Moin, Am Sa den 3. Okt 2026 um 11:01 schrieb Slavko: > Not special, i check EHLO's address literals with client's IP for long > time, and (with some exceptions of private ranges and so) i reject AUTH > command in exim if literal doesn't match IP and log that, eg: > > H=([124.83.9.141]) [65.20.141.202] rejected AUTH LOGIN:H=[65.20.141.202] > HDIFF=124.83.9.141 > > (that means connection from 65.20.141.202, with EHLO [124.83.9.141])
How do you get the IP in HELO? I always never seen that. Usually it is a random (mostly not existing) hostname. > From my experience, time when one (or small amount of) IP hammered > server with something bad is gone and blocking IP/CIDRs is just a > nostalgic idea... Nowadays botnets has in average 4k bots (IIRC),with > median about 2k (and spikes over 100k), and when disrupted botnet is > (loudly) announced, it means (for me) only that new wave of attempts > (IPs) will start... AI makes it even worse :-( > > I see that for some years, difference is only in counts, but mostly far > from (D)DOS (from tens to hundreds/day), eg. yesterday it was 158 unique > IPs (but yes, (tens of) thousands of IPs already blocked by various > rules). > > Some (long) time ago i tried to count repeats, but that was useless, > only small amount of repeats from the same IP/CIDR, nor from reasonable > small/big CIDR blocks, nor in client's IP, nor in EHLO literal... IMO, > they are aware as simple is to block IPs/CIDRs... As I limit auth only to countries DE,CH,FR,GB,IE, I don't see most of the crap. However, as I mentioned earlier, I see similar stuff on my web server. I have a base line of about 100 hits to my fail2ban rules but some time ago I had way over 1000 and that was starting when the AI agents came out big. So I don't think that they are common bot net. I never seen that big attacks before AI. I think, that it is AI bots running on client machines and been meshed together. And no IP is used twice; what make it sensless to block them. For a time, it was helping to block full BR country. By the way, facebook did work the same as all that AI bots and indexing from client systems instead from their own servers. And they get their stuff to index even from private browsing history on that devices! > When you take look at last bigger MSA attempt (~1000 IPs/month is my > threshold, beware, logarithmic scale) here > https://foto.slavino.sk/%C3%9Atoky/Blokovania_MSA/msa_2026-04.png > you can see 1138 unique IPs, from 764 different CIDRs, from 426 ASNs > and 94 countries... How do you create that nice graphics? :-) Gruß Klaus -- Klaus Ethgen http://www.ethgen.ch/ pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen <[email protected]> Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C
signature.asc
Description: PGP signature
_______________________________________________ mailop mailing list -- [email protected] To unsubscribe send an email to [email protected]
