On Fri, 29 Apr 2005 15:13:54 CDT, Paul Russell said:

> Spammer tactics have changed. Some spamware programs still send messages
> with multiple recipients per message; other send individual messages to
> individual recipients. In either case, the sender addresses on different
> messages are likely to be different. Even without the phenomenal increase
> in the volume of spam, this change in tactics would have resulted in a
> significant increase in the number of X-SPAM jobs.

Umm.. I'm having some cognitive dissonance here.  If the sender addresses are
usually different, why are we seeing the *same* senders often enough to trigger
the spam filters *anyway*? (Obviously, it's because they're randomizing across a
small enough list that they get duplicates often enough to trigger).

I've often wondered how effective the cross-site notifications *really* are these
days - if my Listserv is getting spammed, what are the *real* chances that another
backbone site will see significant spammage from *the same run*?  We may very
well be at the point where the warnings are now more traffic than the spams they
stop.

Note that doing the anti-spam blocking *on the same server* is still useful - if
they've nailed 10 of my lists, there's a *real* good chance another 20 or 30 are
in the pipe.  But the fact that 10 of my lists are in the spammer's targets doesn't
say as much about whether some other site's lists are in the target list.

Personally, I've been running all the e-mailed reports about the spam filter
through a procmail script that basically hands me the ones that are generated
by *my* server, or report about one of *my* user's addresses (probably joe-jobbed,
but still useful to know), and tosses all the other ones.  I've only had 10
e-mails actually show up this month, and it's the 29th.

On the other hand, I've had literally 22,563 pieces of mail bounce back to
the Listserv 'Postmaster' address, the vast majority of which are double-bounces
from spam from bogus source addresses that hit my lists in onesies and twosies...

Conclusion: it's not making much of a difference here, because the vast majority
are already flying under the radar....