Thursday, March 31, 2022

update on mail.stormerantispam.us

 It appears the attacks have mostly subsided.  A large number of failed smtp attempts were blocking legit users from making connections to the mail server.  The primary country that was doing this came from Bulgaria.  I have blocked the entire country in the firewall.  If you have clients or people you correspond with in Bulgaria, they will need to communicate some other way.

Here's a list of 'hits' to the logs from a few of the IP addresses:

root@mail [/var/log]# fgrep -c 87.246.7.229 exim_mainlog

27613

root@mail [/var/log]# fgrep -c 212.70.149.57 exim_mainlog

49473

root@mail [/var/log]# fgrep -c 212.70.149.89 exim_mainlog

31204

root@mail [/var/log]# fgrep -c 87.246.7.246 exim_mainlog

94266


The bold numbers are the number of times that IP address had attempted to 'authenticate'.  These repeated authentications caused problems for everyone.   I will continue to monitor it, but it most appears to be over.   Let me know if you continue to have issues.