finding the spammer (was Re: [clug] <your email address> I take that back)

[Tim Potter]

On Thu, 2006-04-20 at 15:08 +1000, Kim Holburn wrote:

> He had an automated system that replied each time I (or anyone else)  
> sent an email to the clug list with an email appearing to be a  
> response from greylist system and asking me to click on a "special"  
> link to verify I had in fact sent the email.  He has been subscribed  
> to the clug list and some other lists for a few weeks.

I wouldn't call it a greylist system.  It's one of those stupid
challenge/response programs like TMDA which tries to solve spam by
generating more of it.

> It looks like at the very least it harvests emails from people who  
> send emails to the clug list and immediately bombards them with an  
> awful lot of emails.  I know this because the sender of the emails I  
> sent is not really a valid email and I have never used it before I  
> have been seeing a dictionary attack on it on my mail server in the  
> last hour or 2.  Otherwise I probably wouldn't have noticed this in  
> the normal blizzard of spam and anti-spam in my email system.

Neat.  It could be an infected Windows desktop that is triggered by
received emails.  This is a bit of a problem on the samba list as well
where if you haven't posted to the list before, your mailserver starts
getting hit with viruses as soon as you do.  )-:


Tim.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/linux/attachments/20060420/0abec80b/attachment.bin