I'm guessing that it is making some guesses at generic names associated with domains. I've seen an unnatural amount of traffic to/from "webmaster@" our various domains. Our webmaster is not very chatty, so I'm thinking that KLEZ tries a few common names to see if the relay will let them slip through.
-Bill -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Harry Vanderzand Sent: Thursday, May 16, 2002 12:53 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] klez A further point on this. We have had incidents of our postmaster account being the spoofed address that is used. Does anyone have any ideas how Klez is doing this? Harry -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Kenneth Bird Sent: Thursday, May 16, 2002 12:37 PM To: [EMAIL PROTECTED] Subject: [Declude.Virus] klez Is anyone else being drove to insanity by klez? We are catching the virus, but that doesn't stop everyone else on different Isp's thinking we are sending them because of the spoofed from address. blblblbl Ken Bird --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
