On Mon, Nov 17, 2008 at 1:35 PM, Barry Shein
<bzs(_at_)world(_dot_)std(_dot_)com> wrote:
You should watch my mail logs here. It's an odd day I don't have
SEVERAL simulataneous dictionary attacks (aaa(_at_)theworld(_dot_)com, no such
user, aab(_at_)theworld(_dot_)com, no such user), often coming from big ISPs
like
earthlink which is kinda frustrating: They shut it down and it pops up
again w/in 24 hrs and they shut it again and again and then they get
sick of shutting it down and we get sick of asking and suggest they
fix their system which raises tension etc...
All day, all night, every day, every night, day in, day out.
And that's just ONE easily log-summarized (I have script which gives
me a frequency chart of sites generating the most user unknowns) spam
form. Most of the traffic isn't that, it's just being pounded from
lists spammers have. All day, all night...
STAGGERING!
I'm wondering why World doesn't script a little log watcher that
identifies the source of dictionary attacks and drop all their packets
at the perimter for a few hours when they occur.
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
https://www.irtf.org/mailman/listinfo/asrg