From mboxrd@z Thu Jan  1 00:00:00 1970
Message-ID: <91428b31c1ef98ddc01e31bf249b0b7a@quanstro.net>
To: 9fans@cse.psu.edu
From: erik quanstrom <quanstro@quanstro.net>
Date: Fri, 21 Nov 2008 13:28:57 -0500
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Subject: [9fans] (no subject)
Topicbox-Message-UUID: 4fa4d798-ead4-11e9-9d60-3106f5b1d025

Subjet: email attacks

since our friends in sweeden helped out our spammer friends
get back on line, i've seen a lot more attacks.  today i've been
getting ~10 connections/sec.  fortunately its from a small
number of machines, so this trick helps alot:

/n/dump/2008/1121/sys/src/cmd/upas/smtp/smtpd.c:348,353 - smtpd.c:348,355
  				if(!qflag)
  					syslog(0, "smtpd", "Hung up on %s; "
  						"claimed to be %s", nci->rsys, him);
+ 				if(Dflag)
+ 					sleep(delaysecs()*1000);
  				reply("554 5.7.0 Liar!\r\n");
  				exits("client pretended to be us");
  				return;

oddly, i've found that adding a few of the hosts as -k flags stops the attack
entirely.

- erik