Subject: Mailman subscribe attacks - Cloudflare redux

From: Glen <[email-masked]>
Date: Thu, 17 Sep 2015 13:55:05 -0700

All -

Seven hours ago I reported that we had discovered an API that allows us to
automatically block, in Cloudflare, IP addresses from which attacks are
coming.

The good news:  We successfully deployed a script that let us feed data to
that API, and began blocking the IP Addresses in the attacking network.

The bad news:  Cloudflare appears to have a limit of 2000 entries in their
blacklist table.  We have exceeded that limit.  (We have identified almost
twice as many IP addresses currently in use as attack sources.)

So, unfortunately, that method will not be a good solution here.

At the moment, we have successfully blocked all currently-identified
attacks using our configurable referral screen, and we will continue to
watch for changes in the attack and adapt as possible.

I just wanted to make sure everyone was aware of where this potential
solution went.

Thanks,
Glen
Glen Barney
IT Director
AMS (IETF Secretariat)