Messages in this thread | | | Date | Fri, 9 Jan 2009 11:14:04 -0700 (MST) | Subject | Re: [ANNOUNCE] Kernel Blocking Firewall | From | jmerkey@wolfmoun ... |
| |
> jmerkey@wolfmountaingroup.com wrote: >> Allowing a server on a dynamic IP range to act as a mail server is what >> is >> stupid. > > Sorry to be argue semantics, but I think it's SMTP clients that are the > major cause of spam. Many, probably most, ISPs provide an SMTP relay > for their subscribers, and blocking these dynamic addresses doesn't > present a hard impediment for delivery of their mail to you. None the > less, to say that people on a dynamic IP address should be *obliged* to > go through a relay is offensive. (Not that you did say that, but I > think it's what you had in mind.) >
That's good point, but not what I see in actual practice. These zombie systems don't seem to use the smtp gateway for their ranges, they send the emails direct. From my observations, most of these systems tend to stay zombies, since almost all of them are windows systems.
I have discovered that by using this method to block them, once they open a connection and I start dropping traffic while the connection is left open it "tarpits" the bots and causes a cascade failure in the botnet network for about 20 minutes until the systems start skipping the mail server doing the bocking.
Jeff
| |