On Fri, Jan 29, 2010 at 12:15:40PM +0000, Richard Clayton wrote:
> You'll find that a lot of bots send two emails, <n> minutes apart. If
> you are using greylisting the second one is delivered, if you are not
> then two copies of the email are delivered -- what's not to like!
>
> viz: greylisting isn't perfect; merely a heuristic that (remarkably in
> my opinion) still has some impact on incoming spam levels (or to be more
> precise -- reduces the load on the next layer of spam filtering)
That is all that can be done with any anti spam measure, hope that it has
some effect. Greylisting is not heavy on system resources (as spamassassin
can be). Chris Wilson suggests that it catches 13%, but that was in 2007:
http://www.exim-new-users.co.uk/Chris-Wilson-Aptivate-Reducing-Spam.pdf
> >The pair (relay_ip & sender_domain) tends to be more robust since spammers
> >tend to set the sender_domain ''at random'',
>
> No general statements about spammers are ever true...
>
> I daily see large amounts of logging of spam (I look after a log
> processing system that picks out the patterns of wickedness and draws
> the abuse@ team's attention to it) and I would say that randomly chosen
> domains are in the minority at present... however, there are still some
> senders doing this
It might be worth having an anti spam afternoon/workshop at the UKUUG conference
in Manchester on 23-25 March. Anyone up for that ?
--
Alain Williams
Linux/GNU Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer.
+44 (0) 787 668 0256
http://www.phcomp.co.uk/
Parliament Hill Computers Ltd. Registration Information:
http://www.phcomp.co.uk/contact.php
Past chairman of UKUUG:
http://www.ukuug.org/
#include <std_disclaimer.h>
