[Mimedefang] Spammers who won't take no for an answer

[Jonas Eckerman]

On Mon, 20 Oct 2003 20:26:37 -0400 (EDT), David F. Skoll wrote:
> Is anyone seeing a new trend (maybe a new ratware package?)
> I'm seeing spammers repeatedly retry the same message, even
> after a 5xx failure code.

Yes. I noticed the same thing last week when checking some stuff in 
the logs.

Not only did one of those hosts repeatedly try to send the same 
message, it did if fast. The shortes delay between a failure and the 
next connect was about 0.25 seconds, the longest was 7 seconds. :-(

I've noticed the same thing about the hosts that tries to send mail 
though our HTTP reverse proxy with CONNECT or POST. Even though they 
fail (getting a "forbidden" or "not found" answer), they keep on 
trying for a while. :-/

I've wondered what they hope to gain. Maybe some servers turn of the 
spam checking if they get too busy, and they hope to overload the 
servers?
(Wich seems odd, an overloaded server would be more likely to return 
a temporary failure than to simply accept everything, and it doesn't 
explain the retries to the HTTP server...)

/Jonas

-- 
Jonas Eckerman, jonas_lists at frukt.org
http://www.fsdb.org/