From: Len Conrad (LConradGo2France.com)
Date: Sun Oct 02 2005 - 07:30:57 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

>The smtp processes should eventually time out.

mx1# postconf | egrep "smtp_.*timeout"
smtp_connect_timeout = 60s
smtp_data_done_timeout = 60s
smtp_data_init_timeout = 60s
smtp_data_xfer_timeout = 60s
smtp_helo_timeout = 60s
smtp_mail_timeout = 60s
smtp_quit_timeout = 60s
smtp_rcpt_timeout = 60s
smtp_rset_timeout = 20s
...

... not if there were some kind of SMTP activity

>But what do they do to keep the session from timing out?

Somebody said some infra-SMTP TCP trick, but that would have been not
seen by postfix as smtp activity, so postfix would have smtp timed.

I wanted to fix the SMTP problem quickly, not research bit and
bytes. Perhaps smtp sessions were timing out and quickly
re-connecting, since after a postfix start, the number smtp
connections to them rose and stabilized quickly, rather than a gradual ramp up.

It's easy enough for anybody interested in the tarpitting details to
point their postfix smtp at those IPs.
For those Class Cs, the only host addresses I saw were in the range
.1 - .7, nothing higher.

imgate# telnet 204.9.246.1
Trying 204.9.246.1...
^C

imgate# telnet 204.9.246.2
Trying 204.9.246.2...
^C

imgate# telnet 204.9.246.3
Trying 204.9.246.3...
^C

imgate# telnet 204.9.246.4
Trying 204.9.246.4...
^C

imgate# telnet 204.9.246.5
Trying 204.9.246.5...
telnet: connect to address 204.9.246.5: Connection refused
telnet: Unable to connect to remote host

imgate# telnet 204.9.246.6
Trying 204.9.246.6...
telnet: connect to address 204.9.246.6: Connection refused
telnet: Unable to connect to remote host

imgate# telnet 204.9.246.7
Trying 204.9.246.7...
telnet: connect to address 204.9.246.7: Connection refused
telnet: Unable to connect to remote host

However, perhaps their tarpitting daemon waited for specific SAV
"RCTP TO: sendersender.domain" before tarpitting.

Here are the totals/day of smtp timeouts to those Class Cs:

mx1# zegrep -ic "... .. ........ ... postfix/smtp\[.*204.9.24.*timed"
/var/log/maillog.[0-9].gz
/var/log/maillog.0.gz:45848
/var/log/maillog.1.gz:128552
/var/log/maillog.2.gz:40818
/var/log/maillog.3.gz:55149
/var/log/maillog.4.gz:0
/var/log/maillog.5.gz:9488
/var/log/maillog.6.gz:3405
/var/log/maillog.7.gz:3242
/var/log/maillog.8.gz:1357
/var/log/maillog.9.gz:0

... perhaps there was not tricky tarpitting tricks going, but simply
their port 25 that were extremely slow combined with the sheer
volume of spam from them, causing our SAV to have 200+ smtp sessions
tied up continuously.

Our MX runs postgrey, so here are the qty of reject: per domain.tld
for the sender*.domain.tld that were greylisted from those ClassC's
in the last 10 days:

mx1# zegrep -i "... .. ........ ... postfix/smtpd\[.*reject:
.*204.9.24.\." /var/log/maillog.[0-9].gz |\
  awk '{print $(NF-3)}' |\
  cut -d -f 2 | tr -d ">" |\
  cut -d "." -f 2,3 |\
  sort -fn |\
  uniq -ic |\
  less

    6 aboutgoodstuff.com
    9 aboutgoodstuff.net
    9 absinthiated.com
   16 absinthiated.net
   14 absolutelygoodnews.com
   17 absolutelygoodnews.net
    8 absolutelygoods.com
   18 absolutelygoods.net
   11 absolutelyinformation.net
    7 absolutelyname.com
   12 absolutelynation.com
    4 absolutelynation.net
   12 absolutelynews.com
   10 absolutelynews.net
    8 absolutelyobservation.com
    3 absolutelyproducts.net
    7 absolutelysavings.com
   13 acetol.net
    5 acraspeda.com
   12 acraspeda.net
  335 agistment.net
    6 allglobalnews.com
   18 amazinggoodnews.com
    8 amazinggoodnews.net
   14 amazinginformation.net
   12 amazingobservation.com
    9 amazingopinion.net
   30 amazingorder.com
   11 amazingornament.net
   13 amazingowner.net
   15 ancestorial.com
    4 ancestorial.net
    4 anchylosing.com
   14 anchylosing.net
   11 approvedfreestuff.com
   11 approvedgoodnews.com
    9 approvedgoodnews.net
   23 approvedgoods.com
    9 approvedgoods.net
    9 approvedinformation.com
   10 approvedinformation.net
    9 approvednews.com
   10 approvedproducts.net
   12 approvedwaiting.net
    7 approvedwhite.net
   10 arundiferous.com
    5 arundiferous.net
   20 attractivefreestuff.com
   14 attractivegoodnews.com
   11 attractivegoodnews.net
   11 attractivegoods.com
    9 attractivegoods.net
    8 attractiveinformation.com
    4 attractiveinformation.net
    9 attractiveinternet.com
   10 attractivemilk.com
    7 attractivenews.com
   14 attractiveproducts.net
   14 aurazone.com
   14 authenticfreestuff.com
    7 authenticgoodnews.com
    6 authenticgoodnews.net
   16 authenticinformation.net
   15 authenticproducts.net
   19 authenticsavings.com
    7 autogenous.com
   11 autogenous.net
    7 awaynews.com
    9 awaynews.net
   11 bargainfreestuff.com
    8 bargaingoodnews.com
    8 bargaingoodnews.net
    8 bargaininformation.com
   14 bargaininformation.net
   18 beautifulfreestuff.com
    9 beautifulgoodnews.com
    7 beautifulgoodnews.net
    8 beautifulgoods.net
    5 beautifulproducts.net
   11 bettera.net
   15 betterfruit.com
    9 bettergive.net
   12 bettergold.net
   24 bettergoodnews.com
   10 bettergoodnews.net
   13 bettergovernment.net
    5 betterinformation.net
    9 bettertake.net
   18 betterword.net
    5 betteryear.net
    7 bigdogsavings.com
   12 bigdogsavings.net
    4 bigfoodsavings.com
   13 bigfreestuff.com
   10 biggong.com
    9 biggong.net
    5 biggoodnews.com
    9 biggoodnews.net
   25 biggoods.net
    3 bighomesavings.net
   13 bigoar.com
   10 bigoar.net
    7 bigoracle.com
    9 bigoracle.net
   18 bigorganic.com
    3 bigorganic.net
    9 bigproducts.net
   14 bigsavingsbank.com
    7 bigsavingsguy.com
    6 bigsavingsguy.net
   14 bigtopsavings.com
   11 bigtopsavings.net
   19 bluezapp.com
    7 brownmaster.com
   10 buhlwork.com
   12 buhlwork.net
   13 bunglingly.com
   11 bunglingly.net
    8 burkism.com
   20 calcule.net
   11 canthisbetrue.com
   12 chirosophist.com
   10 ciliform.com
   15 circumfluous.com
   14 circumfluous.net
    7 colorfulfreestuff.com
   18 colorfulgoodnews.com
    7 colorfulgoodnews.net
    8 colorfulgoods.net
   12 colorfulinformation.com
   18 colorfulinformation.net
    7 colorfulsavings.com
    8 colossalgoodnews.com
    5 colossalgoodnews.net
    6 colossalgoods.com
   12 colossalgoods.net
   15 colossalinformation.com
    6 colossalinformation.net
    6 colossalproducts.com
   10 colossalproducts.net
   10 colubrine.com
    9 colubrine.net
    2 com
   10 combating.net
   16 completefold.com
    5 completefront.net
    5 completegoodnews.com
    9 completegoodnews.net
   14 completegoods.net
   10 completehumor.net
    7 completeinformation.net
   16 completeproducts.net
   15 confidentialfreestuff.com
    8 confidentialgoodnews.com
    4 confidentialgoodnews.net
    3 confidentialgoods.net
   10 confidentialinternet.com
    7 confidentialnews.com
    9 confidentialproducts.net
   10 confidentialsavings.com
    7 coolletter.com
    3 coolletter.net
    8 crammedgoodnews.com
   13 crammedgoodnews.net
    5 crammedgoods.com
    7 crammedgoods.net
    8 crammedinformation.com
   12 crammedinformation.net
   15 crammedproducts.com
    6 crammedproducts.net
   14 cyclostoma.com
    7 cyclostoma.net
   16 decession.net
   16 deliveredfreestuff.biz
   17 deliveredfreestuff.com
    4 deliveredfreestuff.info
    7 deliveredfreestuff.la
   12 deliveredfreestuff.name
   16 deliveredfreestuff.net
   11 deliveredfreestuff.org
   11 deliveredfreestuff.tv
    6 deliveredfreestuff.us
   21 deliveredgoodnews.com
   11 deliveredgoodnews.net
    5 deliveredgoods.net
   12 deliveredinformation.net
   17 deliveredinternet.com
   12 deliverednews.com
    7 deliveredproducts.net
   16 deliveredsavings.com
    7 detainment.net
    9 diastaticsearch.net
   15 diodont.com
   15 diodont.net
   10 directfear.com
   10 directfiction.net
   10 directflame.com
   12 directfriend.com
   27 directgoodnews.com
    9 directgoodnews.net
    6 directgoods.net
   20 directhumor.net
    6 directinformation.net
    5 discountblow.net
    7 discountgoodnews.com
   10 discountgoodnews.net
   11 discountinformation.net
    4 discountlead.net
   16 dissemblance.net
   21 dissociable.net
   12 divellicate.com
   10 divellicate.net
    8 dobbersearch.net
    7 domainsecurefirst.com
    6 donaldjackson.net
   20 donaldthomas.net
   13 donaldwilson.net
   15 dueful.com
    9 duskiness.com
   14 duskiness.net
   13 e-goodstuff.com
   10 e-goodstuff.net
    9 easilyfreestuff.com
   12 easilygoodnews.com
    5 easilygoodnews.net
    7 easilygoods.com
   24 easilygoods.net
   10 easilyinformation.com
   15 easilylip.net
   12 easilymap.com
    7 easilynews.com
   10 easilyproducts.com
   12 easilysavings.com
   14 eastcoastdns.net
    4 edwarddavis.net
   16 edwardmoore.net
    7 enactment.net
    8 endorsedfreestuff.com
   14 endorsedgoodnews.com
   16 endorsedgoodnews.net
   20 endorsedgoods.com
    6 endorsedgoods.net
   13 endorsedinformation.com
    9 endorsedinformation.net
   25 endorsedproducts.com
   15 endorsedproducts.net
   85 enervating.com
   19 enormousfreestuff.com
    6 enormousinternet.com
   11 enormousnews.com
    9 epiploon.com
    9 epiploon.net
    5 epispastic.com
    3 epispastic.net
    6 epispasticsearch.com
  148 euctical.com
   21 euhemerism.com
   15 euhemerism.net
    8 excitingfreestuff.com
    6 exclusiveact.com
   11 exclusiveadvertisement.com
   16 exclusiveback.net
   12 exclusivebite.net
   14 exclusivefreestuff.com
   11 exclusivewest.com
    7 exorcisedsearch.com
   10 expertfreestuff.com
   10 expertrespect.net
    8 expertside.net
    9 expertsize.net
   14 experttime.com
   10 fairletter.com
   34 fairletter.net
   16 fallowed.net
    5 famousfoot.net
   10 famousisland.net
    7 famousjewel.net
  113 feoffment.com
    8 firstnetsecure.com
   17 firstpointsecure.com
   10 firstsecuredcapital.com
   15 firstsecurelink.com
    7 flattraffic.com
   13 flukeworm.net
   11 forgetfulness.net
   13 fugh.net
    8 fusibility.com
    6 fusibility.net
   12 fusile.com
   28 fusile.net
   14 gallomania.net
   12 georgerobinson.net
    7 georgewhite.net
   15 giganticapple.net
   10 giganticbottle.net
   10 giganticboy.net
   16 giganticnews.com
   11 girdsearch.net
   16 goodgiftsforyou.com
   13 goodstuffcentral.com
    6 goodstuffcentral.net
    7 goodstuffonline.net
   18 goodtimeoffers.com
   10 haplomi.com
    8 haplomi.net
    9 heedful.net
    6 heedfulsearch.com
   17 heedfulsearch.net
   14 homesraffle.com
   10 housecarl.net
    6 hugebut.com
   11 hugeside.net
  328 hylaeosaur.net
   13 illimitation.com
   13 illimitation.net
    7 improvedfreestuff.com
   14 improvedinternet.com
  386 incitant.net
   20 incyour.com
   12 incyour.net
   15 indilatory.com
   14 indilatory.net
    8 instructivenews.com
   10 inswept.com
   13 inswept.net
   10 integratednethosting.com
    7 inwalling.com
    7 inwalling.net
   11 isoprene.net
  366 jeffersonite.com
   15 jobyour.com
    8 jobyour.net
   17 josephwilson.net
    9 justmaster.com
    9 kavasses.net
   11 kennethtaylor.net
    4 largestnews.com
    6 leftsearch.net
   20 lessnews.com
   10 lessnews.net
    9 lightletter.com
    9 lightletter.net
   10 locisearch.net
   16 lowestnews.com
   11 loxodromics.net
   11 macrosporic.com
    6 macrosporic.net
    5 madreporian.com
    9 madreporian.net
   15 mahometanized.com
   10 mahometanized.net
   13 mammothfreestuff.com
   13 maninternet.com
   11 maninternet.net
   10 marazone.com
   21 masterbbs.com
   11 masterface.com
   10 masterthai.com
    6 melanic.net
   13 mineroof.com
   13 minestart.com
   10 minisaver.com
   67 minisaver.net
   17 minisavers.com
    8 minisavers.net
   13 miracleinternet.com
   18 mistthunder.com
   11 mobilegood.com
   15 mobilegood.net
    6 monoroom.com
   10 monoroom.net
    9 monthbrown.com
    9 monthwho.net
    9 motionattraction.net
   12 multisavers.com
   10 multisavers.net
    9 mumnews.com
   11 mumnews.net
    9 nameweek.net
   11 narazone.com
    9 neoroad.com
   12 neoroad.net
    2 net
    9 newsany.com
    5 newsany.net
    8 newsierra.com
   12 newsierra.net
    7 newsolo.com
   11 newsolo.net
   12 newsred.com
    7 newsred.net
   14 newssecond.net
    9 newssign.net
    9 nitromagnesite.com
    4 nitromagnesite.net
    5 nodated.com
   15 nodated.net
    7 noiseglass.net
    6 objectively.net
   19 omnisaver.com
   10 omnisaver.net
    8 opinionamount.net
    5 orgulous.net
   11 ornamentfalse.net
   17 otaries.net
    6 ourzaps.com
   14 outstandinginternet.com
  104 oxacid.com
  346 oystering.net
   14 painstomach.net
    7 paintyellow.net
   20 palkane.com
  452 palkids.com
  475 palkids.net
    8 palkiss.com
   21 palkiss.net
  307 panym.com
   14 parfocal.net
   14 paulpalka.net
    7 pereirazone.com
   14 plantshoe.com
   12 poisonable.com
   19 poisonable.net
   16 positionfemale.net
    7 positionside.net
   14 powderhair.net
   15 powerfulinternet.com
    7 powerfulnews.com
   18 pressinternet.com
    9 pressinternet.net
    9 pressuris.com
    8 pressuris.net
   10 pressurisation.com
   19 pressurisation.net
   17 pressurise.com
   12 pressurise.net
   11 pressurised.com
   18 profitparcel.com
   12 profuselygoods.com
   10 profuselygoods.net
   15 profuselyproducts.net
    9 proraffle.com
    4 proron.com
    7 proron.net
    8 provengoodnews.com
   19 provengoods.net
   16 proveninformation.com
   21 proveninformation.net
    8 proveninternet.com
   10 pugging.net
    7 pullheat.com
   15 punishmentroom.net
    9 purlsearch.net
   10 qualitygoodnews.net
    8 quavering.com
   16 quavering.net
   15 quicklygoodnews.com
    7 quicklygoodnews.net
    5 quicklygoods.com
   16 quicklygoods.net
    2 quicklyinformation.com
   10 quicklyinformation.net
    7 quicklynews.com
    5 quicklyproducts.com
   13 quicklyproducts.net
   11 raregoodnews.com
    3 raregoodnews.net
    6 raregoods.net
   14 rareinformation.net
   10 rareproducts.net
   11 reciprocalness.net
   21 recreance.net
    4 reducedgoodnews.com
   14 reducedgoodnews.net
   11 reducedgoods.net
   17 reducedproducts.net
   11 refundablegoodnews.com
   10 refundablegoodnews.net
    6 refundableproducts.com
   11 refundableproducts.net
   13 remarkablegoodnews.net
   12 remarkablenews.com
    9 repercussive.com
    7 repercussive.net
    8 repinesearch.net
   12 responsal.com
   12 responsal.net
    9 revealment.com
   16 revealment.net
    5 revolutionaryinternet.com
    5 rightletter.com
   13 rightletter.net
   10 rimose.com
   11 rimose.net
    9 roadinternet.com
   14 roadinternet.net
   15 ronaldallen.net
   10 ronaldclark.net
   12 ronaldmoore.net
    4 ronaldtaylor.net
   13 ronaldthomas.net
   13 ronaldwilliams.net
   17 roughdraw.com
    3 roughdraw.net
    4 rubricate.net
   10 rumply.net
    9 saltfoot.com
    7 saltfoot.net
    8 sarazone.com
    9 saveinternet.com
    6 saveinternet.net
    7 scarpsearch.net
   11 schilerization.com
   13 schilerization.net
    5 schilerizationsearch.net
   14 secretsinternet.com
    5 secretsnews.com
    5 securecross.com
   13 securegirl.com
    5 securemovie.com
   11 securenetexchange.com
   24 securerock.com
   14 securewill.com
   20 semeiography.com
   11 semeiography.net
    9 semeiographysearch.com
   18 sensationalinternet.com
   13 sesquialteral.com
    7 sesquialteral.net
   10 shiftiness.net
    6 shopyour.com
   10 shopyour.net
   18 shrewish.net
    3 sizablenews.com
    5 slickersearch.com
    8 slickersearch.net
    9 soloron.com
    6 soloron.net
   11 somite.net
    8 specialism.net
    3 startlinginternet.com
    7 startlingnews.com
   14 stomatic.com
    4 stomatic.net
   13 strangeinternet.com
   10 stronginternet.com
    9 sturdyinternet.com
   11 sturdynews.com
   15 subereous.com
   10 subereous.net
   10 successfulinternet.com
   13 successfulnews.com
    8 supersavingsnews.com
    7 supra-acromial.com
   13 supra-acromial.net
   12 suprasternal.com
   12 suprasternal.net
   14 surffreedom.net
   15 surpriseinternet.com
    6 sylvanium.com
    5 sylvanium.net
    8 synonyma.com
   16 synonyma.net
   14 tabellionsearch.net
   13 taptime.com
   12 tartrelic.com
   22 tartrelic.net
   10 teemful.net
   13 termsearch.net
    6 thinletter.com
    4 thinletter.net
   17 thomasharris.net
   15 timearea.com
   11 tinnersearch.net
    8 todnews.com
    8 todnews.net
  142 tracheobranchia.com
    8 trafficmess.com
   67 trafficopen.com
    3 transshaped.net
    7 tremendousinternet.com
    9 tremendousnews.com
   10 turanian.com
   11 turanian.net
    6 undulatesearch.com
   16 unpursed.com
   12 unpursed.net
   12 urontechnology.com
   13 usefulgoods.net
    5 usetime.com
   15 usurious.net
   15 valuablegoods.com
   16 valuablegoods.net
   14 valuableinformation.net
   10 valuableinternet.com
   10 verygoodoffer.com
    4 vettime.com
   14 wannews.com
    5 wannews.net
   15 wealthgoodnews.com
   10 wealthgoods.com
   11 wealthgoods.net
   17 wealthinternet.com
   12 wealthproducts.net
   14 weirdgoodnews.com
    6 weirdgoodnews.net
   11 weirdgoods.net
   19 weirdinformation.com
   13 weirdinformation.net
   12 weirdinternet.com
   11 weirdproducts.net
    9 westcoastdns.net
   11 wholesalefiber.net
    6 williamrobinson.net
    6 williamwilliams.net
   10 wirbling.com
    5 wirbling.net
    7 wirblingsearch.com
    6 wonderfulgoodnews.com
    7 wonderfulgoodnews.net
    9 wonderfulgoods.net
    3 wonderfulinformation.com
   18 wonderfulinformation.net
    8 woodinternet.com
   19 woodinternet.net
    9 wordsman.net
    8 yourfort.com
   16 yourfort.net
   23 yournow.com
   11 yournow.net
   11 yourzap.com
    3 zapatour.com
   10 zapgourmet.com
   11 zaptour.com
    9 znapinc.com
    7 zowltd.com

Len

_____________________________________________________________________
http://IMGate.MEIway.com : free anti-spam gateway, runs on 1000's of sites

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]