Section on : Abuse detection and control

Presentation 2 is on Dynamic Port 25 Blocking to Control SPAM Zombies by Jonathan Schmidt.

In their experience dynamic blocking is almost as as effective as a total port 25 block this is since many end users don’t actually care about port 25 blocking. They had 5 out of 250,000 that cared in their region.

Presentation 3 is Miles Libbey Yahoo! about algorithmically determining store-and-forward MTA relays using DomainKeys. This is an interesting way of gathering forwarders using domainkeys to wind back the trusted headers to extract and assign reputation to the sending IP’s from the previous received line as provided by the forwarder.

Presentation 4 is Anrirudh Ramachandram from Georgia Tech on “Can DNS blacklists keep up with bots”. Interesting since I had breakfast this morning with Jeff Chan from surbl.org Highlighted are 2 distinct issues, detection (as in detection rate) and response (how long does it take to list). The buzzline is that 60% bots target just one domain, though he notes that this stat could be flawed.