[unisog] massive uptick in targeted spam this weekend and week

Steve VanDevender stevev at darkwing.uoregon.edu
Thu Oct 17 17:57:14 GMT 2002

James Morris writes:
 > They're also changing IP addresses fairly frequently to avoid
 > counter-measures based on rate detection..

They're spamming through open HTTP and SOCKS proxies.

Altogether spam rejection volume on one of my hosts has nearly tripled
since last week, and they're a major part of that.

Someone on SPAM-L says they look like the "Empire Towers" spammers based
on some common features of the messages, particularly certain patterns
of obfuscated URLs used in the messages.

More information about the unisog mailing list