Philip Prindeville wrote: > Rather than blocking the entire network (CIDR block) automatically, at > least blacklisting > the individual address for 3-5 days?
If I did that, I'd end up blocking Hotmail and MSN's servers more-or-less permanently. While I might not think that's a Bad Thing, it's probably not acceptable for most MIMEDefang users. Unfortunately, the mapping between spammer and IP address is rather tenuous, from the extreme of many spammers per IP address (Hotmail) to many IP addresses per spammer (your average zombie spam-run.) What I do on my server is ban an IP address for an hour if I detect a dictionary attack (too many invalid recipients). That seems to work pretty well. Regards, David. _______________________________________________ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. Visit http://www.mimedefang.org and http://www.roaringpenguin.com MIMEDefang mailing list [email protected] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
