3 ms·
Running your own mail server is a great source of data to identify botnet-compromised hosts. When I started banning IPs that send "HELO <myhostname>" for 24 ho
by dpifke 4y ago
Running your own mail server is a great source of data to identify botnet-compromised hosts.
When I started banning IPs that send "HELO <myhostname>" for 24 hours, I cut the number of fake login/registration attempts on a bunch of my web-based projects by ~50%.
It works the other way, too. Temporary bans on hosts that try to access /wp-admin (I don't run Wordpress anywhere) cut my email spam significantly.
(Some day, I'll get around to implementing a real reputation tracking system, with exponential ban lengths.)
- bombcar 4y agoThis is an important aspect of it - you can use information on one angle of attack to protect other devices. Do note that doing this kind of thing can block people on Tor, because Tor is used for attacks quite often, also.