Time to check the rate limits on your mail servers

Thu Feb 3 18:22:08 UTC 2005

GE> Date: Thu, 03 Feb 2005 17:14:40 +0200
GE> From: Gadi Evron

GE> heck, I don't see how SMTP auth would help, either. They have local
GE> access to the machine.

"User joe6pack is pumping out 100k messages/day.  That can't possibly be
valid; let's disable his -- and only his -- SMTP access.  He can't spam
directly via SMTP/25 connections, so we're good there."

"User joe6pack's mail volume is two sigma above normal.  Good thing our
outbound mail spam scanning is much more stringent under these
conditions."

"User joe6pack doesn't know which of 50 machines behind his SOHO's NAT
box sent the spam.  Luckily, the username helps us/him track down the
infected box."

Eddy
--
Everquick Internet - http://www.everquick.net/
A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/
Bandwidth, consulting, e-commerce, hosting, and network building
Phone: +1 785 865 5885 Lawrence and [inter]national
Phone: +1 316 794 8922 Wichita
________________________________________________________________________
DO NOT send mail to the following addresses:
davidc at brics.com -*- jfconmaapaq at intc.net -*- sam at everquick.net
Sending mail to spambait addresses is a great way to get blocked.
Ditto for broken OOO autoresponders and foolish AV software backscatter.