On Wednesday 30 July 2008 00:55:50 mouss wrote: > Ken A wrote: > > Can be a probe too. Accepting mail from that IP with that content says > > something about your system. Spammers aren't stupid. They fingerprint us > > just like we fingerprint them. > > If I was a spammer, I don't see why I would probe you. I understand if > it's filter poisoning, but probing to see if the message will be > accepted is useless. they can just send their spam. if you reject it, > others will accept it, and some will read it, which is exactly what they > want to achieve.
No. Some spammers are a lot more clever then that. Especialy if you sell lists, you usually make sure they are high quality. This is a low volume probe. Propably to clean out harvested lists. - They are probing for wrong addresses (This is why returning 550 imho makes sense and greylisting does not) - They are probing for backscatterer All mails would have the same From address,envelope, and helo of a compromised mailserver. - They are probing for spamtraps. Bigger ISPs can propably detect that best, since the mails would have a pattern. Of course there is always the posibility that the ratware is simply broken. shit happens :P -- mit freundlichen Grüßen / best regards Arvid Ephraim Picciani
