On Tue, 2004-12-07 at 14:59 +0000, Peter Bowyer wrote:
> Chris Edwards <chris@???> wrote:
>
> > - It opens ridiculous numbers of parallel connections. We have
> > observed over 170 connects in a *single second*.
>
> qmail, perhaps?
Unlikely - qmail may throw stuff at a stupid rate, but it doesn't throw
away things that get a 4xx on connect. Sounds very much like fully
fledged spamware.
It appears to be Lyris (judging from the SMTP banner on that server) - I
find it hard to believe that Lyris is that broken. Sounds like a good
case for greylisting (with a 24 hour expiry period).
Nigel.
--
[ Nigel Metheringham Nigel.Metheringham@??? ]
[ - Comments in this message are my own and not ITO opinion/policy - ]
