RE: [MLUG] More spam

["Brent Deterding" <EMAIL:PROTECTED>]

And what about ppl like me who have a "business-class" account but don't
control my reverse dns? Look up my IP and you'll get the ISP dns name.
Look up mail.defenseindepth.net and you'll get my server in the same IP
range. I control my ns and mx records but not my reverse lookup.
 
-- Brent

-----Original Message-----
From: Jason McIntosh [mailto:EMAIL:PROTECTED]
Sent: Wednesday, April 09, 2003 4:45 PM
To: MLUG Members
Subject: Re: [MLUG] More spam


Ok, I have to ask: What about disabling incoming email traffic from
machines that can't handle a reverse DNS lookup that's normal? i.e.
prevent the odd user from att.net from connecting unless they have
another DNS entry for something like jasonshomeserver.net 
Or, another way of putting it, prevent incoming email unless the FROM
address matches the sending server? A LOT of the spam I've gotten seems
to be relayed from one of those stupid spammers using a cable modem, but
displayed as from "EMAIL:PROTECTED". Thus, when you would normally
forward the email to EMAIL:PROTECTED you're not doing a thing, as the
email wasn't sent by their servers. Anyone have any thoughts on how you
prevent this from happening? 
Jason 
On Wednesday, April 9, 2003, at 03:12 PM, Russell Horn wrote: 


I'm not talking about "this email has pr0n in it, delete it", 
I'm talking about "this address sent over 4000 emails at once 
into our system, block them". 



Most spam we track generates a new from address for every few emails to 
stop that happening. 

I've also seen spammers try and use our server for a while then go away 
then come back - suggests to me that they only use a server for a short 
while so there's no huge number of emails from it, before going to a new

server with a new IP and returning later - possibly hoping that their 
previous attempts wouldn't have been noticed either. 

As such spam is difficult to block unless you, for example banish blocks

of IP - perhaps not accepting email from smtp servers on a dynamic IP 
range (i.e. dial up / adsl) Imagine how many linux users that would 
hurt. Or they could use one of the spam black hole lists, but what about

when your mother / sister / son's ISP gets themselves listed and then 
you can receive email from your family... 

It's a tough nut to crack. 

Russell. 

_______________________________________________ 
members mailing list 
EMAIL:PROTECTED 
http://mlug.missouri.edu/mailman/listinfo/members 


/--------------------------------------|---------------------------\ 
| Jason McIntosh | CELL: 573-424-7612 | 
| Webmaster, thinker, Programmer, etc. | WORK: 573-884-3865 | 
| http://poetshome.com/ | | 
|------------------------------------------------------------------| 
|"How should I know if it works? That's what beta testers are | 
|for. I only coded it." | 
|(Attributed to Linus Torvalds, somewhere in a posting) | 
\--------------------------------------|---------------------------/ 

-----BEGIN PGP PUBLIC KEY BLOCK----- 
Version: GnuPG v1.2.1 (GNU/Linux) 

mQGiBD5AMRERBACcxAJ7hiB6udEDefnAksb49o6BDVC2bxdUTwkxP9jS0BmLqbQL 
egYYt09WjEJtn4eRuVdkku7A0fi/G8NIsXnE9oMKnWkqg2tjQ8q65D64Cass5zEU 
WG6j8qABpxpZNP9HGSTqm0yeYTR9f0dGaS6jZbxgme6hU0XDOGH3ug6/qwCg0j1h 
gYkkNl3jbPuwtpCrTIxSUYsD/0J18alKrswomFJfoRgjA7S9AezlV7YJoU3dCLSV 
6D19SAVwmseTRltJm0S8e8Yf6Bq9l+1OdsJCHtT+HYBVuB0PmL8PDhJg6vAzIZlt 
5c3hkfJrSSCssRSMBIr+8Hl2HBU4tKB79L2cI3Nrij+5DJTVzIa5QpvsFDAIO2Cp 
Ma/hA/9vOPY2PyoAWKb3JAQV8T2h7/rjzePxOv0WYI2/6THdgh2lLUP+GJ4FdH76 
I/8d+qtiAzul/Zq2LkFvpejnu41dDZn+yhgsVTkz/xTRKWQX9sOud0QjvyN0nHD9 
KqisFRgs1ByINQcWNK8KpwgLcBRLVS4EALDn5R6yL6AT6poT7bQ8SmFzb24gTWNJ 
bnRvc2ggKFByb2dyYW1tZXIvQW5hbHlzdCkgPE1jSW50b3NoSkBtaXNzb3VyaS5l 
ZHU+iF8EExECAB8FAj5AMREFCQHhM4AECwcDAgMVAgMDFgIBAh4BAheAAAoJEGZP 
+3FaGjd1P9IAoJQL5kaHEjG1TNVSt20bAXDx/DzmAJ4pVTDnpWUPNCxk+/kMBlGe 
bO97ObkCDQQ+QDEfEAgAjl6vRTDWrMTUfXyngnWAgU/3wRZmjcKONhCGcpqFOFR/ 
2CiMeeJOnNXgSzrPxIfUJphlh00vBm1K/ngllg3MGFI9hOffuLuHXiw8e/Yc87uz 
YdtglWHeUz/9YQCe4ndKohtk7nZHUoxQd5OspJxYJH5J5cysSuH2V839NtNPJKBZ 
ai0VhyTFZKD3v9xTC8ZyMEO022bpkhWz1cs/9l5z4g2eg7mOwe+hJstMQFHk77Zr 
GbkPwi+gWwM/b2pxigz1xhQpHpR5HrO/4yM8zWYZHUbUGwxiuTJqKktFEVUKUFDD 
xopIpOAMOy0qVs+wXS5buJSduSgDxPmKq0xZFsJiZwADBwgAi66pXMCTolMQzn50 
MAs9KRK6+3XphI+InmzfN+/OVknwzkAkGhRfisYI0DyN/26wSkn+zyoE87NBuUQt 
xtcNOpwwxS2WCqBx3PhtpVJ6yvaeFmSe3QC2lUf8418B2C6GR/e6IOPNhVW1cnhP 
IR0/yY8c8zQrJxEZNhBtj2SrkLY6Ps7j97lI8n+u21YC2/a5P3TPCa3x0w0m0APB 
zJrhXuNGwPcNtxqKZDz7m9KuROSijx0Xm1buQkGfDZqkqA1D8ljN2vdA+jx/v1eq 
H27iXk2iZ+i8bOyoiflniKh6nrd2UlVPvzmLscpiUf0rEGQuBV0Sq5AUUqO7MQM+ 
L8jCYYhMBBgRAgAMBQI+QDEfBQkB4TOAAAoJEGZP+3FaGjd1yhMAnjAwU37EIok3 
WZu1BXhaD9y1ryjBAKC7fnv7AdrVrxdXkmdgdA5jxUFXOg== 
=ueqZ 
-----END PGP PUBLIC KEY BLOCK----- 


_______________________________________________
members mailing list
EMAIL:PROTECTED
http://mlug.missouri.edu/mailman/listinfo/members