Sobig.f harvesting from websites? (was Re: Virus emails from nanog mail list)

["variable () ednet co uk" <variable () ednet co uk>]

On Tue, 19 Aug 2003, Steven M. Bellovin wrote:

> I've gotten hundreds of such bounce messages today.  Only a few have 
> Received: lines, but those have differed.  I don't know for sure if 
> it's the nanog list, since I don't use a different email address for it.

I suspect it's the list archives.  Speaking to customers who are seeing 
similar problems with bounces, the pattern of addresses used suggest that 
those addresses have been havested from their websites.

Rich