On 9/27/07, Raymond L. Corbin <rcorbin@hostmysite.com> wrote:
Did you check the source IP in the headers? My logs show that they are coming from a buncha residential IP addresses so its prolly a bot network doing it. Most of the messages going through our servers with that have the domain lifeleaksfromyo.com in it which is causing the messages to fail in our servers. You can always try the rbl that lists a lot of residential IP's in it...i think it's the PBL from spamhaus. That would help limit it, and blocking emails with the domain lifeleaksfromyo.com.... Other then that I'm out of ideas. What spam appliance are you using?
Raymond, all: Thanks for all the responses, public and private. I did, and am, watching the sources. It's uninteresting in terms of capability to act since it's spread out pretty widely and it's obviously difficult to tell what will and will not cause collateral damage. I'll capture some source traffic and put it out on the web for all the researches that replied looking for sample data. I think I can probably pcap something that won't violate any privacy laws where this is. In the meantime, here's some sources that are in the top tier of connections: 3215 | 86.195.231.168 | AS3215 France Telecom - Orange 3269 | 87.19.141.208 | ASN-IBSNAZ TELECOM ITALIA 3320 | 84.148.13.150 | DTAG Deutsche Telekom AG 3320 | 84.148.13.150 | DTAG Deutsche Telekom AG 3320 | 84.148.13.150 | DTAG Deutsche Telekom AG 3320 | 84.148.13.150 | DTAG Deutsche Telekom AG 6746 | 89.136.159.120 | ASTRAL ASTRAL Telecom SA, Romania 7132 | 67.120.22.10 | SBIS-AS - AT&T Internet Services 9121 | 78.180.16.161 | TTNET TTnet Autonomous System 9121 | 85.108.127.90 | TTNET TTnet Autonomous System 9121 | 85.108.127.90 | TTNET TTnet Autonomous System 9121 | 85.108.127.90 | TTNET TTnet Autonomous System 10796 | 71.79.216.254 | SCRR-10796 - Road Runner HoldCo LLC 10796 | 71.79.216.254 | SCRR-10796 - Road Runner HoldCo LLC 19262 | 71.254.34.123 | VZGNI-TRANSIT - Verizon Internet Services Inc. 22773 | 64.58.163.237 | CCINET-2 - Cox Communications Inc. 25041 | 91.125.42.251 | BRIGHTVIEW-UK-AS Brightview Internet Services AS 35911 | 24.212.10.244 | BNQ-1 - Telebec 35911 | 24.212.10.244 | BNQ-1 - Telebec