We've seen a big spike in list bombing in the last few weeks. Individual mailboxes receiving 10k+ "confirm your subscription" emails, all from legitimate ESPs. So we heavily rate limited them thinking/hoping that ESPs would see their queues build up, prompting them to look and see what wasn't getting delivered, perhaps even detect the abuse and stop it!! (I know, I'm dreaming.)
List bombing isn't anything new. I figured most would have had something in place to detect this by now. Perhaps a new technique is being used by the abuser? These attacks are spread across hundreds of ESPs, but each individual one is sending anywhere from 30 to 150 unique confirmation messages per hour .. to the SAME rcpt. That should be pretty detectable. Anyway, if you're an ESP and you find yourself being heavily rate limited by one or more US/CA/EU ISPs then you might want to check for some list bombing abuse. Thanks, -R. Smith
_______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
