Re: Isn't spam a ISP issue?

On 13-03-18 11:51 AM, Steve Atkins wrote:
> 
> On Mar 18, 2013, at 8:45 AM, Chris Lewis <[email protected]> wrote:

>> Using an ISP MTA for spam hasn't been common for the a decade or so.
> 
> And yet, I still get a lot of spam from ISP smarthosts, and it's often the
> trickiest to filter (or otherwise deal with, as the ISPs involved don't care
> and wholesale blocking of their outbounds is problematic).

I wouldn't exactly say they don't care, it's just damn difficult to
solve.  But we're working on it ;-)

Somewhere around 5% to perhaps 30% of all spam is compromised account
spamming through MTAs.  This seems to overlap with my previous numbers,
but remember that a given attack can be more than one thing.

Part of that is sendsafe - sendsafe infections should be relatively
simple to at least limit the damage.  Each compromised account sends a
_lot_.

What's worse is that cutwail (windows bot) has learned how to spoof
auth, as has at least one of the *ix web server compromises.  The latter
of which is particularly "good" at limiting the amount of spam sent per
compromised account even though individual IPs are sometimes observed to
send more than 1M spams/day, so rate-limiting by-user doesn't help.

> Just because it's not a big fraction of the volume doesn't mean it's not
> a sizable fraction of the problem.

True enough.