full-disclosure - Re: Empty emails example

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040228204047.XKAQ189272.fep03-mail.bloor.is.net.cable.rogers.com@BillDell>
From: full-disclosure at royds.net (Bill Royds)
Subject: Re: Empty emails example

Received from ISP about empty email I received. If it is not a spammer, it
could be a virus sending emails without the payload.

-----Original Message-----
From: Rory Irvine [mailto:rory@...el.net.uk] 
Sent: February 28, 2004 3:24 PM
To: Bill@...ds.net
Subject: Re: spam flood

Hi,

> X-SamSpade-Version: 1.14
> 
> tradeelectronically.com::  
>  Your server is being used to flood send emails. Please check into its
> misuse.
>   ...
>   

...

> > Received: from 80.76.205.232 by 24.147.39.6; Sun, 29 Feb 2004 00:46:57
> +0500

...

Thanks for bringing this to our attention.

The IP address in question, 80.76.205.232, belongs to a network that is
not currently routable. Its appearance in the headers of the spam
you've received is therefore likely to be a result of a forgery by the
spammer. Unfortunately, there's not much we can do about this :(

I notice that you use the words "flood send" - did you receive multiple
spams appearing to be relayed through that IP? If so, I'd appreciate
copies of as many of the messages as possible, as it may be eveidence of
a deliberate attack against our network.

Rory Irvine
System Administrator
Bytel Ltd