[unisog] annoying spammer via ppp lines at pacbell.net

Joseph Brennan brennan at columbia.edu
Wed Sep 18 13:05:45 GMT 2002



--On Tuesday, September 17, 2002 15:27 -0600 "William D. Colburn (aka Schlake)" <wcolburn at nmt.edu>
wrote:

> This is a heads up, though it might be belated for some of you.
> 
> Over the weekend someone from a pacbell PPP line connected to my mail
> server and started trying to deliver email to "suspicious" addresses
> following the pattern [-a-z0-9_][-a-z0-9_][-a-z0-9_]@nmt.edu.  I can
> imagine that soon he will move on the more complicated addresses with 4
> tokens instead of 3.  Sigh.
> 
> The sender was set statically as <mailman at postman2.seed.net.tw>, but he
> recently starting using randomly generated address of the form
> <xxxxxxxxxx at yahoo.com> (which x is a lowercase letter) that are a bit
> harder to uniformly block.
 

We've seen only two in the past few days with envelope From set to
<mailman at postman2.seed.net.tw>, and they really came to us from a 
seed.net.tw host.  I don't know what they are.  They were addressed to 
real addresses here.
 
Joseph Brennan                           postmaster at columbia.edu
Academic Technologies Group, Academic Information Systems (AcIS)







More information about the unisog mailing list