You catch a spammer trying to relay off your network..

[Gadsden]

Let's say you are the admin of a network and your IDS alerts you that a spammer is trying to relay off of your mail server. You see that it is indeed spam (thank you, mailsnarf!) and you know his IP. Do you:

• Flex your 31337 skillz and teach him a lesson he will never forget?
• Try to DoS him off the map?
• Try to scare him away by portscanning, etc.?
• Report him to his ISP and try to get him booted?
• Quietly block him out?
• Rape his dog, kill his wife, burn his house, then salt the earth where he slept?

WWBWD? (What Would BlackWave Do?) :p

[converge]

Keep in mind that the IP you're seeing is probably not anything that will identify or damage the spammer directly... unless the spammer is really stupid, which is much less the case nowadays.

The safer route is to take the abuse@ route... but it's often a futile battle. Just don't let the spammer relay off any of _your_ servers

[blackwave]

it isn't the spam it is the security through obscurity messages in the spam!

Anyone remember this?

Defcon Forums > Technical Area > Got Questions? > Reading foreign leet?

http://forum.defcon.org/showthread.php?s=&threadid=429