Hi,

I don't know if I'm a target of some SPAM attack or if it is just business
as usual.

In the past day or two, I started seeing a lot ( ~ 3000/day ) bounces from
SPAMers forging my domain in their "From:" address. I probably have over
10000 bounces now.

However, what is unusual is the following:
- The actual spam is sent From "domain@domain" (where domain is my domain).
- The actual spam headers attempt to forget my mail server's IP and
FQDN in the "Received: " headers to make it look like I actually sent it.
- Some spam messages also contain references to the dns server for my
domain in them.

Most of the IP addresses look like that a large group in Poland is doing
this....

And most of the messages either have the "TheBat" in "X-Mailer" or the
MessageID.

I'm used to forged SPAM, but not on this scale...

-Alex

------------------------------------------------------------------------
------
This List Sponsored by: Black Hat

Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas.
World renowned security experts reveal tomorrow's threats today. Free of
vendor pitches, the Briefings are designed to be pragmatic regardless of your
security environment. Featuring 36 hands-on training courses and 10 conference
tracks, networking opportunities with over 2,500 delegates from 40+ nations.

http://www.blackhat.com
------------------------------------------------------------------------
------

[ reply ]