Why so much Hotmail spam lately (was Re: [Mimedefang] Adding support for learning our addresses)

[Les Mikesell]

On Tue, 2006-01-31 at 09:54, David F. Skoll wrote:

> > It would seem that they would see high levels of traffic coming from bots 
> > that they could throttle/reject.
> 
> I wouldn't be surprised if more sophisticated bots use zombie networks to
> log on to Hotmail and send mail via their Web interface.  I think it would
> be pretty hard to notice an anomaly against all their regular traffic.

They may be learning to distribute the load across a large number
of hosts to keep it low enough to stay undetected.  I've noticed
something similar with ssh dictionary attacks for a while.  Any
newly exposed address is hit fairly quickly but only gets a few
attempts per hour.

-- 
  Les Mikesell
   les at futuresource.com