[79326] in North American Network Operators' Group
Re: botted hosts
daemon@ATHENA.MIT.EDU (Sean Donelan)
Mon Apr 4 01:11:07 2005
Date: Mon, 4 Apr 2005 01:10:40 -0400 (EDT)
From: Sean Donelan <sean@donelan.com>
To: Nanog <nanog@nanog.org>
In-Reply-To: <m1DI8nr-008hFMC@rdaver.bungi.com>
Errors-To: owner-nanog@merit.edu
On Sun, 3 Apr 2005, Dave Rand wrote:
> The Kelkea (what used to be MAPS) DUL, with more than 150 million entries in
> it stopped about 41% of the spam last month. The QIL, a new product, stopped
> about 55%, with the remainder being stopped by the RBL, OPS and RSS. A view
> of this from a different perspective (an unrelated ISP) is available at
> http://status.hiwaay.net/spam.html
>
> That means that if just the ISPs that we have identified as having
> "dynamically assigned" addresses were to install port 25 blocking, more than
> 1/3 of the spam would vanish.
Why does anyone accept SMTP conenctions from known "dynamically assigned"
addresses? DUL, QIL, etc should drop all those connections on the floor.
If everyone was using DUL, QIL, etc, why do they still complain about
getting spam from dynamically assigned addresses? If mail admins were to
install DUL lists ....
Does port 25 blocking actually make a difference? Any public data from
before and after? Or does it just annoy people, cause problems and not
fix anything?
