mail/tarpitd 1.1.0 FreeBSD

tarpitd answers SMTP connections and holds them open for as long as the peer can be persuaded to wait. It is meant to sit behind a packet filter rule that redirects known spam sources to it, in the manner of spamd(8) on OpenBSD, and it never accepts or delivers anything.

Every reply is a syntactically valid SMTP response, so the sender has no reason to give up, but it is written out one byte at a time and commands are read back at the same rate. Every terminal answer is a temporary failure, so the message stays in the sender's queue and it comes back later to be tarpitted again. The intent is to occupy a slot in the sending botnet's delivery queue for hours rather than to reject mail quickly.

Among its tactics are a delayed and optionally endless multiline greeting, detection of clients that transmit before the greeting has finished, padding of the EHLO response, a STARTTLS handshake that never completes, an AUTH honeypot that decodes and logs the credentials bots offer, and clamped socket buffers so the peer's window stays tiny.

tarpitd carries no blocklist and applies no heuristics of its own. The addresses come from an external source, such as fail2ban or blacklistd(8), and the only thing that decides whose traffic arrives here is the firewall rule that redirects it.