On 6/8/2017 11:05 PM, Richard James Salts via Exim-users wrote: > On 09/06/17 01:29, Jerry Stuckle wrote: >>> >>> Probably not rejections, but possibly slowness (e.g. >>> https://serverfault.com/ >>> questions/350023/tc-ingress-policing-and-ifb-mirroring to limit the >>> rate they >>> can send to 300 bit/s or something). >>>> One can only hope :) >>>> >>>> Jerry >> No, I don't believe it was slowness because the SPAM was not coming from >> just one server or ISP. It was coming from many MTAs, all over the >> world. Some might even have been compromised home computers used as >> spam relays; I never dug that far. > I was trying to say, they probably won't care about rejections, because > it gives them information, but a slow connection costs them an outgoing > conection > for extended periods, and they may eventually blacklist the server from > their spam runs. >> >> Jerry >> > >
Sorry, I misunderstood. Yes, a slow connection can cause them problems. But since they're using multiple systems to source the messages, they probably don't care. They could have 50 different scripts running, each one connecting to a different server to forward their spam. If it takes two seconds or two minutes, they don't care - they won't be using that system again. Looking now at yesterday's logs the script blocked 66 emails, no more than two of them from the same domain or server. And they came in bunches - several within a one or two minute period, then a break. So it is obviously someone with more time than brains to set up multiple domains and websites to do his spamming. Jerry -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/
