Autor: Steve Drees
Data:
A: Marc MERLIN, exim-users
Assumpte: RE: [Exim] Spammer or new virus?
> mainlog:2002-05-27 10:00:43 H=(Witpnr) [212.195.121.225]:1153
> F=<someemail@???> rejected RCPT <lifi@???>:
> authentication required
Looks like KLEZ.
The random Hostname is a dead giveaway. As well as the forged from.