Newsgroup: it.news.net-abuse
Titolo: rr.com qualcuno ne sa qualcosa?

Ragazzi, il mio server Exchange sta subendo una sorta di "attacco". Che 
posso fare? L'IP di origine è di rr.com... qualcuno conosce?
Di seguito un po' di righe di log...
Grazie.
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@stkate.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@ufl.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@umd.umich.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@seds.org
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@sfbc.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@siu.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@snu.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@stthomas.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@summer.ucla.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@udel.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@umassp.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@umflint.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@sbts.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@stmarys-ca.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@umkc.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@utk.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@sjc.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-
2008-2-22	8:7:6 GMT	24.39.154.211	empire-srv02	
mx1.stkate.edu
	ALADDIN 
10.0.0.254	
intern...@snow.edu
	1031 
ALADDINi6nx8d...@mail.cometti.ch
	1	0	1683	50	2008-2-20 
15:31:29 GMT	0	Version: 6.0.3790.3959	-	 You won a gift from ebay ! 
ser...@ebay.com
	-

 gift from ebay ! 
ser...@ebay.com
    -
Server "leciti", con credenziali SMTP-AUTH facilmente indovinabili (roba 
tipo admin,admin o test,test per intenderci) che stan venendo abusati 
per veicolare phishing.
Credo di starne individuando e segando una 30ina al giorno di media, da 
due mesi a questa parte...
Non è un "attacco", almeno non più di quanto possa esserlo un qualsiasi 
spam-run...

 due mesi a questa parte...
scusa la curiosità da niubbo: come fai ad individuarli? ... 30 al giorno
sono tanti, come raccogli i campioni?


Ci sono delle "firme" negli header di mail veicolate in quel modo, che 
sono abbastanza significative.
Tengo traccia via header_checks delle mail che giungono e hanno quelle 
caratteristiche, poi faccio qualche verifica che non giunga a me 
attraverso multihop.
Se passa le verifiche ed è evidentemenre un relay abusato, la listo.
Della natura delle suddette firme non è opportuno parlare su canali 
pubblici, per ragioni che spero sian evidenti...