Re: IM2000 RNASP -- identifying message stores to recipients

On Thu, Mar 11, 2004 at 13:09:47 -0600,
  Charles Cazabon <[email protected]> wrote:
> 
> If domain literals are allowed, he'll use that to direct recipients to his
> spam message store.  People can't blacklist it by domain; blacklisting it by
> IP address will result in false positives when other, innocent parties are
> assigned that IP address.  It costs the spammer nothing to move his spam
> message store around and change his notifications to point to it.

This would still invalid notifications previously sent out with the old
IP address. So they need to steal some more resources to send a new round
of notifications, just like they would with the domain names.

I don't think the innocent parties is a big problem as long as the block lists
get aged over something like weeks. Generally they either got hacked or
they are using dynamic IP addresses which shouldn't be used for a message
store. Occasionally spammers will get a static IP revoked and it will get
handed out to a new customer. Aging blocked IPs will take care of this
case.