Re: German Spam

Hey folks... This is the new Sober worm... Not much you can do short of =
filter and reject the numerous subject lines it is generating.  Turns =
the infected system into a mail server.  Reverse DNS may help, but not =
entirely.
-sjf

-----Original Message-----
From: "Dick Wesseling"<[email protected]>
Sent: 5/16/05 1:01:37 PM
To: "DSBL Discuss"<[email protected]>
Subject: Re: [DSBL-Discussion] German Spam=20


Puff@NLE said:
> following IPs.  I only test a few ports - could someone else give
> them a good probe?  Thanks!

I did a grand scan of 25 hosts(*), and it seems to use a custom mail=20
engine rather than an open proxy (well actually I found one -=20
82.55.78.173:s4:1080 - but that is probably due to a double infection,=20
or a dynamic IP being reused).

(*) I probably scanned much much more than 25, but this sample was=20
derived by checking my log against a list of known infected systems.

----------------------------------------------
This message was sent to the opt-in DSBL list.
If you do not want to receive DSBL messages,
please send mail to [email protected].


----------------------------------------------
This message was sent to the opt-in DSBL list.
If you do not want to receive DSBL messages,
please send mail to [email protected].