From: "MATSUDA Yoh-ichi" <[EMAIL PROTECTED]>
Hello.
From: "John Fleming" <[EMAIL PROTECTED]>
Subject: hey john spam
Date: Fri, 27 Jan 2006 19:48:03 -0500
This is a new one for me. Today I've received some mail with "hey john" in
the subject, and the mail otherwise appears blank. It didn't contain a
virus, or it would've been discarded by ClamAV.
...
I received 2 similiar spams.
Then, I wrote rules below:
I'm watching them still roll in and have developed a theory about them.
Suppose some "idiot" decides to play "white hat hacker" with a botnet
he managed to commandeer or a set of open relays he managed to discover.
So he sends these strange emails through those links with the intent of
effectively generating a DoS attack against the open relays or compromised
computers. I note that the scores on the messages are going up with time
as they get listed in more and more of the BLs. At a guess chello.pl is
having a problem delivering email anywhere in the world at the moment.
Their user at 84.10.17.111 is certainly not delivering mail very many
places. It's a "semi-clever" DoS against open spam sources.
{^_-}
