Tag Info

New answers tagged

0

Doing this manually is going to be a nightmare and definitely a case of whack-a-mole. The real question is: what kind of spam attacks? In nearly all cases these things are widespread and common enough that it can be mitigated in at least half of cases through using a public blacklist or tweaking some settings. If it's: comment spam, see if your ...


0

IPtables is pretty easy. First do iptables --list to get a list of your chains and rules. The default is pretty simple. If the below doesn't work or you don't see an INPUT rule, post the output of that command with the IP's removed for security. The following adds a rule to log traffic from a server and then drop it and saves your chains so that they ...


0

May be you want to have a simple bash script or your prefered shell script. #!/bin/bash shit="/tmp/null_ips" ips=$(grep -Ev "^#" $shit) for ip in $ips do ip route add blackhole $ip done further: Check if you already blocked those ip.. ip route show


1

Is there a reason you want to null route the hosts vs. just blocking them with IP tables? Either way both IPtables rules and static routes can be managed via set config files in ubuntu. You could write a script to parse a text file and then modify the route or iptables config files, but that seems circular. It would essentially be creating a config file ...


6

We mitigated the same issue by using an outside vendor as our e-mail gateway (in our case, Exchange Online Protection but there's many other comparable services). We then configured all our e-mail sending services to use that as the smarthost. Now, all our outgoing messages are associated with the reputation of the external e-mail gateway. Because of that, ...


15

I'm looking forward to seeing other answers to this question, but my feeling is that if you're catching compromised mail accounts after only 40 spams have got through, you're doing really well. I'm not sure I could detect similar abuse so quickly, and the prospect worries me. But I'm appalled that seven sets of credentials were stolen in the past week ...



Top 50 recent answers are included