From: Jason Robertson (jasonifuture.com)
Date: Tue Jul 22 2003 - 11:52:04 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I have found that recently a spammer has been using a mod_proxy
configuration, (that was meant to allow for an easier transition to a
new naming scheme, as well as changes to a backend software) as a spam
relay.
The spammer has been using HTTP POST requests to send these messages
with POST HTTP://mailserver:25/ HTTP/1.1
With some research it looks like this is an automated process including
the initial scan stage.

When I contacted Apache in regards to this, the response was not very
promising.

This problem would be a simple fix with implementing the AllowConnect
configuration option within proxy_http, to prevent outbound
connections.

Jason

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]