Re: OT spammers

2006-05-02 Thread Dimitri Yioulos
On Tuesday May 02 2006 1:55 am, Loren Wilton wrote: > > What I don't get is who in his/her right mind would respond to a piece of > > spam > > > that uses so much obfuscation as to be almost unreadable. But, as they > > say, > > > if it didn't work nobody would be doing it. > > Perhaps spammer's t

Re: OT spammers

2006-05-01 Thread Loren Wilton
> What I don't get is who in his/her right mind would respond to a piece of spam > that uses so much obfuscation as to be almost unreadable. But, as they say, > if it didn't work nobody would be doing it. Perhaps spammer's targets are poor enough at grammar and spelling that they don't realize th

Re: OT spammers

2006-05-01 Thread Dimitri Yioulos
On Saturday April 29 2006 12:44 am, Richard Ozer wrote: > I've purchased HUNDREDS of fake degrees and I feel much smarter because of > it! > > Serious answer many spammers are probably paid per email. Others > figure that more retries to a given address will result in a higher > likelihood of

Re: OT spammers

2006-04-29 Thread David Gibbs
Igor Chudov wrote: > Here's something that I do not understand. What is the point of > spamming people repeatedly not once, twice, or even 10 times, but > hundreds of times. If I wanted to procure pils, or pgrn, or whatever, > I would have done it on the first 10 spams. After 100 or so spams, > wha

Re: OT spammers

2006-04-28 Thread Richard Ozer
I've purchased HUNDREDS of fake degrees and I feel much smarter because of it! Serious answer many spammers are probably paid per email. Others figure that more retries to a given address will result in a higher likelihood of the mail being read (or read by accident). But you are right..

Re: OT spammers

2006-04-28 Thread Dan
Ratio's of messages to recipients used to apply: send 100, 10 make it to live inboxes, 1 gets seen. Then came along filtering: send 1000, 100 get through the spam filters, 10 make it to live inboxes, 1 gets seen. So they send 1000 variations in the hopes that some make it through. But wh

Re: OT: Spammers' reactions to rejection

2005-11-20 Thread hamann . w
Hi, I fear there are already more zombies than admins ... It is a good idea to implement some kind of limiting, however, both on senders and receivers. Some big ISPs dont take more than ## mails per hour from any other server, unless the other one is a biggie too, or there is mutual agreement. L

Re: OT: Spammers' reactions to rejection

2005-11-20 Thread Theodore Heise
On Thu, 17 Nov 2005, mouss wrote: Roger Taranto a écrit : If it didn't tie up sockets on our machines, it seems like instead of rejecting the mail, we should just hold on to the mail connection for as long as possible. It wouldn't take too long to tie up all of their outbound connections an

Re: OT: Spammers' reactions to rejection

2005-11-19 Thread Kai Schaetzl
Magnus Holmgren wrote on Thu, 17 Nov 2005 19:04:06 +0100: > Spammers need to clean their address lists once in a while, lest they > end up with a very low proportion of valid addresses, right? They do not care at all, at least not those which make up for the majority of spam. They don't even ca

Re: OT: Spammers' reactions to rejection

2005-11-18 Thread Dave Pooser
> I would vote that these "legitimate mailing list" are not so > legitimate if they can't clean up bounces after several years of > getting them. Legitimate != well-run. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "In our family, happy usually involves gunfire and at least two patrol cars

Re: OT: Spammers' reactions to rejection

2005-11-18 Thread Matt Kettler
At 04:09 PM 11/18/2005, Vivek Khera wrote: On Nov 17, 2005, at 2:05 PM, Kelson wrote: incoming mail. I turned them back on, unsubscribed from everything for a few months to weed out any legitimate mailing lists that the old users might have subscribed to, and eventually turned them into spam

Re: OT: Spammers' reactions to rejection

2005-11-18 Thread Vivek Khera
On Nov 17, 2005, at 2:05 PM, Kelson wrote: incoming mail. I turned them back on, unsubscribed from everything for a few months to weed out any legitimate mailing lists that the old users might have subscribed to, and eventually turned them into spam I would vote that these "ligitimate m

Re: [sa-list] Re: OT: Spammers' reactions to rejection

2005-11-18 Thread Kris Deugau
"Dan Mahoney, System Admin" wrote: > Three firewall rules I think nobody should live without: > > 1) ipfw add 500 allow tcp from any to me 25 limit src-addr 2 setup > > Yup, you read that right. Limits tcp connections to no more than two > per connecting address. You could probably even drop th

Re: OT: Spammers' reactions to rejection

2005-11-18 Thread John Hardin
On Thu, 2005-11-17 at 11:55, Christian Recktenwald wrote: > On Thu, Nov 17, 2005 at 11:42:44AM -0800, John Woolsey wrote: > > It would be an interesting addition to a honeypot. Make the mail server > > just hang up and not respond to tie up connections on the spammer. > > There's a cool piece of s

Re: [sa-list] Re: OT: Spammers' reactions to rejection

2005-11-18 Thread Dan Mahoney, System Admin
On Thu, 17 Nov 2005, mouss wrote: Three firewall rules I think nobody should live without: 1) ipfw add 500 allow tcp from any to me 25 limit src-addr 2 setup Yup, you read that right. Limits tcp connections to no more than two per connecting address. You could probably even drop that to one.

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread jdow
From: "Kelson" <[EMAIL PROTECTED]> Magnus Holmgren wrote: Question: Is there any knowledge as to how spammers deal with different kinds of failure? Does it matter if I reject the RCPT command or the MAIL command, or even drop the connection right away I'm sure it depends on the spammer, but a

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread Christian Recktenwald
On Thu, Nov 17, 2005 at 11:42:44AM -0800, John Woolsey wrote: > It would be an interesting addition to a honeypot. Make the mail server > just hang up and not respond to tie up connections on the spammer. There's a cool piece of software holding tcp connections alive as long as possible called "la

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread mouss
Roger Taranto a écrit : If it didn't tie up sockets on our machines, it seems like instead of rejecting the mail, we should just hold on to the mail connection for as long as possible. It wouldn't take too long to tie up all of their outbound connections and back up their mail server. Unfortu

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread Matt Kettler
Roger Taranto wrote: > On Thu, 2005-11-17 at 10:17, Matt Kettler wrote: > >>Magnus Holmgren wrote: >> >>>Spammers need to clean their address lists once in a while, lest they >>>end up with a very low proportion of valid addresses, right? >> >>No, they don't have to clean it. > > > If it didn't

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread John Woolsey
It would be an interesting addition to a honeypot. Make the mail server just hang up and not respond to tie up connections on the spammer. - bfn - JAW -- Original Message -- From: Roger Taranto <[EMAIL PROT

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread Roger Taranto
On Thu, 2005-11-17 at 10:17, Matt Kettler wrote: > Magnus Holmgren wrote: > > Spammers need to clean their address lists once in a while, lest they > > end up with a very low proportion of valid addresses, right? > > No, they don't have to clean it. If it didn't tie up sockets on our machines, it

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread Kelson
Magnus Holmgren wrote: Question: Is there any knowledge as to how spammers deal with different kinds of failure? Does it matter if I reject the RCPT command or the MAIL command, or even drop the connection right away I'm sure it depends on the spammer, but a while back I started looking at the

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread Matt Kettler
Magnus Holmgren wrote: > Spammers need to clean their address lists once in a while, lest they > end up with a very low proportion of valid addresses, right? No, they don't have to clean it. Let's face it.. spammers are currently making extensive use of dictionary attacks to add more addresses to