[Dshield] Exchange Open Relay

David Cary Hart DShield at TQMcube.com
Sat Mar 4 20:55:46 GMT 2006

On Sat, 4 Mar 2006 11:03:54 -0800
"Abuse" <abuse at what4now.com> opined:
> Can you filter all spam?  How do you expect them to filter all
> false positives? And in this case sending spam even if it is via an
> out-of-office message is still sending spam.  Since you think
> someone should look at spam trap messages why don't you inspect the
> out-of-office messages (since there will be a lot less of them
> going out of your server than what goes into a spam trap) before
> they are sent, either filtered by a program or visually by a
> person? _________________________________________ Learn about
> Intrusion Detection in Depth from the comfort of your own couch:
> https://www.sans.org/athome/details.php?id=1341&d=1
For the record, I consider auto-replies, non-local NDRs
(backscatter) and challenge/response messages to be spam. The reason
is simple. The majority of these are sent to individuals who did not
initiate the message. I have had spikes of thousands of these per
hour (mostly backscatter) when some nitwit spammer decides "MAIL
FROM:" = a local user.


           Eliminate Spam: http://www.TQMcube.com
          Multi-RBL Check: http://www.TQMcube.com/rblcheck.php
            Zombie Graphs: http://www.TQMcube.com/zombies.php

More information about the list mailing list