"patrick keshishian"  writes:
> I'm running spamdb in greylist mode, but these servers were

quoted text
> getting white-listed very quickly.

Then it sounds almost like you were running with a too short passtime,

but then that's easy to adjust.
> At around 1:40 PM (PDT) my SMTP server started getting flooded

quoted text
> by enormous amount of connections.  The connections were for

> seemingly random "users" @my-domain-name.

We've been seeing a lot of that here, too.  Mostly it's a few (maybe

20) a day to the most widely known domain here, then occasionally

somebody pushes the "generate" button for too long and one domain

almost nobody actually uses gets the bouces for 700+ fake

addresses[1].  Bob Beck's greyscanner is rather effective, as is the

more manual methods I've blogged about the observations quite a bit,

starting with [2].
Short summary for those who are not too interested in blog posts: I

started seeing more than the usual amount of bounce activity in my

mail server log summaries, close enough to what you describe.  So

after a bit of thinking and log browsing I decided this was generated

mainly by misconfigured mail servers bouncing spam.  Then I decided I

wanted to do an experiment, to see if I could poison the well and at

the same time get a feel for the data I was collecting.
I started publishing the fake addresses on a web page[3] as well as

entering them into the list of trap addresses.  I've been seeing

evidence that the addresses are actually being harvested and used as

to-be-spammed addresses too: addresses which are all uppercase on the

web page turning up in the spamd logs and greylist dumps in all

lowercase, addresses which have been on my flypaper list for months

turn up all the time, and we see a steadily growing number of hosts in

TRAPPED state.
My users here are not getting any more spam than they used to (as

close as does not matter to none), false positives are pretty much an

unknown, and it looks like we're succeeding in making the spammers

work harder.
[1] http://bsdly.blogspot.com/2007/08/lady-in-distress-or-then-again-maybe.html

[2] http://bsdly.blogspot.com/2007/07/hey-spammer-heres-list-for-you.html

[3] http://www.bsdly.net/~peter/traplist.html
--

Peter N. M. Hansteen, member of the first RFC 1149 implementation team

http://bsdly.blogspot.com/ http://www.datadok.no/ http://www.nuug.no/

"Remember to set the evil bit on all malicious network traffic"

delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.