On Tue, Feb 20, 2007 at 03:07:45PM -0600, Jacob Yocom-Piatt wrote:
> Theo de Raadt wrote:
> >In fact, there are spammers who ARE noticing that greylisting servers
> >look (or behave) different, and they are disconnecting and not sending
> >spam through them. Thus, no spam is delivered.
>
> i have seen a number of spammer outfits doing this: following the RFC
> and retrying until the spam gets though and they're whitelisted, then
> they're free to push crap through. any thoughts on how to best combat
> this behavior besides spamassassin + amavisd (i.e. wasting cpu cycles
> and bandwidth)?
Theoretically, honeypots might catch the spam and blacklist the sending
host before it can try again. (See: DCC, Vipul's Razor, Pyzor, ..., or
plain old [EMAIL PROTECTED])
Joachim
