[Top] [All Lists]

Re: SPF I-D for review: draft-schlitt-spf-classic-01.txt

2005-05-25 12:15:13

Arnt Gulbrandsen wrote:

I suspect that every few weeks, they just pick a new victim. 

Yes, I've read reports about this pattern on danam (the German
counterpart of nanae minus trolls) in 2004.  But in my case
the "few weeks" were almost exactly six months.  And I didn't
get any further backscatter since it stopped.

About 100 Sober-Q last week, the author of this beast didn't
bother to avoid SPF-protected addresses.  But that's nothing
against the 250,000 backsatter mails I did _not_ get after it
stopped.  Or the 150,000 before.  With my modem account I care
about these "peanuts".

Maybe some Sober-Q FAIL results for my forged addresses helped
to block / report the infected systems faster, the worm author
reads danam, he will be delighted by my "technical tips for a
successful worm author".
                        Sigh, bye, Frank


<Prev in Thread] Current Thread [Next in Thread>