Re: email address probes

[Ned Fleming <ned () kaw us>]

On Wed, 5 Feb 2003 20:54:19 +0000, Andy Bastien
<lists+incidents () yuggoth net> wrote:

[snip]

> I'd like to be able to stop these attempts, but I can't think of a way
> to do it.  All of the attempts are coming from valid servers from some
> domains that we can't block.  They do all have null reverse-paths
> (MAIL FROM:<>), but I don't think that we can reject on this criteria

Maybe you're being joe-jobbed. To wit: A spammer is using your domain
name as the "From: xyz () yogguth net" or "Reply-To:" address on the spam
he's spewing.

        http://www.spamfaq.net/terminology.shtml#joe_job


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com