RE: [cobalt-users] RaQXTR - Help! Being spammed into next week

["Dan Kriwitsky" <list1@xxxxxxxxxxxxxxxxxxxx>]

> "Tim Skipper" <mailinglists@xxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> > Steve, and others that replied....
> 
> > As you can see they're not coming from a consistant IP address. The 
> > only thing that is relatively common is the from line, 
> which is always 
> > amandaXXXX@xxxxxxxx, where XXXX is a random sequence.

Based on that, I'd almost bet the spam leads to sex2go.com. See
news.admin.net-abuse.email for details. They've been forging my domain
using the same nameXXX@xxxxxxxxxx rotating fake from address for months.
A good thread with info on them
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&safe=off&selm=bPuH9.2
055%2437.230659%40cletus.bright.net or http://tinyurl.com/3cpv (Click
the "Complete thread" link.)

Those "dictionary" attacks is why I discourage my users from having a
catch-all address and instead suggest they just stick with info,
webmaster, abuse, etc. and if they use an underscore, joe_smith@ to also
have joe-smith@ which generally takes care of catching mistakes.

-- 
C2002 Dan Kriwitsky

Please reply to the list only. Off list replies are not read.