[Dshield] Spam Falloff (was Increased activity)

Jeff Kell jeff-kell at utc.edu
Tue Aug 19 03:44:28 GMT 2003


John D. wrote:

>> Do the spammers use port 135 to communicate with their bots?
> 
> not sure - but it wouldn't surprise me.  I'm currently doing research
> on spam trojans and bots.

Rarely.  Proxy trojans like Jeem pick random control ports, then log 
onto some obscure IRC server/channel and report their IP/port.  From 
there the spambags have an open proxy.  I've nuked a few recently :-(

Jeff




More information about the list mailing list