Slashdot Mirror

← Back to Stories (view on slashdot.org)

I am the Most Spammed Person in the World

Posted by timothy on from the heart-goes-out-to-you dept.

jefp writes "In November 2004, Microsoft's second-in-command Steve Ballmer made some headlines by mentioning that Chairman Bill Gates was getting four million spams per day. At the time, I was dealing with a little spam problem of my own - I was getting around a million spams per day. I found it a little comforting that my problem wasn't quite as bad as Bill's. However, a couple of weeks later Ballmer corrected himself, saying he mis-remembered the stat and Gates actually gets four million per year. This means I was getting one hundred times as much spam as Bill Gates. I've written a tutorial explaining why I get so much crapmail and how I deal with it."

2 of 478 comments (clear)

  1. Re:Tip #1 by phildog · · Score: 4, Interesting

    thanks for the plug xtracto, I created and maintain dodgeit.com :-) We were getting well over 1 million spams a day before we started using DNS blacklists. I'm stunned that the story author is weathering the storm with sendmail. I never could configure that beast. Dodgeit is a postfix shop.

    --
    slashsearch.org - slashdot search. powered by google.
  2. What to do... by SamMichaels · · Score: 5, Interesting
    Well his site is dead, mirrordot chokes on frames, and I'm too lazy to google....so I'll risk getting -1 RTFA and post anyway.

    This guy's SMTP server:
    220 gate.acme.com ESMTP Sendmail; Wed, 8 Jun 2005 11:53:27 -0700 (PDT)
    EHLO myhostname
    250-gate.acme.com Hello [myip], pleased to meet you
    250-ENHANCEDSTATUSCODES
    250-PIPELINING
    250- 8BITMIME
    250-SIZE
    250-ETRN
    250-STARTTLS
    250-DE LIVERBY
    250 HELP
    Pipelining is turned on for untrusted hosts. Nice.

    Either way, a good portion of the spam hitting my system never even makes it to EHLO/HELO time because if there's any sort of resolution problems with the dns/rdns or if the hostname contains the IP address in it (RFC violation) I delay the connection 20 seonds before the greeting. RFC states clients WILL NOT send data unless asked to do so, except for pipelining which is not advertised for untrusted hosts. When the MTA sees a bunch of incoming crap, it drops the connection because they violated the RFC rules for handshaking (clients MUST wait for the greeting). This does not affect legit MTAs with temporary problems.

    I go through a whole bunch of other checks even before DATA time, delaying at each step if there's a problem. 90% of the spam/viruses never even make it to scanning for spam/viruses because they violate something before that and the connection get drops (or they drop it from waiting). Once again, delaying 20 seconds does NOT affect legit MTAs.

    Big writeup on SPAM filtering

    My MTA