[Mimedefang] Let the Fishing begin

[David F. Skoll]

On Thu, 07 Jun 2012 12:41:53 -0500
Ben Kamen <bkamen at benjammin.net> wrote:

> Has anyone else seen an increase since the breach?

Not really.  But interestingly, I've seen a few emails to my theoretically
secret former LinkedIn address.  These are in my logs from before
the breach was disclosed... could it be that the breach actually happened
a month ago?

May 11 16:33:44 colo3 CanIt[29042]: q4BKXhXA027488: Replacing locked
address t99ef724coxc3omn at la.roaringpenguin.com with private address
dfs at roaringpenguin.com

May 11 16:33:45 colo3 sm-mta[27488]: q4BKXhXA027488:
from=<xvcvrsqkcbl at alltech1.com>, size=780, class=0, nrcpts=1,
msgid=<716758022412.03300471078362 at alltech1.com>, proto=SMTP,
daemon=MTA, relay=[89.123.28.82]

May 11 16:33:45 colo3 CanIt[20530]: q4BKXhXA027488: what=greylisted,
stream=default, city=Timisoara, country_code=RO, detail=post-data,
nrcpts=1, relay=89.123.28.82, sender=xvcvrsqkcbl at alltech1.com,
subject=%3D?iso-8859-1?Q?Start_winning_big_with_our_generous_welcome_bonus_at_Dice?%3D%09%3D?iso-8859-1?Q?_Stars_Casino!?%3D

May 11 16:33:45 colo3 sm-mta[27488]: q4BKXhXA027488:
to=<t99ef724coxc3omn at la.roaringpenguin.com>, delay=00:00:00,
pri=30780, stat=<xvcvrsqkcbl at alltech1.com>... First-time sender
tempfailed as anti-spam measure; please try again in 60 minutes

Interesting how that leaked out...

Regards,

David.