I am staring at our reports... I find the following trends: When these spammers send e-Mail, they use a bogus email such as: (based on our log): [EMAIL PROTECTED]
Now looking at this e-Mail - this person has sent e-Mail to almost everybody in the company in different bursts. So lets say that we have a temporary blacklist (since this email will never be used after so many hours) that will block this user for so many hours and then will release it. This will save on the space needed to keep track of all the e-Mails that will never be used but yet will save a lot of overhead during their attack. Of course the temporary blacklist will be in addition to the permanent list that we are finding more and more companies that really need to be blocked. Two new comers to us are: @permissionpass.com .permissionpass.com @your-info.net .your-info.net We are flooded by these domains. Anyhow Regards, Kami -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Monday, May 20, 2002 5:09 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Wish List >Would it not be great if we could assign an e-Mail or a number of >e-Mails that if someone sends a message to they will automatically get >blacklisted? This would immediately save all the junk they will manage >to send through. It is a good idea. The question though is what to block -- the remote mailserver, the return address, or something else? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
