RE: [IMail Forum] Spam-- logs-- please help decipher

Wed, 05 Sep 2001 12:33:20 -0700 

Ok Len,

I think this has to be your best work yet :)

Bryan

-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Len Conrad
Sent: Wednesday, September 05, 2001 10:46 AM
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] Spam-- logs-- please help decipher



>We have been hit very hard lately.
>
>Last week we had 350,000 files in /spool.

ho! just warming up, are we??

>I have contacted an attorney in Virginia

no, just block his ip address. :))

>One day I counted over 17,000 spam emails:  FROM:<[EMAIL PROTECTED]> from
>one source.

the headers are totally unreliable indication of anything.  They are easily
spoofable, I�d be surprised that they�d stand up court.  Would you like it
to stand up in court if the evidence against a spammer was "From:
[EMAIL PROTECTED]" ??

The ip address of the sending mail server(s) is the best, if not perfect,
evidence.  and you�ll need the full list of delivery headers.

>Question is:

.... why are you wasting money on lawyers, when you can run IMGate for free?

>does each email address that I replaced:
>FROM:<[EMAIL PROTECTED]>  equal one SPAM email?

nothing from nothing is nothing

Look, some poor Imail user was under attack for weeks, yes weeks, from all
over the planet.  He intended to put IMGAte a while back but never got
round tuit.

So I put in IMGate and turned it on Wed morning, here�s the first 2.5
hours, note the REJECTS column vs the delivered column:

Per-Hour Traffic Summary
     time          received  delivered   deferred    bounced     rejected
     --------------------------------------------------------------------
     0900-1000           0          0          0          0          0
     1000-1100         144        119          1          8        215
     1100-1200        3156       1545         20        632       6355
     1200-1300        2978       1351         20        514       7762
     1300-1400        1978        972         11        283       4753
     1400-1500           0          0          0          0          0

He says it gets MUCH WORSE AT NIGHT!!

and here�s where (some of) that crap is coming from:

     blocked using or.orbl.org
          390   onda.com.br
          297   static213-229-22-149.adsl.inode.at
          264   164.77.252.118
          223   pacific.net.sg
          152   techpta.ac.za
           94   203.194.133.247
           84   211.224.130.98
           78   202.106.102.62
           60   202.122.64.129
           57   www.cg41.fr
           50   202.102.141.61
           48   212.212.11.130
           35   200.222.34.131
           15   211.229.46.245
           15   211.41.54.226
           14   202.85.137.35
           12   baro.antw.online.be
           11   211.167.149.1
           10   213.26.25.66
           10   203.255.122.253
           10   203.41.219.2
           10   195.114.205.165
            7   195.126.239.12
            7   machipoke.com
            7   211.192.22.50

     blocked using relays.ordb.org
         1421   mantiqueira.fis.puc-rio.br
          970   210.96.115.3
          377   202.43.69.118
          336   booster.co.kr
          319   202.43.71.123
          264   61.132.36.92
          258   212.217.13.34
          221   itmina.edu.mx
          187   hyopwoon.co.kr
          163   210.68.48.129
          144   212.56.97.33
          144   connect.com.au
          142   202.42.223.252
          135   202.30.222.196
          133   hallym.ac.kr
          133   210.72.225.107
          132   210.76.97.252
          132   195.7.209.6
          129   211.174.61.59
          122   210.232.199.34
          109   202.144.66.60
          105   211.44.252.1
          104   202.183.229.201
           99   cnu.ac.kr
           97   netvigator.com
           96   212.217.26.131
           96   s-integra.co.jp
           96   202.120.189.104
           95   cust.tie.cl
           91   211.188.56.40
           90   203.116.179.76
           89   210.181.230.145
           84   kalia.or.kr
           82   crescent.co.jp
           81   211.236.68.67
           76   210.162.254.146
           76   194.65.67.60
           75   210.225.85.130
           74   210.103.109.3
           72   211.55.181.216
           70   202.82.139.177
           69   meiwa.or.jp
           68   200.178.231.2
           67   210.219.215.4

     blocked using relays.osirusoft.com
           28   61.140.76.211
           16   210.77.157.171
           14   203.143.131.87
           14   ozemail.com.au
            7   coastlandtech.com
            4   216.127.234.130
            4   210.77.157.215
            4   61.129.52.29

But, if you still want to hire an attorney ...

Len, J.D. Harvard 1970  :)))


http://MenAndMice.com/DNS-training
http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K
http://IMGate.MEIway.com  : Build free, hi-perf, anti-abuse mail gateways


Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.

An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/


Please visit http://www.ipswitch.com/support/mailing-lists.html 
to be removed from this list.

An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/

Reply via email to