[unisog] massive uptick in targeted spam this weekend and week

James Morris jmorris at cac.washington.edu
Thu Oct 17 17:04:02 GMT 2002


They're also changing IP addresses fairly frequently to avoid
counter-measures based on rate detection..

-James 

-----Original Message-----
From: H. Morrow Long [mailto:morrow.long at yale.edu] 
Sent: Wednesday, October 16, 2002 11:45
To: Steve VanDevender
Cc: unisog at sans.org
Subject: Re: [unisog] massive uptick in targeted spam this weekend and
week


We also saw them switch over to optprofessionals.com last night.

Morrow

Steve VanDevender wrote:
> Steve VanDevender writes:
>  > The nice thing, though, is that all the
>  > stuff is showing up with sender addresses in the optingnow.com
domain,
>  > making it quite easy to block.
> 
> Except as of last night they seem to have started using the domain
> optprofessionals.com too.  Whois information seems to indicate this is
> exactly the same outfit as optingnow.com.
> 
> Exploiting open proxies to send spam full of forged headers is
_really_
> professional, isn't it?





More information about the unisog mailing list