Re: Observation on secondary MX

2005-05-03 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Tony Finch writes: > On Mon, 2 May 2005, Justin Mason wrote: > > > > It might be worthwhile maintaining some kind of spammer tactics > > knowledge base, on the wiki maybe? > > There's http://www.jgc.org/tsc/ but it's more focussed on textual > obfusc

Re: Observation on secondary MX

2005-05-03 Thread Tony Finch
On Mon, 2 May 2005, Justin Mason wrote: > > It might be worthwhile maintaining some kind of spammer tactics > knowledge base, on the wiki maybe? There's http://www.jgc.org/tsc/ but it's more focussed on textual obfuscation than low-level tactics. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http:/

Re: Observation on secondary MX

2005-05-03 Thread Rick Macdougall
Jeff Chan wrote: On Monday, May 2, 2005, 4:54:10 AM, Niek Niek wrote: On 5/2/2005 1:48 PM +0200, Kevin Peuhkurinen wrote: spam going to that server! I wonder if the spammers have cached the old MX entry Jup. Niek And spam through our real backup MX did die down when I added a fake second bac

Re: Observation on secondary MX

2005-05-03 Thread Jeff Chan
On Monday, May 2, 2005, 4:54:10 AM, Niek Niek wrote: > On 5/2/2005 1:48 PM +0200, Kevin Peuhkurinen wrote: >> spam going to that server! I wonder if the spammers have cached the >> old MX entry > Jup. > Niek And spam through our real backup MX did die down when I added a fake second backup MX

Re: Observation on secondary MX

2005-05-02 Thread Kenneth Porter
--On Monday, May 02, 2005 7:48 AM -0400 Kevin Peuhkurinen <[EMAIL PROTECTED]> wrote: The interesting thing is that now, about a month later, I'm still seeing spam going to that server! I wonder if the spammers have cached the old MX entry or if they have some database of mail server addresses a

Re: Observation on secondary MX

2005-05-02 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Niek writes: > On 5/2/2005 1:48 PM +0200, Kevin Peuhkurinen wrote: > > spam going to that server! I wonder if the spammers have cached the > > old MX entry > > Jup. BTW I've seen a few discussions recently where people rediscover (sorry Kevin) th

Re: Observation on secondary MX

2005-05-02 Thread List Mail User
>... > >About a month ago, there was a discussion on the list about how spammers >specifically target secondary MX records. After reading I verified >that indeed 99% of the mail that flowed through my store-and-forward >secondary mail server was spam. So, I removed the second MX record >fro

Re: Observation on secondary MX

2005-05-02 Thread Niek
On 5/2/2005 1:48 PM +0200, Kevin Peuhkurinen wrote: spam going to that server! I wonder if the spammers have cached the old MX entry Jup. Niek

Observation on secondary MX

2005-05-02 Thread Kevin Peuhkurinen
About a month ago, there was a discussion on the list about how spammers specifically target secondary MX records. After reading I verified that indeed 99% of the mail that flowed through my store-and-forward secondary mail server was spam. So, I removed the second MX record from my DNS zon