August 22, 2003

Sobig.F virus and spam

[The context of this was a mailing list thread about an expected wave of Sobig.F virus attacks from certain sites in the virus data]

I ran the list of Sobig.F attack addresses through Google searches, both by address and by resolved name, to see if anything interesting could be found. The data and results confirmed what Rich Kulawiec had written about the connection to spamming systems. That is, there is a connection to spam systems.

At least eight of the sites appeared in various spam-denying log files from one place which makes such logs public.

Sites found:

Detailed data below or

[The last number is the number of hits of the site from that day, I think]

mailhost1-grep.2003-07-26 (blacklist) 1
mailhost1-grep.2003-07-29 (blacklist) 1
mailhost1-grep.2003-07-30 (proxies) 1
mailhost1-grep.2003-07-31 (proxies) 1
mailhost1-grep.2003-08-02 (proxies) 2
mailhost1-grep.2003-08-02 (blacklist) 2
mailhost1-grep.2003-08-02 (blacklist) 1
mailhost1-grep.2003-08-03 (blacklist) 3
mailhost1-grep.2003-08-03 (proxies) 2
mailhost1-grep.2003-08-05 (proxies) 1
mailhost1-grep.2003-08-10 (proxies) 1
mailhost1-grep.2003-08-11 (blacklist) 1
mailhost1-grep.2003-08-12 (blacklist) 2
mailhost1-grep.2003-08-12 (proxies) 1
mailhost1-grep.2003-08-13 (proxies) 1
mailhost1-grep.2003-08-13 (blacklist) 1
mailhost1-grep.2003-08-14 (proxies) 2
mailhost1-grep.2003-08-15 (proxies) 7
mailhost1-grep.2003-08-15 (proxies) 5
mailhost1-grep.2003-08-15 (proxies) 1
mailhost1-grep.2003-08-16 (blacklist) 2
mailhost1-grep.2003-08-16 (proxies) 1
mailhost1-grep.2003-08-17 (proxies) 9
mailhost1-grep.2003-08-17 (blacklist) 2
mailhost1-grep.2003-08-17 (blacklist) 2
mailhost2-grep.2003-07-24 (blacklist) 1
mailhost2-grep.2003-07-25 (blacklist) 1
mailhost2-grep.2003-07-26 (blacklist) 8
mailhost2-grep.2003-07-27 (blacklist) 1
mailhost2-grep.2003-07-28 (blacklist) 1
mailhost2-grep.2003-07-30 (blacklist) 2
mailhost2-grep.2003-07-31 (blacklist) 7
mailhost2-grep.2003-08-01 (blacklist) 1
mailhost2-grep.2003-08-02 (blacklist) 3
mailhost2-grep.2003-08-03 (proxies) 4
mailhost2-grep.2003-08-04 (proxies) 2
mailhost2-grep.2003-08-11 (proxies) 3
mailhost2-grep.2003-08-11 (blacklist) 1
mailhost2-grep.2003-08-12 (proxies) 1
mailhost2-grep.2003-08-15 (proxies) 2
mailhost2-grep.2003-08-15 (proxies) 2
mailhost2-grep.2003-08-15 (proxies) 1
mailhost2-grep.2003-08-16 (blacklist) 1
mailhost2-grep.2003-08-16 (proxies) 1
mailhost2-grep.2003-08-17 (proxies) 4
mailhost2-grep.2003-08-17 (blacklist) 2
mailhost2-grep.2003-08-17 (blacklist) 1

By Seth Finkelstein | posted in security , spam | on August 22, 2003 07:18 PM (Infothought permalink) | Followups
Seth Finkelstein's Infothought blog (Wikipedia, Google, censorware, and an inside view of net-politics) - Syndicate site (subscribe, RSS)

Subscribe with Bloglines      Subscribe in NewsGator Online  Google Reader or Homepage