Hi,
I don't know if I'm a target of some SPAM attack or if it is just business
as usual.
In the past day or two, I started seeing a lot ( ~ 3000/day ) bounces from
SPAMers forging my domain in their "From:" address. I probably have over
10000 bounces now.
However, what is unusual is the following:
- The actual spam is sent From "[EMAIL PROTECTED]" (where domain is my
domain).
- The actual spam headers attempt to forget my mail server's IP and
FQDN in the "Received: " headers to make it look like I actually sent it.
- Some spam messages also contain references to the dns server for my
domain in them.
Most of the IP addresses look like that a large group in Poland is doing
this....
And most of the messages either have the "TheBat" in "X-Mailer" or the
MessageID.
I'm used to forged SPAM, but not on this scale...
-Alex
------------------------------------------------------------------------------
This List Sponsored by: Black Hat
Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas.
World renowned security experts reveal tomorrow's threats today. Free of
vendor pitches, the Briefings are designed to be pragmatic regardless of your
security environment. Featuring 36 hands-on training courses and 10 conference
tracks, networking opportunities with over 2,500 delegates from 40+ nations.
http://www.blackhat.com
------------------------------------------------------------------------------
