Thanks for the reply. No dictionary attacks that I can see in the logs for these domains, but it's possible that it happened.
The previous host was DigiHost. There was no sign of spam filtering and it's not on their list of features or options. Will ask one of the customers for permission to post a header. Gotta keep inside our Privacy Policy. Thanks for the quick reply! -Joe ----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, February 05, 2004 9:16 AM Subject: Re: [Declude.JunkMail] How do they do it? > > >I've had two cases recently where I had hosting customers move their email > >services to my Imail/Declude box. Both moved from a national hosting > >company and had no spam protection of any kind on their services. Both > >complained within a week of the move that they're getting bombarded by spam. > >Both claim that they didn't receive much spam on their old host. One had a > >mail archive that I was able to look at and there really wan't much in the > >way of spam in there. > > The only thing that I can think of is that the spammers have access to the > zone files (which list all the domains in a TLD and their NS records), and > are looking for changes in the NS records, and targeting those domains. > > Are the spams going to valid user accounts? Is this a dictionary > attack? My guess is that the hosting company was indeed filtering spam. > > >How is it that these spammers are hitting these domains when they move to my > >box? I have JunkMail pretty well configured (I think) and they still get > >more spam than they did before the move. Doesn't make sense to me. > > Could you send me the full headers of several spams that are getting > through? I may be able to get a better idea of what is happening. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > since 2000. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
