From owner-freebsd-isp  Sun Aug  5 17:17:27 2001
Delivered-To: freebsd-isp@freebsd.org
Received: from inet03.citec.qld.gov.au (inet03.citec.qld.gov.au [203.5.10.10])
	by hub.freebsd.org (Postfix) with ESMTP id 1CFCF37B403
	for <freebsd-isp@FreeBSD.ORG>; Sun,  5 Aug 2001 17:17:22 -0700 (PDT)
	(envelope-from sgcccdc@citec.qld.gov.au)
Received: by inet03.citec.qld.gov.au; id KAA01949; Mon, 6 Aug 2001 10:17:16 +1000 (EST)
Received: from citecub.citec.qld.gov.au( 131.242.4.98) by inet03.citec.qld.gov.au via smap (V2.0)
	id xma001022; Mon, 6 Aug 01 10:16:38 +1000
Received: from guru.citec.qld.gov.au by citecub.citec.qld.gov.au (SMI-8.6/SMI-SVR4)
	id KAA13768; Mon, 6 Aug 2001 10:16:38 +1000
Received: from localhost (sgcccdc@localhost)
	by guru.citec.qld.gov.au (8.9.3/8.9.3) with ESMTP id KAA39036;
	Mon, 6 Aug 2001 10:16:27 +1000 (EST)
	(envelope-from sgcccdc@citec.qld.gov.au)
X-Authentication-Warning: guru.citec.qld.gov.au: sgcccdc owned process doing -bs
Date: Mon, 6 Aug 2001 10:16:26 +1000 (EST)
From: Colin Campbell <sgcccdc@citec.qld.gov.au>
To: <Keith@apcs.com.au>
Cc: <freebsd-isp@FreeBSD.ORG>
Subject: Re: Sendmail / ipfw /username collecting
In-Reply-To: <XFMail.20010804091500.Keith@apcs.com.au>
Message-ID: <Pine.BSF.4.33.0108061014190.89713-100000@guru.citec.qld.gov.au>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-isp@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-isp.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-isp>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-isp>
X-Loop: FreeBSD.org

Hi,

The 213.122.x.y addresses are managed by (I think) British Telecom. Their
whois entry also says:

remarks:      Please send abuse notification to abuse@btinternet.com

I'd try that along with logs giving date and time of "attacks". They might
just decide to terminate this (ab)user's connection.

Colin

On Sat, 4 Aug 2001 Keith@apcs.com.au wrote:

> Hi All
>
> I'm currently under attack to my Sendmail (ip's below)
>
> Every time I add them to the ipfw they start an hour or two
> later with a new ip. Can I automate ipfw or sendmail to stop this.
>
> 213.122.48.161  213.122.192.99 213.1.128.134
> 213.122.114.186 213.122.52.253 213.122.78.31


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-isp" in the body of the message