> I've seen both behaviors with greylisting, and other behaviors as well.
> They still don't get past spamd, so I don't worry much about them. There
> are many different behaviors depending on what spam sending software
> they're using, and it'll change somewhat next week or next month. Rather
> than trying to match the current patterns just let spamd work. Added
> benefit if you have some old, spam-laden addresses to use as spamtraps.
> That will blacklist a lot of zombies no matter their sending pattern of
> the week.
using the greytraps gets them pretty good - I get about 20,000 +
zombie hosts a day that I actually push out to a nice little
blacklist for other hosts to use here.
In case anyone wants to try it:
http://www.openbsd.org/spamd/traplist.gz
is updated once an hour and hosts only stay on it for
24 hours. makes a nice no-baby-with-bathwater blacklist.
Keep that just to the list please, I'm probably
not going to continue hosting it there, but if you use it
let mw know how effective you find it.
-Bob
---
P.S.
Hmm. looks like it must be a good zombie morning - I guess I'm
closer to 30K right now:
$ ftp http://www.openbsd.org/spamd/traplist.gz
Trying 129.128.5.191...
Requesting http://www.openbsd.org/spamd/traplist.gz
100% |**************************************************| 113 KB 00:00
Successfully retrieved file.
$ zcat traplist.gz | wc -l
27629
