[SpamCop-List] Earthlink Servers Compromised
nobody at devnull.spamcop.net
Fri Aug 6 18:21:51 EDT 2004
It looks like the Earthlink mail servers have been compromised:
Here is an El Sever mynah.mail.pas.earthlink.net relaying for a Wanadoo.fr
ip listed by sorbs.net:
Here is asmtp-a063f35.pas.sa.earthlink.net relying for 188.8.131.52
(China.cn.net) listed in SORBS:
Here is audiogram.mail.pas.earthlink.net relaying for 184.108.40.206
(Comcast) Listed in SORBS:
Here is invasion.mail.pas.earthlink.net relaying for 220.127.116.11 (noos.fr)
listed in SORBS:
In all cases the mail should have been sent direct from the originator, not
via EL. It looks like someone have gained access to the servers and setting
up accounts to send though.
BTW the sites being spamvertised appear to be hosted by YAHOO.
The above is a sample of what I received today.
I have informed EL lets see what happens.
More information about the SpamCop-List