Re: [Groff] Spam from list member addresses

[Larry Kollar]

Peter Schaffter wrote:

> I got two pornographic-sounding spams today, one apparently from
> Werner, the other apparently from Ted Harding.  Rather than wait to
> see if these are isolated incidents, I'm cut 'n' pasting both
> emails with full headers into this post.

Yup, I noticed they came back in the last few days. Some server along
the line has gotten smarter about removing the (presumably viral)
payload, though.

> I'm not an expert in mail header forensics, but someone else may
> spot something useful.

I can read headers most of the time, it comes in handy to track spam
back to its injection point. It's the one at the bottom that seems to be
the important one:

> Received: from [194.2.232.250] (helo=199.232.76.166)
>         by monty-python.gnu.org with smtp (Exim 4.34) id 
> 1DH2ik-0007k9-Uq
>         for address@hidden; Thu, 31 Mar 2005 11:40:39 -0500

The one I got had a similar header. The IP address in brackets is
the one that's important here. Quoth the "dig" utility:

> % dig -x 194.2.232.250
>
> ; <<>> DiG 8.3 <<>> -x
> ;; res options: init recurs defnam dnsrch
> ;; got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
> ;; QUERY SECTION:
> ;;      250.232.2.194.in-addr.arpa, type = ANY, class = IN
>
> ;; ANSWER SECTION:
> 250.232.2.194.in-addr.arpa.  1H IN PTR  nat.isep.fr.
>
> ;; Total query time: 2510 msec
> ;; FROM: Lapdancer.local. to SERVER: default -- 10.0.1.1
> ;; WHEN: Thu Mar 31 21:32:56 2005
> ;; MSG SIZE  sent: 44  rcvd: 69
>
> %

The part we want is the line below the "ANSWER SECTION" -- nat.isep.fr.
Querying RIPE's whois (whois -h whois.ripe.net 194.2.232.250) suggests
that Kumar Reddy and Gilles Carpentier (first.last at isep.fr) would be 
the
people to contact about what is likely an infested PC on their network.

A lot of these parasitic programs work by scanning address books for
more potential victims, and often use names from the same address book
as the "source" and destination... which suggests to me that someone
subscribed to the groff list -- or someone who knows someone (I doubt
it's more than one degree of separation) has been infested.
--
Larry Kollar     k  o  l  l  a  r  @  a  l  l  t  e  l  .  n  e  t
Unix Text Processing: "UTP Revival"
http://home.alltel.net/kollar/utp/