[anti-abuse-wg] how to detect spambots - SPAMTrusted

* Frank Gadegast:

> And the following makes me really crazy:
> - preventing spambotted PCs from sending spam is SOOO easy

The detection problem has been solved years ago, agreed.  There are
multiple, working solutions.

> YES, its not only "likely", its prooven, spambots scan outlook address
> books, and if the provider is only big enough (it works here for
> only 10000 mailboxes) ...
> ... SPAMBOTS USING YOUR DIAL-IN IPs DO SEND SPAM TO YOUR OWN MAILSERVERS !!!

And even if that doesn't happen for you due to some strange scenario,
there are tons of free, external data feeds to which you can subscribe
which provide you with high-quality data about compromised customer
PCs.

> the customer phones up usally 5 minutes later, we can explain
> and check the situation, he is cleaning his computer and
> there is one spambotted PC less in the world.

Cleaning up the PC costs between 100 and 200 EUR.  Someone needs to
absorb those costs.

Detection is solved, but response is still an open problem.

-- 
Florian Weimer                <fweimer at bfk.de>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99