On Thu, 6 Nov 2003 02:25:52 -0700, [EMAIL PROTECTED] (Bob Proulx) posted to spamassassin-talk: > In a nutshell a not too common address got hit from one IP address, > then a few seconds later from another IP address, then a few seconds > later from a third IP address. The first two were blocked with a 550 > because of RBL entries. The third IP address was finally accepted. > This really makes it look like spammers are building distributed > spamming engines across multiple IP addresses. If a site rejects one > IP address it appears to switch to an alternate source? Perhaps this > is a coincidence but it seems too much to be purely random chance.
It's been known for some time, although I have not seen it described at this level of detail. If you'd keep the rejected DATA around for a while, you could see that it's the same guy, and immediately add the new IP address to your local blocklist, and submit it to your DNSBL of preference. /* era */ -- The email address era the contact information Just for kicks, imagine at iki dot fi is heavily link on my home page at what it's like to get spam filtered. If you <http://www.iki.fi/era/> 500 pieces of spam for want to reach me, see instead. each wanted message. ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
