spamassassin-users October 2010 archive
Main Archive Page > Month Archives  > spamassassin-users archives
spamassassin-users: Re: SORBS is definitely hosed today

Re: SORBS is definitely hosed today

From: Karsten Bräckelmann <guenther_at_nospam>
Date: Thu Oct 07 2010 - 18:52:31 GMT
To: users@spamassassin.apache.org

On Thu, 2010-10-07 at 08:29 -1000, Alexandre Chapellon wrote:
> I can't see any problem right now with SORBS... is it related to a
> specific Sorbs DNSBL?
>
> Le jeudi 07 octobre 2010 à 09:09 -0700, Marc Perkel a écrit :
> > Not sure what is happening but they appear to be down and when they
> > are up they have a lot of people blacklists that shouldn't be. I noticed
> > that this list uses sorbs and the admins might want to disable it.
> >
> > I don't know what's happening but I wish them the best.

http://isc.sans.edu/diary.html?storyid=9685

In particular, note the second comment, by Michelle.

 "We have experienced a DDoS attack today which was 'smart' we have
  mitigated it so the site is now operational if a user waits about
  10-15 seconds for the response.

  We have had reports that we have a database corruption, there is no
  evidence of that but to be safe we have emptied the DNS zone files and
  the rsync files until we can check the database for any possible
  errors. We expect this to be complete within 24 hours."

-- char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}