Dong CHE has told me that mail from mail.freebsdchina.org has been bounced back because it was listed in rblplus.mail-abuse.org. From the query page I found mail.freebsdchina.org were listed in mail-abuse.org’s DUL by mistake (I believe so because the mail.freebsdchina.org block is not owned by dial up user).
With more and more aaazzz’s received on beastie.frontfree.net, it makes me to seriously consider the possiblity to set up a set of early filter on postfix.
From my statistics on beastie.frontfree.net, the winner is Worm.SomeFool family.
There are two common way to process unaccepted letters: One is bounce, a.k.a. give the sender a message saying “Your letter is bounced.” Another is discard, in other words, drop the letter silently.
It’s really necessary to train a new security officer lead for Frontfree, if I must leave the campaus. While it will be reasonable if I will invest some of my time maintaing the server, they must deal some real-world problems theirselves, as I may be unable to reach these boxes in time.
Gibe and its variants are still dominant, and MyDoom is approaching to catch up:
beastie# cat drwebd.log | grep infect | grep MyDoom | wc -l
243
beastie# cat drwebd.log | grep infect | grep Gibe | wc -l
257
beastie# cat drwebd.log | grep infect | grep -v Gibe | grep -v MyDoom | wc -l
0
It’s interesting that there’s no viruses without a name “Gibe” nor “MyDoom”…
From my Dr.Web log, it seems mydoom is getting its peak. Today it replaced the Win32.HLLM.Gibe.2, to be the king of virus on my mail server :)
It’s to my interest that the virus seemed to be < 32K. So if you have a sample, please send it to me (REMEMBER: Please encrypt it by adding a password in your ZIP or RAR archive, so I will be able to receive it without having the DrWeb to block it.)
呵呵，实在不知道闹鬼这个词怎么能够贴切地用英文表达，所以，还是老老实实用中文吧，so if you don’t understand Chinese, I can’t share this blob with you, just learn Chinese like what I did with English :-)