North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: AOL holes again.

  • From: Eric A. Hall
  • Date: Tue Mar 20 13:02:01 2001 
> Well, it turns out that it is a problem with AOL that NANOG folks might
> be interested in:
> 
>         http://www.msnbc.com/news/546689.asp?0nm=C14R&cp1=1

Actually it appears to be a problem with earthlink (nee mindspring). I've
been gettting a lot of spam from their server lately, and judging from the
headers it appears the mindspring servers are configured to relay mail
from any system that puts [mail.]mindspring.com in the HELO banner.

For example:

 | Received: from mail.mindspring.com (pool-63.49.172.115.troy.grid.net
 | [63.49.172.115]) by smtp10.atl.mindspring.net (8.9.3/8.8.5) with SMTP
 | id VAA09132; Mon, 19 Mar 2001 21:24:44 -0500 (EST)

I've probably gotten a couple of dozen such spams over the past week,
sourced from all over, with the common flag being [mail.]mindspring.com in
the source spammer's HELO banner.

Of course I've tried to tell earthlink/mindspring about it but all I get
back is a stupid form letter and no action.

AOL's servers did the right thing if this is what they reacted to.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/