[LINK] DOS Spam

[Scott Howard]

On Wed, Oct 31, 2012 at 10:04 PM, Roger Clarke <Roger.Clarke at xamax.com.au>wrote:

> I assume that there are filters at various points in the network,
> including at individual IAPs, that block the most extreme forms of
> attachment-laden emails.
>
> But I just got one (well two copies of the same email) with 299 files
> totalling 7.5MB).  Headers below.
>

Interestingly this is an area where most anti-spam products fail.

The majority (but not all) of the major anti-spam products simply fail to
scan messages that are beyond a certain size.  Generally this works because
spammers aren't interested in sending large messages, as that generally
means that they can send fewer of them.

Some levels of protection still work (eg, IP address
reputation/blacklists), but if they get past that level then they are
likely to hit the mailbox.

  Scott