[nsp-sec] ACK: Spam attack against pike.stonelake.fi (1927 ASNs)

[Helmut Springer]

Hi,


On Fri, Feb 01, 2008 at 01:50:09PM +0000, Kinnari Johanna wrote:
> Since Jan 23 pike.stonelake.fi (217.112.241.160) has been under a
> DDoS-like of spam attack. You can find the list of hosts attached.
> 
> Timestamps are in EET (GMT+2) timezone.
> 
> The IP address(es) mentioned have been found to be a source for email
> messages directed to either one of these bogus addresses:

ACK 71 and 151.


> 71      | 156.153.255.245  | 2008-01-31 09:05:49 | HP-INTERNET-AS Hewlett-Packard Company
> 71      | 161.114.21.104   | 2008-01-31 07:36:45 | HP-INTERNET-AS Hewlett-Packard Company
> 71      | 161.114.21.107   | 2008-01-31 09:38:28 | HP-INTERNET-AS Hewlett-Packard Company
> 151     | 15.208.32.41     | 2008-01-31 06:39:46 | IND-NTC-AS - Hewlett-Packard Company

All SMTP relays, investigation by CSIRT running, sorry for the
delay.


Cheers,
helmut

-- 
helmut springer                                          HP Services
email:     delta at hp.com
phone: +49.7031.14.4240                      EMEA Escalation Manager