Re: [Operators] Let's start some witch-hunt

2010-06-15 Thread Pedro Melo
Hi, 2010/6/16 Nikolay Iliev : > Please, stop sending me these newsletters or whatever you call them. I > received 11 yesterday!... It's quite annoying you know. So please send me an > unsubscribe link or simply do not waste your time sending me your emails. Nikolay, all messages to the XMPP Opera

Re: [Operators] Let's start some witch-hunt

2010-06-15 Thread Nikolay Iliev
Please, stop sending me these newsletters or whatever you call them. I received 11 yesterday!... It's quite annoying you know. So please send me an unsubscribe link or simply do not waste your time sending me your emails. > Date: Tue, 15 Jun 2010 18:57:01 -0500 > From: a...@seabrook.me > To: m

Re: [Operators] Let's start some witch-hunt

2010-06-15 Thread Nikolay Iliev
Please, stop sending me these newsletters or whatever you call them. I received 11 yesterday!... It's quite annoying you know. So please send me an unsubscribe link or simply do not waste your time sending me your emails. > Date: Tue, 15 Jun 2010 19:57:27 -0500 > From: coder2...@gmail.com > To

Re: [Operators] Let's start some witch-hunt

2010-06-15 Thread Dieter Lunn
It seems like an IM spam bot to me. I don't run a public server yet but have been considering it for some ideas I have. Dieter Lunn http://www.coder2000.ca On Tue, Jun 15, 2010 at 6:57 PM, Adam Seabrook wrote: > I had 5,000 accounts registered on chatmask.com and about 1,000 concurrent > login

Re: [Operators] Let's start some witch-hunt

2010-06-15 Thread Adam Seabrook
I had 5,000 accounts registered on chatmask.com and about 1,000 concurrent logins after which the server would block them. Banned all of them but they continue to try and log in but have stopped creating accounts. I personally think it is not a bot but some type of free messaging application as

Re: [Operators] Let's start some witch-hunt

2010-06-15 Thread naw
On Miércoles 16 Junio 2010 01:00:07 Martin Sebald escribió: > Hello viq! > > >> Maybe I'm stating the obvious here, but this really sounds like a > >> virus-originated botnet using XMPP as the control channel. > > I am thinking it would be interesting to see some of the content they are > > sendin

Re: [Operators] Let's start some witch-hunt

2010-06-15 Thread viq
On Wed, Jun 16, 2010 at 1:00 AM, Martin Sebald wrote: > Hello viq! > >>> Maybe I'm stating the obvious here, but this really sounds like a >>> virus-originated botnet using XMPP as the control channel. >> I am thinking it would be interesting to see some of the content they are >> sending. I wonde

Re: [Operators] Let's start some witch-hunt

2010-06-15 Thread Martin Sebald
Hello viq! >> Maybe I'm stating the obvious here, but this really sounds like a >> virus-originated botnet using XMPP as the control channel. > I am thinking it would be interesting to see some of the content they are > sending. I wonder if it would be feasible to set up a 'honeypot' server > for

Re: [Operators] Let's start some witch-hunt

2010-06-15 Thread viq
On Tue, Jun 15, 2010 at 11:37 PM, Andreas Monitzer wrote: > On Jun 15, 2010, at 23:31, Peter Schwindt wrote: > >> Martin (of hot-chilli.*) was the first to publicly (on jadmin-ML, about >> 2 weeks ago) mention a bunch of weird registrations. The accounts to be >> considered all look nearly the sam

Re: [Operators] Let's start some witch-hunt

2010-06-15 Thread Martin Sebald
Hello Peter, Mathias, Andreas and list, great that Peter is bringing this issue up here. Our server was dealing with two interesting things. One is what Peter described here and the second is what Mathias described. I also think that this is not a coincidence that our server flatlined several tim

Re: [Operators] Let's start some witch-hunt

2010-06-15 Thread Mathias Ertl
Dear Peter, Martin, Hal and the rest, On 06/15/2010 11:31 PM, Peter Schwindt wrote: > Martin (of hot-chilli.*) was the first to publicly (on jadmin-ML, about > 2 weeks ago) mention a bunch of weird registrations. The accounts to be > considered all look nearly the same: A posix timestamp + ("LOP"

Re: [Operators] Let's start some witch-hunt

2010-06-15 Thread Andreas Monitzer
On Jun 15, 2010, at 23:31, Peter Schwindt wrote: Martin (of hot-chilli.*) was the first to publicly (on jadmin-ML, about 2 weeks ago) mention a bunch of weird registrations. The accounts to be considered all look nearly the same: A posix timestamp + ("LOP" or "LMC") + server part (i.e. 12757

[Operators] Let's start some witch-hunt

2010-06-15 Thread Peter Schwindt
Dear fellow Operators, let's do some real stuff on this ML instead of only receiving low-traffic server listing requests ;-) Martin (of hot-chilli.*) was the first to publicly (on jadmin-ML, about 2 weeks ago) mention a bunch of weird registrations. The accounts to be considered all look nearly t