[Mimedefang] Bounce spam with hit counts between 5-10...

Matthew.van.Eerde at hbinc.com Matthew.van.Eerde at hbinc.com
Wed May 25 18:04:39 EDT 2005


Fernando Gleiser wrote:
> On Wed, 25 May 2005 Matthew.van.Eerde at hbinc.com wrote:
>> action_bounce actually rejects email, so bounce email (if any) is
>> generated by the SENDING MTA.  If the email is really spam, this is
>> probably the spambot.  Spambots typically won't bother sending bounce
>> emails.
> 
> Last january, some bastard sent spam and used my address as the RCPT
> FROM I got more than 300 bounces in 12 hours, ranging all the way
> from the "user unknown" to the "don't send me spam" bounces.
> 
> No Sir, I didn't like it. And don't get me started about those
> "you sent me a virus" bounces that some brain-dead antivirus send.

All good reasons to use REJECT rather than generating a bounce.  action_bounce actually does a REJECT, despite the name of the method.

If all the MTAs that the spambot was sending to had used REJECT you would not have received one single bounce.

Similarly, if the antivirus programs used REJECT (like clamav-milter does, for example) then you would not receive one single bounce.

Well, maybe one or two.  For example, if joe at we-accept-anything.example.com has a .forward to joe at we-only-take-plaintext.example.org then you might experience some blowback sent from you to joe at we-accept-anything.example.com.

-- 
Matthew.van.Eerde (at) hbinc.com                 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com         Software Engineer
perl -e"map{y/a-z/l-za-k/;print}shift" "Jjhi pcdiwtg Ptga wprztg," 




More information about the MIMEDefang mailing list