[Mimedefang] Greylist-busting ratware?

[David F. Skoll]

Hi,

I think greylisting is nearing the end of its useful life.  I'm
noticing a new kind of ratware that retries every 5 minutes
like clockwork, mutating message bodies.  Our CanIt software tempfails
mail until it's approved by a human, and this mechanism has the side-effect
of illuminating ratware behaviour.

For example:

http://www.roaringpenguin.com/canit/showtrap.php?o=71.0.177.139&status=spam

(Login/password = demo/demo)

Anyone else seeing this?  We see it quite a lot, and always from cable modem
or DSL machines (probably cracked Windoze boxes.)

Regards,

David.