Re: Re: Port 10099?

Dick Wesseling wrote:
> Maybe one of the ISP's on this list can shed some light on this,
> I am sure some of you have interesting trojans on your network.

There's been an increase in trojan-infections that are either not 
proxies or not proxies all the time; and trojans that take their orders 
through irc or other means.

Based on the results of our actions (on first detection, a spamming 
trojan get's the same treatment as a relay or proxy; denial of TCP SYN 
packets), proxy-trojans that are smarter about protecting themselves 
against detection appear to be more prevalent still, though. For about 1 
out of 10 cases that action is not sufficient to stop the flood.

On the incoming side I'm seeing more traffic from hosts that look more 
like dedicated spamming servers (lots in CHINANET-GD space), but behave 
like trojans in their smtp-conversations.

Vince

----------------------------------------------
This message was sent to the opt-in DSBL list.
If you do not want to receive DSBL messages,
please send mail to [email protected].