Submission + - What do you do when a botnet spams you to death? 1
micromuncher writes: "A month ago I was a happy IT geek. I host my own web site and email server (and have been for over 10 years), and I had been running MDaemon (v7) successfully for four years. A low percentage of spam reached my desktop, though admittedly its gone from a few a day a couple years ago to about twenty now, but then something bad happened. I had measures in place to rudely disconnect spammers; fail on no RDNS, fail on no MX records, and use several spam filters to weed out spam. But the trouble came, from what I can tell, when a non-existant email account got into a botnet — and from what I can tell — its huge. Even though my connections were throttled, I received so many requests, and something odd about the requests, it crashed my mail server. So I flipped on tarpitting and the like, and set my timeouts short, and throttle tight... and I still got crushed. All of the originating servers were passing through the spam filters. Most of them were passing through RBLs. I tried to find information on current spam outbreaks; and I didn't find much useful. I contacted my mail server vendor, and they suggested I fork out the money for an upgrade (that I did), that had the feature of a "bait account". But I'm still getting overloaded by spam (though I am not crashing as far as I can tell.)
So my questions to the world; how the heck do you monitor spam outbreaks? What are the most effective measures for dealing with botnets (where all the senders seem legit)? And what the heck can you do to stick it to the foul scum who either advertise through this fraud, or facilitate it?"
