Re: Spam sent from compromised (web)hosts vs botnet spam

> I think this isn't just an interesting statistic about spam (like
> reports listing the ten worst spam-sending countries), but it may
> indicate a problem. I suspect most of these senders are normal MTAs,
> running Sendmail or Postfix, against which many anti-botspam
> techniques won't work as well - as such, these emails may be more
> likely to slip through filters.

I've heard that a lot of them are sites running versions of blog or
cms software with known security holes that allow bad guys to upload
scripts and run them.  Since the number of popular blog and cms
packages is small, the scanning and upload is automated.

A lot of web hosting companies force the outgoing mail through
smarthosts, but then don't do effective outbound filtering.  (Perfora
and Demon, we're looking at you.)  That makes things worse, since now
you have the real mail and spam all coming from the same small set of
IPs.

It's also possible that bad guys are signing up for their own hosting
accounts, and Peer1 certainly has a history of ignoring abuse
problems, but I don't know which predominates.  Further research is
definitely required.

-
This is the asrg mailing list.  To change your subscription settings, see
http://lists.services.net/cgi-bin/mj_wwwusr/domain=lists.gurus.org