One new spam source from the current attack. They only used this once
last night on each of my servers, but it's clearly the same
person/group. The useful header for filtering is: (I'm filtering off of
the crosschecked line, since that's where this is coming from. It looks
like they're spoofing as the site they're sending to here, which is a
new wrinkle in their attack if so).
Received: from pop1-wcom.uu.net by pop1-wcom.uu.net with SMTP
(peer crosschecked as: custsvc-4.bv.sgi.net [208.195.210.52])
Also, heard from nlights.com, and he says the attack through his site
was coming from mattblack@audiophile.com, and all traffic from that
site's been banned. I'll let you know if I see any further traffic
through nlight, but that was definitely one of the accounts I've seen
in the spam. Whether he was testing on himself or whether there's some
confusion at nlight,w e'll see, but they're responding and working to
close the hole at the very least (yippee!)
chuq
--
Chuq Von Rospach (chuq@apple.com) Apple IS&T Mail List Gnome
<http://www.solutions.apple.com/>
Plaidworks Consulting (chuqui@plaidworks.com) <http://www.plaidworks.com/>
(<http://www.plaidworks.com/hockey/> +-+ The home for Hockey on the net)
Follow-Ups:
|
|
