Another attack to fight off

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Exactly what doesn't work?

Vlad Mazek wrote:
> It's escalating too :( which is why I'm trying to do the split queue 
> thing but MailScanner has a big bold FIXME where it parses for 
> incoming directories..
>
> On 2/28/08, *Daniel Straka* <dstraka at caspercollege.edu 
> <mailto:dstraka at caspercollege.edu>> wrote:
>
>     I'm seeing Vlad's problem too, only 100% (2x) more than last week,
>     it's unnerving...
>
>     >>> On 2/28/2008 at 1:38 PM, in message
>     <eb3cb5620802281238y3e7979bbq484c21d7a690f2dc at mail.gmail.com
>     <mailto:eb3cb5620802281238y3e7979bbq484c21d7a690f2dc at mail.gmail.com>>,
>     "Vlad Mazek"
>
>     <v at vladville.com <mailto:v at vladville.com>> wrote:
>     > The problem too is that at least here we've seen a 40% increase
>     in message
>     > load specifically in NDRs and null senders over the past 2-3
>     days. The iron
>     > is starting to turn orange..
>     >
>     > -Vlad
>     >
>     > On 2/28/08, Scott Silva <ssilva at sgvwater.com
>     <mailto:ssilva at sgvwater.com>> wrote:
>     >>
>     >> on 2-28-2008 9:39 AM Kevin Miller spake the following:
>     >>
>     >> > Scott Silva wrote:
>     >> >> I see a new reason to block OoO replies;
>     >> >>
>     >> >> It seems that spammers are using legitimate webmail accounts to
>     >> >> bounce their garbage via OoO replies. Just fake the sender, and
>     >> >> suddenly you have spam with legitimate DKIM sigs, valid SPF, and
>     >> >> maybe even whitelists.
>     >> >>
>     >> >>
>     >> >
>     http://www.networkworld.com/news/2008/022608-out-of-office-messages-turn
>     >> > ed.html
>     >> >> Filthy spammers!
>     >> >
>     >> > Dang those boys are clever.  Imagine if they turned their
>     creativity to
>     >> > world peace and cheap, clean energy.  Too bad there's no
>     money in that.
>     >> >
>     >> > So how are you blocking Oo0 replies?  There a spamassassin
>     ruleset for
>     >> > that or what?
>     >>
>     >>
>
>
>     --
>     MailScanner mailing list
>     mailscanner at lists.mailscanner.info
>     <mailto:mailscanner at lists.mailscanner.info>
>     http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>     Before posting, read http://wiki.mailscanner.info/posting
>
>     Support MailScanner development - buy the book off the website!
>
>
>
>
> -- 
>
> -Vlad 

Jules

- -- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
PGP public key: http://www.jules.fm/julesfm.asc


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.8.0 (Build 2158)
Comment: Use Thunderbird Enigmail to verify this message
Charset: ISO-8859-1

wj8DBQFHxzEQEfZZRxQVtlQRAkUbAKCr7ScV/mPp1IWV5ux6mENVVh6J+gCfSKOu
QxC2KgJ7yAyfC81+MXT8wmQ=
=9fh3
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.