Re: [exim] An interesting observation about spam zombies

2007-09-03 Thread Ian Eiloart
--On 29 August 2007 16:23:48 -0700 Jeroen van Aart <[EMAIL PROTECTED]> wrote: > Graeme Fowler wrote: >> that's fine. If, however, you drop, reject, blackhole or otherwise send >> AWOL a time-critical [0] message destined to one of your customers and >> cause, ooh, a business deadline to be miss

Re: [exim] An interesting observation about spam zombies

2007-08-30 Thread Jeroen van Aart
Graeme Fowler wrote: > All together now: "Plusnet" !!! Ok, blatant stupidity (or evil intent) is not what I refered to. :-) Regards, Jeroen -- ## List details at http://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - ht

Re: [exim] An interesting observation about spam zombies

2007-08-30 Thread Graeme Fowler
On Wed, 2007-08-29 at 16:23 -0700, Jeroen van Aart wrote: > I don't think one can blame an email provider for lost email just as one > can't blame a telephone provider for dropped or missed calls. Or at > least it should be that way. Plus I am sure any sane email provider adds > a nice long disclai

Re: [exim] An interesting observation about spam zombies

2007-08-30 Thread Graeme Fowler
On Wed, 2007-08-29 at 23:20 +0100, Martin A. Brooks wrote: > Omniscience being the obvious candidate. I shall duly add that to the Exim5 wishlist :) Graeme -- ## List details at http://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki wi

Re: [exim] An interesting observation about spam zombies

2007-08-29 Thread Phil \(Medway Hosting\)
- Original Message - From: "Jeroen van Aart" <[EMAIL PROTECTED]> To: Sent: Thursday, August 30, 2007 12:23 AM Subject: Re: [exim] An interesting observation about spam zombies > I don't think one can blame an email provider for lost email just as one > can&#

Re: [exim] An interesting observation about spam zombies

2007-08-29 Thread Jeroen van Aart
Graeme Fowler wrote: > that's fine. If, however, you drop, reject, blackhole or otherwise send > AWOL a time-critical [0] message destined to one of your customers and > cause, ooh, a business deadline to be missed, then you'd best be > prepared for several long talks with your lawyer. I don't thi

Re: [exim] An interesting observation about spam zombies

2007-08-29 Thread Martin A. Brooks
Graeme Fowler wrote: > It needs work, in my opinion, but it could be a reasonable assistant to > other technologies. > Omniscience being the obvious candidate. -- Martin A. Brooks | http://www.antibodymx.net/ | Anti-spam & anti-virus Consultant| [EMAIL PROTECTED] | filterin

Re: [exim] An interesting observation about spam zombies

2007-08-29 Thread Graeme Fowler
On Wed, 2007-08-29 at 14:42 -0700, Marc Perkel wrote: > Keep in mind Phil that these are fake high numbers MX records that > normal server never access even if they are correct. So if you add in > the expired fake MX factor then it starts getting pretty safe. I refer the honourable gentleman to

Re: [exim] An interesting observation about spam zombies

2007-08-29 Thread Marc Perkel
Phil (Medway Hosting) wrote: > - Original Message - > From: "Marc Perkel" <[EMAIL PROTECTED]> > To: > Sent: Wednesday, August 29, 2007 6:23 PM > Subject: [exim] An interesting observation about spam zombies > > > >> As some of you k

Re: [exim] An interesting observation about spam zombies

2007-08-29 Thread Richard Pitt
On Wed, 2007-08-29 at 18:48 +0100, Graeme Fowler wrote: > On Wed, 2007-08-29 at 10:23 -0700, Marc Perkel wrote: > > As some of you know I get rid of a lot of spam using fake high numbered > > MX records. I'm now doing some interesting experiments. Even though my > > TTL is only 2 hours I notice

Re: [exim] An interesting observation about spam zombies

2007-08-29 Thread Martin A. Brooks
Graeme Fowler wrote: > In the olden days, when AOL used to be a Really Big Player (!), there > were many uncorroborated and persistent rumours that they (and several > other large ISPs) used to deliberately ignore DNS zone and resource > TTls, and forced them to be much longer than the zone adminis

Re: [exim] An interesting observation about spam zombies

2007-08-29 Thread Martin A. Brooks
Marc Perkel wrote: > My theort is that spam zombies do DNS caching so as to maximize spam > output by eliminating dns lookups. Thus zombies retain old information > far longer than they are supposed to. > > So I'm experimenting with a blaclisting trick where I change my fake > high MX records, w

Re: [exim] An interesting observation about spam zombies

2007-08-29 Thread Graeme Fowler
On Wed, 2007-08-29 at 10:23 -0700, Marc Perkel wrote: > As some of you know I get rid of a lot of spam using fake high numbered > MX records. I'm now doing some interesting experiments. Even though my > TTL is only 2 hours I notice that if I change my fake high MX to > different fake high MX tha

Re: [exim] An interesting observation about spam zombies

2007-08-29 Thread Phil \(Medway Hosting\)
- Original Message - From: "Marc Perkel" <[EMAIL PROTECTED]> To: Sent: Wednesday, August 29, 2007 6:23 PM Subject: [exim] An interesting observation about spam zombies > As some of you know I get rid of a lot of spam using fake high numbered > MX recor

Re: [exim] An interesting observation about spam zombies

2007-08-29 Thread Richard Pitt
Hmmm... over the years I've run into many instances where short TTLs (and in fact any TTL in some cases) have been ignored by some (many) of the big ISPs - again, sometimes for a month or more (AOL for example) These instances were for A records mostly as things like web sites and ftp sites were mo

[exim] An interesting observation about spam zombies

2007-08-29 Thread Marc Perkel
As some of you know I get rid of a lot of spam using fake high numbered MX records. I'm now doing some interesting experiments. Even though my TTL is only 2 hours I notice that if I change my fake high MX to different fake high MX that the spam zombies still send email to the old fake MX record