Massive SPAM Increase

[Alex <incidents () alex gotdns org>]

Hi,

I don't know if I'm a target of some SPAM attack or if it is just business 
as usual.


In the past day or two, I started seeing a lot ( ~ 3000/day ) bounces from 
SPAMers forging my domain in their "From:" address. I probably have over 
10000 bounces now.

However, what is unusual is the following:
  - The actual spam is sent From "domain@domain" (where domain is my domain).
  - The actual spam headers  attempt to forget my mail server's IP and 
FQDN in the "Received: " headers to make it look like I actually sent it.
  - Some spam messages also contain references to the dns server for my 
domain  in them.

Most of the IP addresses look like that a large group in Poland is doing 
this....

And most of the messages either have the "TheBat" in "X-Mailer" or the 
MessageID.




I'm used to forged SPAM, but not on this scale...


-Alex

------------------------------------------------------------------------------
This List Sponsored by: Black Hat

Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas. 
World renowned security experts reveal tomorrow's threats today. Free of 
vendor pitches, the Briefings are designed to be pragmatic regardless of your 
security environment. Featuring 36 hands-on training courses and 10 conference 
tracks, networking opportunities with over 2,500 delegates from 40+ nations. 

http://www.blackhat.com
------------------------------------------------------------------------------