Re: Mailserver at 52.169.9.191

2017-11-08 Thread Kevin A. McGrail
On 11/8/2017 3:36 PM, Dave Jones wrote: I think there are old "zombie" scripts out there trying to curl fetch updates outside of using sa-update.  Maybe they are trying to fetch them into their own copy/repo or something?  I don't know for sure. Should we remove DNS entries for all "ancient" v

Re: Mailserver at 52.169.9.191

2017-11-08 Thread Dave Jones
On 11/08/2017 01:45 PM, Kevin A. McGrail wrote: On 11/8/2017 10:02 AM, Dave Jones wrote: Dave, with rules how many versions do we publish now?  Just one with a cname for a few versions?  Which versions?  Sorry, I can't figure out how to get into PowerDNS to check! http://svn.apache.org/vi

Re: Mailserver at 52.169.9.191

2017-11-08 Thread Kevin A. McGrail
On 11/8/2017 10:02 AM, Dave Jones wrote: Dave, with rules how many versions do we publish now?  Just one with a cname for a few versions?  Which versions?  Sorry, I can't figure out how to get into PowerDNS to check! http://svn.apache.org/viewvc/spamassassin/dns/spamassassin.org?view=marku

Re: Mailserver at 52.169.9.191

2017-11-08 Thread Dave Jones
On 11/08/2017 08:45 AM, Kevin A. McGrail wrote: I’m very much in favor of aggregating and analyzing data, that’s bascially what we do at dnswl.org  :) Having said that, I usually don’t see that much load on our sa-update mirror, just a bit of bandwidth being used. Well

Re: Mailserver at 52.169.9.191

2017-11-08 Thread Kevin A. McGrail
I’m very much in favor of aggregating and analyzing data, that’s bascially what we do at dnswl.org  :) Having said that, I usually don’t see that much load on our sa-update mirror, just a bit of bandwidth being used. Well nice sleuthing to figure out the culprits compan

Re: Mailserver at 52.169.9.191

2017-11-07 Thread Matthias Leisi
> It's the only time I have ever seen it abused to be honest. I added the Azure > abuse team so it should get resolved and they responded that they are > escalating it to their CERT team. Plus I am curious what the hell is going on > so I'll ask them to follow-up Indeed, I should have done that

Re: SRX1403554742ID - FW: Mailserver at 52.169.9.191

2017-11-07 Thread Kevin A. McGrail
Online Safety --- Original Message --- *From* : "MS Online Customer Service (abuse)" *Sent* : Tuesday, November 7, 2017 3:43:28 AM UTC *To* : "mosaf.mrea.ww.00.en.cvg.mnl.au.t01.spt.sg...@css.one.microsoft.com" *Subject* : FW:

Re: Mailserver at 52.169.9.191

2017-11-07 Thread Kevin A. McGrail
+sysadmins@s.a.o -Microsoft Hi Matthias, It's the only time I have ever seen it abused to be honest. I added the Azure abuse team so it should get resolved and they responded that they are escalating it to their CERT team. Plus I am curious what the hell is going on so I'll ask them to follow