[unisog] cornell.edu blog being used for spam - and now virginia.edu as well

[Josh]

On Nov 28, 2007 5:29 PM,  <Valdis.Kletnieks at vt.edu> wrote:
> On Wed, 28 Nov 2007 16:17:52 EST, "STeve Andre'" said:
> > I'd wait more than 12 hours.  What if the person responsible is out, etc?
> > I'd wait three days.
>
> I'd *hope* that at "larger universities", there's more than one person :)
>
> I don't know about other places, but we have almost 24x7 coverage of our
> security@ mailbox (we tend to be a bit sparse around 2-4AM for some odd
> reason), but abuse@ probably won't get any action until normal business
> hours - and it often takes a while to wade through all the reports from
> overnight, so if you're at the tail end of the inbox it can be a while.
>
> Speaking of which - what tricks/tips do you guys all have for how to
> distinguish between spam directed at abuse@, and reports about spam that
> happen to include the whole spam?
>
> _______________________________________________
> unisog mailing list
> unisog at lists.dshield.org
> https://lists.sans.org/mailman/listinfo/unisog
>

It may have something to do with this:
http://isc.sans.org/diary.html?storyid=3700