[SpamCop-List] Earthlink Servers Compromised

[Robert Slade]

It looks like the Earthlink mail servers have been compromised:

Here is an El Sever mynah.mail.pas.earthlink.net relaying for a Wanadoo.fr
ip listed by sorbs.net:

http://spamcop.net/sc?id=z587767602z4281a2bbb63cf18e42041467cd13d9abz

Here is asmtp-a063f35.pas.sa.earthlink.net relying for 61.145.236.157
(China.cn.net) listed in SORBS:

http://spamcop.net/sc?id=z587767603z76e17e025419877cc290c275ff5419fcz

Here is audiogram.mail.pas.earthlink.net relaying for 69.240.69.211
(Comcast) Listed in SORBS:

http://spamcop.net/sc?id=z587767605zc1139266c88c250b4bdc7db2b35dcdc2z

Here is invasion.mail.pas.earthlink.net relaying for 81.65.126.181 (noos.fr)
listed in SORBS:

http://spamcop.net/sc?id=z587804568z88ace335720924ad2343bee2b8cb5e9ez

In all cases the mail should have been sent direct from the originator, not
via EL. It looks like someone have gained access to the servers and setting
up accounts to send though.

BTW the sites being spamvertised appear to be hosted by YAHOO.

The above is a sample of what I received today.

I have informed EL lets see what happens.

Rob