Re: Spam sent from compromised (web)hosts vs botnet spam

>I'll do some initial research to see if a significant number of spam sending IPs is listening on port
>80. If there is, I'll look at the correlation between catch rates and listening on port 80. I'm making
>the assumption here that, for IP addresses that send spam, there is significant overlap between
>'listening on port 80' and 'being a compromised webhost'.

You might want to follow one Received header, which could find
webhosts using a shared outbound mail relay.

-
This is the asrg mailing list.  To change your subscription settings, see
http://lists.services.net/cgi-bin/mj_wwwusr/domain=lists.gurus.org