Re: backscatter joe-job attack

[Bob Proulx]

Bob Proulx wrote:
> FYI: I routed a nonexisting address to /dev/nullon on debbugs tonight
> to mitigate a backscatter joe-job style attack to it.  Some dozens of
> outlook.com exit nodes are connecting and dumping what looks like
> backscatter to an 11 digit number address.  WAT?  I have no idea.  But

grep'ing the logs I see this has sent 12053 of them silently to
/dev/null so far since yesterday.  Exim logs flummox me but I think
there have been 55108 messages to that address in total in the last
two days.  The listhelper anti-spam auto-discarded the first many
thousands before I routed it to /dev/null upstream.

Mostly things have stopped but I am still seeing a very few to that
address this afternoon.  Probably mostly done but some still draining
from mail queues.  Might see a few more drag in over the next couple
of days as machines process their deferred queues.

Bob