Ahoj,
Dňa 2 Oct 2026 13:53:51 -0400 "John Levine" <[email protected]> napísal:
> Maybe I'm special. I tweaked it to report the HELO strings which
> turn out to be mostly bracketed IP addresses, or
> wsip-174-68-47-148.lv.lv.cox.net or 111-70-33-194.emome-ip.hinet.net.
Not special, i check EHLO's address literals with client's IP for long
time, and (with some exceptions of private ranges and so) i reject AUTH
command in exim if literal doesn't match IP and log that, eg:
H=([124.83.9.141]) [65.20.141.202] rejected AUTH LOGIN:H=[65.20.141.202]
HDIFF=124.83.9.141
(that means connection from 65.20.141.202, with EHLO [124.83.9.141])
I have custom fail2ban's jail for that, which feeds firewall on one
attempt, and increases bantime (initial is 10 days) on repeats, but
that is waste of resources, as near no repeats happens in 40 days (10 +
3x10 -- fail2ban's math), it helps only for that time (max blocked
packets for one IP is currently 36, as ipset reports).
From my experience, time when one (or small amount of) IP hammered
server with something bad is gone and blocking IP/CIDRs is just a
nostalgic idea... Nowadays botnets has in average 4k bots (IIRC),with
median about 2k (and spikes over 100k), and when disrupted botnet is
(loudly) announced, it means (for me) only that new wave of attempts
(IPs) will start... AI makes it even worse :-(
I see that for some years, difference is only in counts, but mostly far
from (D)DOS (from tens to hundreds/day), eg. yesterday it was 158 unique
IPs (but yes, (tens of) thousands of IPs already blocked by various
rules).
Some (long) time ago i tried to count repeats, but that was useless,
only small amount of repeats from the same IP/CIDR, nor from reasonable
small/big CIDR blocks, nor in client's IP, nor in EHLO literal... IMO,
they are aware as simple is to block IPs/CIDRs...
> Haven't been able to look at the AUTH strings yet because I'm using a
> library that not unreasonably doesn't want to show them in case
> they're typos of real credentials.
Some (long) time ago i inspect credentials in that, but that shows
nothing useful too...
When i start to serve own public services, i was aware of Internet
noise, but i was surprised and wondering. Nowadays, when i see new
wave, i just sit down quietly in the corner and wait until it passes...
Or, when I want to, i use that as traffic generator to test new
rules...
When you take look at last bigger MSA attempt (~1000 IPs/month is my
threshold, beware, logarithmic scale) here
https://foto.slavino.sk/%C3%9Atoky/Blokovania_MSA/msa_2026-04.png
you can see 1138 unique IPs, from 764 different CIDRs, from 426 ASNs
and 94 countries...
regards
--
Slavko
https://www.slavino.sk
_______________________________________________
mailop mailing list -- [email protected]
To unsubscribe send an email to [email protected]
