Darrell, I wondered if that might be the case. Thanks for the info!
> -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell > ([EMAIL PROTECTED]) > Sent: Thursday, October 12, 2006 4:44 PM > To: declude.junkmail@declude.com > Subject: Re: [Declude.JunkMail] Interesting SMTP connection patterns > > Dave, > > That is really not that uncommon. I see this with very aggressive spammers > who are trying to get the most spam through in the least amount of time and > have no disregard for crashing the server they are sending spam to... > > Darrell > ------------------------------------------- > Check out http://www.invariantsystems.com for utilities for Declude, Imail, > mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI > integration, MRTG Integration, and Log Parsers. > > > Dave Beckstrom writes: > > > Yesterday I took a snapshot of the SMTP connections active on our server. I > > then did a reverse IP to find out where they were from. > > > > Below are the results. You can see someone from Thailand had 5 SMTP > > connections active and Spain had 4. You can also see that only 3 of the IPS > > connected were for potentially legitimate email. We don't get any > > legitimate email from other Countries so everything not from the USA would > > be spam. > > > > Any idea why a spammer would open more than one SMTP connection? > > > > > > 202.139.211.241 5 Thailand > > 88.0.230.26 4 Spain > > 71.55.71.138 2 USA > > 87.219.166.9 2 Spain > > 213.85.39.108 1 Russian Federation > > 84.77.107.183 1 Spain > > 83.131.106.234 1 Croatia > > 84.61.135.61 1 Germany > > 83.84.74.219 1 Netherlands > > 90.9.36.180 1 France > > 83.167.108.79 1 Russian Federation > > 67.172.162.33 1 USA > > 84.54.248.96 1 Russian Federation > > 86.75.242.215 1 France > > 201.208.171.250 1 Venezuela > > 88.204.240.177 1 Kazakstan > > 82.158.0.237 1 Spain > > 69.30.246.125 1 USA > > 200.168.86.224 1 Brazil > > 83.167.108.44 1 Russian Federation > > 75.41.79.203 1 USA > > 200.206.252.123 1 Brazil > > 84.60.109.148 1 Germany > > > > > > > > > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
