On Thu, 30 Jan 1997, Erik Fichtner wrote:
> >This won't catch the cases where spammers are using another system to
> >relay mail. E.g. 99.9% of the cases.
>
> actually, aside from the few that use worldnet.att.net to spam from,
> the spammers that are giving me grief at the office ARE using their own
> mail hosts. (i know, cause i'm dropping them at the firewall based on
> their ip address.) it works for cyberpromo, sallynet, hotmail.com,
> camelot.net (et al) and the rest of the porno-advertisment spammers.
Ok, then it won't catch it the second their mail makes it to one of your
MX sites upon failure to deliver direct. The mail will then come from a
clean site, IP-wise.
I finally caved and put a site into badmailfrom (anyone have a measure or
estimate of the performance or resource use hit this causes?), something I
did not think I would do because they had a very active and persistent,
fully-MX-aware mailer. Most spammers I dealt with before seemed to have
mailers that didn't know an MX from their elbow.
> maybe they're just not very bright. :)
See above.
> anyway. the firewall solution works, but it's not very elegant. their
> queue keeps trying and trying and trying.. i want to send them a
> 554 Eat Thyself.
> and have their sendmail (hopefully) give up with a fatal error.
See above. ;-)
-M
Michael Brian Scher (MS683) | Anthropologist, Attorney, Part-Time Guru
http://www.tezcat.com/~strange/ | strange@cultural.com
strange@tezcat.com | mbscher@midway.uchicago.edu
What is the sound of one route flapping?
> >This won't catch the cases where spammers are using another system to
> >relay mail. E.g. 99.9% of the cases.
>
> actually, aside from the few that use worldnet.att.net to spam from,
> the spammers that are giving me grief at the office ARE using their own
> mail hosts. (i know, cause i'm dropping them at the firewall based on
> their ip address.) it works for cyberpromo, sallynet, hotmail.com,
> camelot.net (et al) and the rest of the porno-advertisment spammers.
Ok, then it won't catch it the second their mail makes it to one of your
MX sites upon failure to deliver direct. The mail will then come from a
clean site, IP-wise.
I finally caved and put a site into badmailfrom (anyone have a measure or
estimate of the performance or resource use hit this causes?), something I
did not think I would do because they had a very active and persistent,
fully-MX-aware mailer. Most spammers I dealt with before seemed to have
mailers that didn't know an MX from their elbow.
> maybe they're just not very bright. :)
See above.
> anyway. the firewall solution works, but it's not very elegant. their
> queue keeps trying and trying and trying.. i want to send them a
> 554 Eat Thyself.
> and have their sendmail (hopefully) give up with a fatal error.
See above. ;-)
-M
Michael Brian Scher (MS683) | Anthropologist, Attorney, Part-Time Guru
http://www.tezcat.com/~strange/ | strange@cultural.com
strange@tezcat.com | mbscher@midway.uchicago.edu
What is the sound of one route flapping?