[Snort-users] List Bounces?

Matt Kettler mkettler at ...4108...
Mon Oct 25 17:03:02 EDT 2004


At 01:42 PM 10/25/2004, sam at ...5202... wrote:
>Agreed.  Someone doing some vacation/out of office trolling would be nice.
>
>
> > Will someone do something about this? Every time I post, I get error
> > messages from weird places that I can do nothing about.
> > --
>
> >
> > Begin forwarded message:
> >
> >> From: postmaster at ...12594...

I block the entire imedia.fr domain because of this crud. If the site admin 
over there can't learn to use envelope returns properly, I want no part of 
mail coming from their servers. They are broken, and dangerous. Once I stop 
seeing their barrage of misdirected bounces getting kicked off my server, 
I'll stop rejecting them. Until then, I got 550's a plenty.

However, it would be nice if the snort-users list admin could track them 
down and remove the offending addresses directly. This has been going on 
for a long time, and it's getting silly.

In the interim might I suggest this bit from my /etc/mail/access file (for 
sendmail):

mail.easynet.fr                 550     mail systems with broken bounces 
are not welcome here
postmaster at ...12594...            550     mail systems with broken bounces 
are not welcome here
212.180.1.138                   550     mail systems with broken bounces 
are not welcome here
212.180.1.136                   550     mail systems with broken bounces 
are not welcome here

Cleans up the problem real fast. Just run make on the directory after you 
edit the file.

Same goes for ipadnet.com.br who are also doing the "bounce to from instead 
of envelope" trick:

200.249.204.129                 550     mail systems with broken bounces 
are not welcome here
postmaster at ...12448...       550     mail systems with broken bounces 
are not welcome here


The whole stunt is just as brilliant as spammers who try to spam 
"DuhInvalid at ...4108..." (I've used it in examples before). Gee do you 
think the address is valid?








More information about the Snort-users mailing list