From owner-freebsd-ports  Tue Nov 25 15:27:12 1997
Return-Path: <owner-freebsd-ports>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id PAA16188
          for ports-outgoing; Tue, 25 Nov 1997 15:27:12 -0800 (PST)
          (envelope-from owner-freebsd-ports)
Received: from smtp01.primenet.com (smtp01.primenet.com [206.165.6.131])
          by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id PAA16015;
          Tue, 25 Nov 1997 15:26:02 -0800 (PST)
          (envelope-from tlambert@usr05.primenet.com)
Received: (from daemon@localhost)
	by smtp01.primenet.com (8.8.8/8.8.8) id JAA07735;
	Tue, 25 Nov 1997 09:40:35 -0700 (MST)
Received: from usr05.primenet.com(206.165.6.205)
 via SMTP by smtp01.primenet.com, id smtpd007685; Tue Nov 25 09:40:28 1997
Received: (from tlambert@localhost)
	by usr05.primenet.com (8.8.5/8.8.5) id QAA02240;
	Tue, 25 Nov 1997 16:24:36 -0700 (MST)
From: Terry Lambert <tlambert@primenet.com>
Message-Id: <199711252324.QAA02240@usr05.primenet.com>
Subject: Re: We will mail 4 U
To: SPAM-L@PEACH.EASE.LSOFT.COM
Date: Tue, 25 Nov 1997 23:24:35 +0000 (GMT)
Cc: freebsd-chat@freebsd.org, freebsd-current@freebsd.org,
        freebsd-doc@freebsd.org, freebsd-emulation@freebsd.org,
        freebsd-hackers@freebsd.org, freebsd-multimedia@freebsd.org,
        freebsd-ports@freebsd.org, freebsd-questions@freebsd.org,
        freebsd-stable@freebsd.org, spamcomplaints@MCI.NET
In-Reply-To: <199711251853.NAA01005@luomat.peak.org> from "Timothy J Luoma" at Nov 25, 97 01:53:44 pm
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: owner-freebsd-ports@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

> From searching several phone directories online, it appears that the person  
> who sent this spam did so on behalf of:
> 
> 	Jack Luke
> 	39 Panda Av
> 	Middleburg, FL 32068-4765
> 	(904) 282-0945

It is pretty obvious (to me, anyway) that this is a targetted trojan of
the type that was used to flood ml.org.

Also, you will note that the putative "relay host" is running a highly
hacked version of sendmail (EHLO it).


					Terry Lambert
					terry@lambert.org
---
Any opinions in this posting are my own and not those of my present
or previous employers.