Timo Schoeler said... > thus Kurt Buff spake: > > Rainer Zocholl said... > > > >>An other trick is "gray listing": > >>If there is a new "mail from:" adresse, reject the email with a > >>"450 Please try again later. See http:\\info for the reason > >>of the delay." > >> > >>Viruses don't run a mail quue and will never try again. > >>Spamers thombies don't run mail quues too (but may > >>simply resent the email. That's why serveral spam mail will > >>be seen twice. ). > > > > > > This is a limited-time trick - if it isn't already beat > down, it will soon > > be. I'm already seeing multiple attempts to relay in my > postfix logs from > > single IP addresses, and the attempts are from obviously > infected computers. > > me, too. i'm running greylisting for quite a while now, and > in the last > few months more and more spam gets through (greylisting). > > however, i think that greylisting is more focusing on fighting spam as > viruses have 'more time' (because they have more resources on > the zombie > they reside and less targets).
The problem now is that more and more of the viruses are used to compromise boxes so that spam can be sent from them. The two (viruses and spam) are now in league with each other. It's getting to be ugly out there. Kurt _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
