New SPAM DOS

Fri Jan 8 19:47:28 UTC 2010

It's a phishing scam:

http://isc.sans.org/diary.html?storyid=7918&rss

On Fri, 8 Jan 2010 12:41:07 -0700
Blake Pfankuch <bpfankuch at cpgreeley.com> wrote:

> I too have been receiving these to my spamtrap domain...  again any
> ideas to combat this would be helpful.
> 
> -----Original Message-----
> From: Shane Ronan [mailto:sronan at fattoc.com]
> Sent: Friday, January 08, 2010 12:34 PM
> To: Owen DeLong
> Cc: Nanog list
> Subject: Re: New SPAM DOS
> 
> I recently started receiving these as well for my domain.
> 
> Would appreciate anyone's input on what the deal is.
> 
> On Jan 8, 2010, at 2:22 PM, Owen DeLong wrote:
> 
> > At least this is new for me...
> >
> > I host scvrs.org on one of my servers, and, it does not have any
> > outlook or owa services.  For some reason, someone decided to try
> > and send this message out to various internet recipients:
> >
> >> Dear user of the scvrs.org mailing service!
> >>
> >> We are informing you that because of the security upgrade of the
> >> mailing service your mailbox (x) settings were changed. In order to
> >> apply the new set of settings click on the following link:
> >>
> >> http://scvrs.org/owa/service_directory/settings.php?email=x&from=
> >> scvrs.org&fromname=wa2ibm
> >>
> >> Best regards, scvrs.org Technical Support.
> >
> > An now I'm having to clean up various blacklistings thinking that my
> > server is a spamvertised web site.
> >
> > Anyone seen this before?  Any good techniques for combatting it?
> >
> > Owen
> >
> 
> 
> 

-- 
John