[prev in list] [next in list] [prev in thread] [next in thread] 

List:       dshield
Subject:    Re: [Dshield] Negligently Exploited Server
From:       David Cary Hart <DavidHart () tqmcube ! com>
Date:       2005-02-03 17:21:52
Message-ID: 1107451312.3654.14.camel () dch ! TQMcube ! com
[Download RAW message or body]

On Thu, 2005-02-03 at 10:25 -0500, Mark Tombaugh wrote:
> On Wednesday 02 February 2005 14:28, David Cary Hart wrote:
> > Absent a response, I added the host to our banned list. The
> > mail just keeps on coming according to the mail logs.
> 
> If you're killing smtp connections based on location without regard to 
> content, are you sure they didn't respond? 

Yes. Moreover, this has nothing to do with location blocking. It's the
IP of a banned server that was added to the dbsbl.

"killing smtp connections based on location without regard to content"
is a tad misleading IMO. If 100% of the mail that I receive from
Spamistan is UCE (some of which have virus attachments), then blocking
smtp connections from Spamistan is most definitely WITH regard to
content -;)

Look, I was one of those people who previously ranted vociferously, and
quite publicly, about sinister blacklists. I have since apologized
publicly. If we want email to be a viable means of business
communications and to be received with the risk of contaminating our
networks, then we need to take those actions (sometimes draconian) that
are based upon economic logic. Some of these are (most regrettably)
antisocial and antithetical to the culture of the Internet.
Unfortunately, that's the price we pay due to the actions of a few
miscreants.   
________________________________________________________________________
Total Quality Management - A Commitment to Excellence
http://www.TQMcube.com

-------------- Sponsor Message ------------------------------------
SANS Intrusion Immersion Training: Orlando, FL, February 3-9th
http://www.sans.org/orlando05

_______________________________________________
send all posts to list@lists.dshield.org
To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
[prev in list] [next in list] [prev in thread] [next in thread]