[Mimedefang] New spam technique

[Les Mikesell]

On Tue, 2004-07-06 at 07:52, Joseph Brennan wrote:
> > I think spammers have adapted by sending only a few addresses at
> > a time, perhaps from virus-owned zombie relays.
> 
> Definitely.  Over 1/10 our smtp connections have user unknowns.
> 
> I am trying to find peace in the idea that they can waste their time
> building lists of addresses that are going to be useless when we
> reject the actual spam.  Let 'em spin their wheels.

The real problem is for relays that forward whole domains to
otherwise firewalled servers where the relay accepts without
checking the local address and is then forced to return a bounce
when the real server rejects it. I'm getting enough that I'll
have to fix it.  I think greylisting will eliminate most of these
when they hit mimedefang, but I still have that one box with
qmail and things hitting it directly instead of following the
MX.  It isn't even a straight qmail install - it is an SMEserver
with smtpfront accepting everything, then bouncing the bad
addresses. 

---
  Les Mikesell
   les at futuresource.com