Are you seeing any significant portion of these messages bearing the Form-Sub header? (documented in https://tools.ietf.org/html/draft-levine-mailbomb-header-01)
--Kurt On Mon, Nov 25, 2019 at 10:19 AM rps462 via mailop <[email protected]> wrote: > We've seen a big spike in list bombing in the last few weeks. Individual > mailboxes receiving 10k+ "confirm your subscription" emails, all from > legitimate ESPs. So we heavily rate limited them thinking/hoping that ESPs > would see their queues build up, prompting them to look and see what wasn't > getting delivered, perhaps even detect the abuse and stop it!! (I know, I'm > dreaming.) > > List bombing isn't anything new. I figured most would have had something > in place to detect this by now. Perhaps a new technique is being used by > the abuser? These attacks are spread across hundreds of ESPs, but each > individual one is sending anywhere from 30 to 150 unique confirmation > messages per hour .. to the SAME rcpt. That should be pretty detectable. > > Anyway, if you're an ESP and you find yourself being heavily rate limited > by one or more US/CA/EU ISPs then you might want to check for some list > bombing abuse. > > Thanks, > -R. Smith > _______________________________________________ > mailop mailing list > [email protected] > https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop >
_______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
