[ILUG] how should I handle a flood of fscking backscatter?

[Brian Foster]

  | From: Nick Murtagh <nickm at go2.ie>
  | Date: Mon, 10 Sep 2007 13:09:50 +0100
  | 
  | Justin Mason wrote:
  | > No, it's probably not a joe job, it's backscatter alright.
  | 
  | A quick google turns up:
  | 
  | http://catb.org/jargon/html/J/joe-job.html

 if you follow the link in that definition to the
 description of the original incident, you should
 find (emphasis in original):

     “A Joe Job is essentially malicious.  A spam with
      dave at hotmail.com in the from: line isn't a Joe Job,
      unless the spammer was _trying_ to pin the blame
      on Dave.  So while forged from: lines are almost
      standard-issue on modern spam, Joe Jobs are
      still pretty rare.”

  | http://members.cox.net/joejob/

 indeed, that page says what seems obvious:  some
 people consider backscatter (apparently sometimes
 also called outscatter) to be joe jobs, and other
 people do not.

  | So I'm still calling it a joe job ;)

 and I'm still calling this incident backscatter.  ;-)

  | It hardly matters when you're on the receiving end!

 yep!  it's still ongoing.  the current number of
 bounces is something over 1400, and it started at
 least 12 hours ago.

 and, to my considerable annoyance, several legit
 e-mails (not bounces!) have been shunted aside by
 procmail as-if they were bounces.  grrrrr.....!

  | > SpamAssassin 3.2.x has a ruleset to get rid of it -- the "VBounce"
  | > ruleset.

 ah....  I'll have to look into that (but probably
 not until the storm abates!  ;-\  ).

cheers!
	-blf-
-- 
▶ ▶  I AM CURRENTLY LOOKING FOR A JOB!  ◀ ◀ | Brian Foster
Experienced (>25 yrs) software engineer:    |        Montpellier, FRANCE
 • Unix, Linux, embedded, design-for-test;  | Stop E$$o (ExxonMobile)!
 • Software/hardware co-design, debugging;  |     http:/www.stopesso.com
 • Kernels, drivers, filesystems, &tc;    Résumé (CV) & contact details:
 • IDL, automated testing, process, &tc.   http://www.blf.utvinternet.ie