Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #193925
| From | "Michelle Konzack" <linux4michelle@tamay-dogan.net> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | Re: More then 2800 spams from the list... |
| Date | 2018-03-19 19:40 +0100 |
| Message-ID | <vv7Ro-1Et-13@gated-at.bofh.it> (permalink) |
| References | (4 earlier) <vv4gO-7NP-11@gated-at.bofh.it> <vv4A9-8aE-5@gated-at.bofh.it> <vv4Tw-8gF-5@gated-at.bofh.it> <vv53h-8jE-3@gated-at.bofh.it> <vv5PA-po-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Now I have made a script to analyse where the traffic is comming from:
A singel network in Spain!
Am 2018-03-19 hackte tomas@tuxteam.de in die Tasten:
> What do you mean by "the spammer is on the list"? The spam messages
> don't go via list. I would get them (my own mail server and no spam
> filter beyond the standard Exim header checking, which would never
> drop/reject a mail coming from the list).
>
>> <mail.tamay-dogan.net> is subject of a DOS attack.
>
> Yes, I rather think they are targetting you. The Debian mailing
> list headers seem to me (well placed) spoof.
>
>> It seems, the Attacker know probably several 10.000 wrong configured
>> mailservers and now use it, to pull down my server...
>
> Yes, that's how it looks to me. Perhaps they're real bounces,
> perhaps they're fake. But I'm pretty sure by now that the
> Debian-list related headers are plain fake, to nudge people
> into "responding to list" and thus spreading the spam even
> more.
I am attacked by this network:
----[ c 'whois -B 188.164.196.32' ]-------------------------------------
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf
% Information related to '188.164.192.0 - 188.164.199.255'
% Abuse contact for '188.164.192.0 - 188.164.199.255' is
'abuse@infortelecom.es'
inetnum: 188.164.192.0 - 188.164.199.255
netname: ES-INFORTELECOM-20120912
country: ES
org: ORG-ISS3-RIPE
admin-c: JDDG1-RIPE
tech-c: JDDG1-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-by: AS50926-MNT
created: 2012-09-12T11:52:24Z
last-modified: 2017-11-30T11:26:09Z
source: RIPE
organisation: ORG-ISS3-RIPE
org-name: Infortelecom Hosting S.L.
org-type: LIR
address: Ronda Narciso Monturiol, num.17
Puerta 1 1 Parque Tecnologico
address: 46980
address: Paterna - VALENCIA
address: SPAIN
phone: +34910820073
phone: +34963788771
e-mail: jdomenech@infortelecom.es
admin-c: JDDG1-RIPE
admin-c: VGP13-RIPE
abuse-c: ABIT11-RIPE
mnt-ref: RIPE-NCC-HM-MNT
mnt-ref: AS50926-MNT
mnt-by: RIPE-NCC-HM-MNT
mnt-by: AS50926-MNT
created: 2004-10-07T15:33:06Z
last-modified: 2017-10-30T14:49:58Z
source: RIPE
person: Jose Daniel Domenech Gasco
address: C/ Ciudad de Sevilla, 76 - Pol. Ind. Fuente del Jarro
address: 46980 Paterna
address: Valencia, SPAIN
e-mail: jdomenech@infortelecom.es
phone: +34963788771
fax-no: +34960451442
nic-hdl: JDDG1-RIPE
mnt-by: AS50926-MNT
created: 2002-10-08T14:20:22Z
last-modified: 2013-04-03T16:12:35Z
source: RIPE
% Information related to '188.164.196.0/24AS50926'
route: 188.164.196.0/24
origin: AS50926
descr: AXARnet-Network
mnt-by: AXARNET-MNT
mnt-by: AS50926-MNT
created: 2017-05-16T10:01:19Z
last-modified: 2017-05-16T10:01:19Z
source: RIPE
% This query was served by the RIPE Database Query Service version
1.91.1 (BLAARKOP)
-----------------------------------------------------------------------
They have several 1000 mailservers which send me this crap...
...and if I read on theire website "VPS & CLOUD" my alarm bells are
ringing. I blocked there WHOLE network!
> FWIW, I've sent a test mesage to (some randomly chosen user name)
> at one of the servers in list and am awaiting a bounce message.
>
> Let's see...
>
> @Michelle: could you please send me a *complete* bounce message,
> headers and all, as it arrives at your place? I still can't figure
> out what kind of headers you sent to this list.
yes in some seconds.
> Thanks
> - -- tomás
Thanks in advance
--
Michelle Konzack Miila ITSystems @ TDnet
GNU/Linux Developer 00372-54541400
Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
More then 2800 spams from the list... "Michelle Konzack" <linux4michelle@tamay-dogan.net> - 2018-03-19 14:00 +0100
Re: More then 2800 spams from the list... Jonathan Dowland <jmtd@debian.org> - 2018-03-19 14:20 +0100
Re: More then 2800 spams from the list... Gene Heskett <gheskett@shentel.net> - 2018-03-19 15:50 +0100
Re: More then 2800 spams from the list... <tomas@tuxteam.de> - 2018-03-19 15:50 +0100
Re: More then 2800 spams from the list... Cindy-Sue Causey <butterflybytes@gmail.com> - 2018-03-19 16:10 +0100
Re: More then 2800 spams from the list... Richard Owlett <rowlett@cloud85.net> - 2018-03-19 16:30 +0100
Re: More then 2800 spams from the list... "Michelle Konzack" <linux4michelle@tamay-dogan.net> - 2018-03-19 16:40 +0100
Re: More then 2800 spams from the list... Jim Popovitch <jim@k4vqc.com> - 2018-03-19 17:00 +0100
Re: More then 2800 spams from the list... <tomas@tuxteam.de> - 2018-03-19 17:30 +0100
Re: More then 2800 spams from the list... Miles Fidelman <mfidelman@meetinghouse.net> - 2018-03-19 18:50 +0100
Re: More then 2800 spams from the list... Tony van der Hoff <lists@vanderhoff.org> - 2018-03-19 19:20 +0100
Re: More then 2800 spams from the list... <tomas@tuxteam.de> - 2018-03-19 19:30 +0100
Re: More then 2800 spams from the list... "Michelle Konzack" <linux4michelle@tamay-dogan.net> - 2018-03-19 19:40 +0100
Re: More then 2800 spams from the list... Gene Heskett <gheskett@shentel.net> - 2018-03-19 16:40 +0100
Re: More then 2800 spams from the list... Curt <curty@free.fr> - 2018-03-19 18:20 +0100
Re: More then 2800 spams from the list... Richard Owlett <rowlett@cloud85.net> - 2018-03-19 16:00 +0100
Re: More then 2800 spams from the list... Karol Augustin <karol@augustin.pl> - 2018-03-19 19:40 +0100
Re: More then 2800 spams from the list... Nick Boyce <nick@steelyglint.org> - 2018-03-19 22:20 +0100
Re: More then 2800 spams from the list... Karol Augustin <karol@augustin.pl> - 2018-03-19 22:40 +0100
Re: More then 2800 spams from the list... Joe <joe@jretrading.com> - 2018-03-19 23:30 +0100
Re: More then 2800 spams from the list... <tomas@tuxteam.de> - 2018-03-20 09:00 +0100
Re: More then 2800 spams from the list... Joe <joe@jretrading.com> - 2018-03-20 10:30 +0100
Re: More then 2800 spams from the list... <tomas@tuxteam.de> - 2018-03-20 10:50 +0100
Re: More then 2800 spams from the list... Greg Wooledge <wooledg@eeg.ccf.org> - 2018-03-20 13:30 +0100
Re: More then 2800 spams from the list... David Wright <deblis@lionunicorn.co.uk> - 2018-03-20 14:40 +0100
Re: More then 2800 spams from the list... Greg Wooledge <wooledg@eeg.ccf.org> - 2018-03-20 14:50 +0100
Re: More then 2800 spams from the list... "Michelle Konzack" <linux4michelle@tamay-dogan.net> - 2018-03-20 20:00 +0100
Re: More then 2800 spams from the list... Brian <ad44@cityscape.co.uk> - 2018-03-21 01:20 +0100
Re: More then 2800 spams from the list... Brad Rogers <brad@fineby.me.uk> - 2018-03-21 08:10 +0100
csiph-web