[nsp-sec] CC at 207.218.241.138

[Stephen Gill]

We reported this one a couple of weeks ago:

 e66d77d6ef22848f5c81eccdd9cb9bb7775b95ba | 1fbee2a1a34b14e43be7a524ecf86edd
|        12 | 5809323 | 2008-01-18 17:55:39 |
http://207.218.241.138/forum.php | 207.218.241.138 | 207.218.241.138 | h
ttp_post | Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR
1.1.4322) | 13749 | US

Ev1, is it still live?

-- steve


On 2/6/08 12:50 PM, "Serge Droz" <serge.droz at switch.ch> wrote:

> ----------- nsp-security Confidential --------
> 
> Hello
> 
> AS      | IP               | AS Name
> 13749   | 207.218.241.138  | EVERYONES-INTERNET - Everyones Internet
> 
> 
> POST http://207.218.241.138:80/forum.php
> 
> Starts sending Mail claiming to originate from Microsoft.
> 
> Cheers
> Serge

-- 
Stephen Gill, Chief Scientist, Team Cymru
http://www.cymru.com | +1 312 924 4023 | gillsr at cymru.com