> > On 06/06/06, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > > We have received a few strange emails (from Korea and France) which > > lists a three character number in the subject line and a different > > three digit character number in the body, no attachments. > > > > The sender (from field) has been spoofed and displays the receivers > > name (to field). > > > > I did a search on google but could not find any further information. > > Has any seen or know where/why these emails are being received? Maybe > > a sdbot infection on zombie PC? > > It's mentioned in the ISC diary today - I got one too, but I haven't > seen any good theories about what it is. It could just be a mistake on > behalf of the spammers. > > If you feel like it, you could note the IP address it originated from > and look it up at openrbl.org to see which, if any, block lists the IP > is in. if it's in the CBL or Spamhaus XBL, that usually indicates a > compromised host. > > cheers, > Jamie > -- > Jamie Riden / [EMAIL PROTECTED] / [EMAIL PROTECTED] > NZ Honeynet project - http://www.nz-honeynet.org/ >
They're not on the CBL/SBL or SORBS, or else I'd never have seen them -- Tim Boyer [EMAIL PROTECTED] ------------------------------------------------------------------------------ This List Sponsored by: Black Hat Attend the Black Hat Briefings & Training USA, July 29. August 3 in Las Vegas. World renowned security experts reveal tomorrow.s threats today. Free of vendor pitches, the Briefings are designed to be pragmatic regardless of your security environment. Featuring 36 hands-on training courses and 10 conference tracks, networking opportunities with over 2,500 delegates from 40+ nations. http://www.blackhat.com ------------------------------------------------------------------------------
