Re: regarding spam...

[Rick Murphy <rmurphy () mitretek org>]

At 04:22 PM 4/1/2002 -0800, Crispin Cowan wrote:
> What WOULD hurt the spammers is a spam filter designed to be deployed as 
> an EGRESS filter for large domains. I get an obnoxious amount of spam from 
> the same domains time and time again.  Some of them are free webmail 
> servers (hotmail.com, yahoo.com, mail.com, etc.) while others are obscure 
> Asian ISPs (263.net comes to mind). The clear pattern that emerges is:

I'll bet you get almost *no* spam from hotmail or yahoo.
What you get is lots of spam forging hotmail, yahoo, msn, etc. I fix that 
by using a smtp proxy (derived from MJR's smap, but heavily enhanced) that 
maintains a list of frequently spoofed domains. Anything in that list is 
rejected if the envelope from address isn't delivered from a host in the 
corresponding domain. If someone forges a bogus hotmail.com address from 
their cable modem, It's rejected.
In combination with a few DNSBLs and spamassasin I'm pretty effective at 
rejecting spam.

> If there was a product that such large providers could deploy at their 
> gateway that filtered *outgoing* mail, and the only thing it did was to 
> bounce a copy of suspected outgoing spam back to the senders inbox, then a 
> spammer's inbox would fill to bursting almost immediately, and the 
> provider could lock out their account from sending any more mail until the 
> issue was resolved.
>
> Throw-away yahoo/hotmail/mail.com accounts would be a lot less cost 
> effective if they could only send 10 spams each before they locked out.

Unless something is blatantly obvious (i.e. it contains a reference to 
"S.1618" or "Section 301", or says "This is not spam") you're going to have 
a hard time categorizing something as spam within 10 messages. Indeed, in 
my experience the major e-mail providers (hotmail, yahoo, aol) are pretty 
good at controlling their spammers. They rate limit, quickly nuke spammers, 
and really aren't much of a problem. The troubles really come from network 
providers that don't take action against spammers. You solve those by 
complaining early and often - make the NSPs take action, which costs them 
money - that'll get them to think twice before taking on a spammer.
        -Rick

_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://list.nfr.com/mailman/listinfo/firewall-wizards