Subject: RE: [Asrg] News Article - FTC targeting open relays

From: Paul Judge <[email-masked]>
Date: Fri, 16 May 2003 17:09:36 -0400

Hey Steve,

Can you provide a little more information about your observations? For
example, what is the source of this data? What percentage comes from each
source? Over what timeframe was this data observed? How do you determine if
a proxy is on a trojan or installed by the machine's owner?

Thanks

> -----Original Message-----
> From: Steve Atkins [mailto:[email-masked]] 
> 
> That's not what I'm seeing. I'd say that there was a lot 
> coming from normal legitimate servers - sometimes offshore, 
> sometimes in the US - a lot coming via open proxies, a fair 
> few through open relays, some being sent through scripted 
> freemail webmail, a few coming from compromised machines and 
> a few from end-user accounts.
> 
> Of the open proxies... some of the proxies are trojans, some 
> are installed by the machine owner.
> 
> Note that the FTC announced action against both open relays 
> and open proxies, if I recall the announcement correctly.
> 
> Cheers,
>   Steve
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Steve Atkins <[email-masked]>
Date: Fri, 16 May 2003 18:13:43 -0700

On Fri, May 16, 2003 at 05:09:36PM -0400, Paul Judge wrote:
> example, what is the source of this data?

Various sources, ranging from my own (completely unfiltered) mailbox,
spamtrap feeds through to data analysis done for a number of our
clients.

> What percentage comes from each source?

Couldn't tell you - that's not data I was (or am) interested in
gathering. This is a rough ranking of the relative proportions of
different sources of spam I've observed, not an exact count.

> Over what timeframe was this data observed? 

Recently, say the last three months.

> How do you determine if

There are a number of ways, some of which I won't mention on a public
list. Two of the more obvious ways to spot trojans are proxies
listening on non-standard ports and forensic analysis of the
compromised machines. Trojans and compromise machines are definitely
in the minority - there are easier ways to send spam right now.

Cheers,
  Steve