RE: Botnet 0.8 Plugin is available (FINALLY!!!)

On Friday, September 28, 2007 4:06 PM hanz wrote:

>
> looking at the debug code, I notice that botnet,pm version 0.8 is only
> checking the last server IP and not all IPs in the path.
>

A botnet sends mail directly from the infected source, rather than relay it via the ISP's mail server. Any previous received headers would be forged so there's no point in checking them.

Jason Received on Fri Sep 28 16:19:02 2007