Re: [SLUG] joe-job or rootkit?

From: Larry Brown (larry.brown@dimensionnetworks.com)
Date: Thu Apr 17 2008 - 21:34:28 EDT


On Thu, 2008-04-17 at 14:33 -0400, Eben King wrote:
> On Thu, 17 Apr 2008, Robin - Bartow FL wrote:
>
> >> Use SPF records and you'll stop this.
> >>
> >> http://en.wikipedia.org/wiki/Sender_Policy_Framework
> >
> > Tonto say, SPF no silver bullet.
> >
> > Does the original outbound spam IP/s "appear" to be Eben's IP/s?
>
> In my case, the spam appears to be from $NAME@csee.$UNI.edu, with a return
> address of "undergrad@csee.$UNI.edu", which is a broadcast address, so I got
> it. At least I think that's how it went. I've already deleted them. There
> were only 68 bounces. Small batch.
>

I got the same type of batch except that it did use my e-mail address as
the sender address with random names and it ran from some time Saturday
through Sunday and then disappeared.

Larry

-----------------------------------------------------------------------
This list is provided as an unmoderated internet service by Networked
Knowledge Systems (NKS). Views and opinions expressed in messages
posted are those of the author and do not necessarily reflect the
official policy or position of NKS or any of its employees.



This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 15:40:32 EDT