[SpamCop-Mail] Re: Instant Bypass of Spamcop Filter

[Petzl]

On Fri, 23 Jan 2004 19:18:50 -0500, "d9d" <d9d at nowhere.net> wrote:

>Seems spammers are using auxillery smtp servers for their outgoing mail 
>when Spamcop rejects a mesage. For example, see the following clip 
>from my smtp server logs.  As you can see, it took two seconds to send 
>that same spam via a completely different IP (2 seconds).

Not sure exactly how it works but there are so many computers infected
with trojans.  I believe spamware is now sold and updated with lists
of (cable mainly) IP's that will act as mailing hosts and switchs from
one to another. This is what makes spamcop blocklist so effective and
presently the only effective "spam block" to use It may miss one spam
but not three. It also suggests that the return address may be being
looked at to detect bounces

 A modest 20000 spams would take most spammers 2 hours to download
SpamCop will have that spamming IP added in minutes. 

if you area a spamcop member you can check report history of a
spamvertised URL. Note the many different IP addresses for that day it
was posted from. 

The solution is to encourage everyone to get a Virus scanner, Firewall
and check for spybots (I've found there are many free sources and or
30 day trails there is no reason why one cannot do this)

This seems good advice also
Symantec Security Response encourages all users and administrators to
adhere to the following basic security "best practices": (Read full
advice)
<http://securityresponse.symantec.com/avcenter/venc/data/download.trojan.html>
or
http://tinyurl.com/f20q




Petzl
-- 
"AVG 6.0 Free Edition" Anti-Virus
<http://www.grisoft.com/us/us_dwnl_free.php>

Check your computer for "Spy Bots" (free)
<http://security.kolla.de/>

Block spamvertised websites (free)
<http://www.staff.uiuc.edu/~ehowes/resource.htm#IESPYAD>

a good firewall for windows(free version available)
<http://www.zonelabs.com/>