In article <199705021741.KAA00561@andare.fugue.com> you write:
> 
> > One single, solitary bogus SYN from every Spamford victim, and
> > the world would be a better place...
> 
> Hm.   Maybe a tiny hack to the NetBSD kernel that just "accidentally"
> sends a flood of SYNs whenever a host connects from Cyberpromo's
> network...

I installed ipfilter rules to block them on our firewall. I didn't do
them the courtesy of return-rst, so I'll slow 'em down a bit right
there.

Problem is, sometimes they use innocent parties as forwarders.  In that
case, a list of their domains and sendmail rules to block CyberPromo's
domains helps, but they keep getting new domains.  I have >300 in my
/etc/spamdomains, mostly theirs!

I'm hoping the next sendmail will make it easier to disable forwarding
so everyone can turn that on, and we can complain to those who don't.
Unfortunately the currently availible stuff disallows all forwarding,
which is a problem for some people who relay for other domains. And many
admins don't have time to figure out a better fix until they've already
been used for an attack once.