[prev in list] [next in list] [prev in thread] [next in thread] 

List:       inet-access
Subject:    Re: whynot.net -- DOS or junk
From:       Paul Chvostek <paul () it ! ca>
Date:       2000-12-31 21:00:06
[Download RAW message or body]


I'm seeing similar stuff on a mail server with about 15000 accounts,
with about 25500 inbound messages per day.  I only have logs going
back to December 10th, and the highest number in a day was 294 of 'em
on December 20th.  The average over the last two weeks is 52 per day.

Aside from the odd host at bigfoot.com, trentu.ca, uact.net and
others, ours are mostly coming from 210.x.x.x as well, resolving (if
they resolve at all) to hosts in .tw, .hk, .jp, .kr, .cn, and .sg,

Of course, we've had the domain whynot.net manually blocked in our
sendmail access file for over a year.  I've *never* had a response from
anyone there, despite complaints going back to late 1998.  (And yes,
I've provided an unblocked contact address. :] ) And of course, I've
never heard any users complain that they couldn't receive mail from
people within that domain.

It looks as if the folks at whynot.net are not related to this use
of their domain, but the block certainly reduces the amount of trash
coming in to our network.


On Sat, Dec 30, 2000 at 10:42:20AM -0600, Douglas R. Locke wrote:
> 
> 
> For the last week or so I've been getting 100's to 1000's or attempted
> emails from   "trashchars"@whynot.net  relayed from multiple different
> networks (I've got 40 or 50 of the blocked now).  The domain name doesn't
> resolve so my email server rejects the attempt.  If I don't block the ip
> at my border, the volume seems to just grow.  The vast majority of the
> addresses are Asian  210.xxx.yyy.zzz .
> 
> I noticed it when my mail server started loading up to something like
> 50%-60% load.
> 
> Is this a general DOS or something else?  Anyone else seeing it?
> 
> Thanks,
> 
> Doug
> 
> -
> List archives can be found at: <http://www.moongroup.com/inet.php>
> Send 'unsubscribe' in the body to 'list-request@inet-access.net' to leave.
> Eat sushi frequently.   inet@inet-access.net is the human contact address.

-- 
  Paul Chvostek                                            <paul@it.ca>
  Operations / Development / Abuse / Whatever      vox: +1 416 598 0000
  IT Canada                                           http://www.it.ca/

-
List archives can be found at: <http://www.moongroup.com/inet.php>
Send 'unsubscribe' in the body to 'list-request@inet-access.net' to leave.
Eat sushi frequently.   inet@inet-access.net is the human contact address.

[prev in list] [next in list] [prev in thread] [next in thread]