[Dshield] Fanmail from a flounder

Frank Knobbe frank at knobbe.us
Fri Apr 27 16:15:10 GMT 2007


On Fri, 2007-04-27 at 10:04 -0400, Tom wrote:
> is bogus. port 25 is not active and I doubt that a provisioning dsl 
> line in mexico is a relay.

I've seen plenty of spam coming from that ISP for a while. So even if
that port 25 is currently closed (read, end user machine turned off),
there are plenty of unsecured workstations in that ISPs network that
either have open relays or have spam-spewing bots installed.

-Frank

-- 
It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://lists.sans.org/pipermail/list/attachments/20070427/af0bfe23/attachment.bin 


More information about the list mailing list