[Mimedefang] New spam technique

[john at essenz.com]

We had a similar issue like this. We simply relayed everything to an 
internal MS exchange box. So we accepted everything at the front door, 
including randomly generated addresses that would never exist. We did it 
like this because we where lazy. And though I like the idea of wasting 
spammers bandwidth on addresses that dont exist, I dont enjoy wasting my 
bandwidth. So we bit the bullet and wrote a script to export active 
directory addresses and make a custom virtuser table in sendmail. Now we 
drop a couple thousand msgs a day just due to invalid addresses and only 
relay explicit addresses that are known to exist. 

-john

----------------------------------------------------
>From : Les Mikesell <les at futuresource.com>
To : mimedefang at lists.roaringpenguin.com
Subject : Re: [Mimedefang] New spam technique
Date : Tue, 06 Jul 2004 09:58:46 -0500
> On Tue, 2004-07-06 at 07:52, Joseph Brennan wrote:
> > > I think spammers have adapted by sending only a few addresses at
> > > a time, perhaps from virus-owned zombie relays.
> > 
> > Definitely.  Over 1/10 our smtp connections have user unknowns.
> > 
> > I am trying to find peace in the idea that they can waste their time
> > building lists of addresses that are going to be useless when we
> > reject the actual spam.  Let 'em spin their wheels.
> 
> The real problem is for relays that forward whole domains to
> otherwise firewalled servers where the relay accepts without
> checking the local address and is then forced to return a bounce
> when the real server rejects it. I'm getting enough that I'll
> have to fix it.  I think greylisting will eliminate most of these
> when they hit mimedefang, but I still have that one box with
> qmail and things hitting it directly instead of following the
> MX.  It isn't even a straight qmail install - it is an SMEserver
> with smtpfront accepting everything, then bouncing the bad
> addresses. 
> 
> ---
>   Les Mikesell
>    les at futuresource.com
> 
> 
> _______________________________________________
> Visit http://www.mimedefang.org and http://www.canit.ca
> MIMEDefang mailing list
> MIMEDefang at lists.roaringpenguin.com
> http://lists.roaringpenguin.com/mailman/listinfo/mimedefang