[Dshield] Spam Falloff (was Increased activity)
jeff-kell at utc.edu
Tue Aug 19 03:44:28 GMT 2003
John D. wrote:
>> Do the spammers use port 135 to communicate with their bots?
> not sure - but it wouldn't surprise me. I'm currently doing research
> on spam trojans and bots.
Rarely. Proxy trojans like Jeem pick random control ports, then log
onto some obscure IRC server/channel and report their IP/port. From
there the spambags have an open proxy. I've nuked a few recently :-(
More information about the list