On Sun, Sep 23, 2007 at 03:33:03PM -0700, patrick keshishian wrote:
quoted text
> At around 1:40 PM (PDT) my SMTP server started getting flooded
> by enormous amount of connections.  The connections were for
> seemingly random "users" @my-domain-name.
> 
> I'm running spamdb in greylist mode, but these servers were
> getting white-listed very quickly.
> 
> $ /usr/sbin/spamdb | /usr/bin/grep -c ^WHITE
> 717

I've seen something *very* similar. In my case the "user" portions
seemed random at first glance, but some were repeated a LOT. See if you
have that, too. If so, enter those "random" addresses as SPAMTRAP
entries. That way they're blocked for 24 hours, and will reblock
themselves if they persist.

I had also done a log tailer that added to a blacklist, but that turned
out not to be needed with the above. ymmv.

-- 
Darrin Chandler            |  Phoenix BSD User Group  |  MetaBUG
dwchandler@stilyagin.com   |  http://phxbug.org/      |  http://metabug.org/
http://www.stilyagin.com/  |  Daemons in the Desert   |  Global BUG Federation