You are not alone, and you may be seeing the result of "Directory Harvest
Attacks". We
use Postini service as a totally external gateway to help to control spam.
Currently,
about 90% of all incoming e-mail is classified as either Spam or a virus. Some
days, I
have seen it a little over 92%. 6-months ago, it was only at a little under
50%.
Also, I have Postini set to not allow any mail through that is not
being sent to a
valid address for which we are receiving mail (15 domains for us). That cuts
out most of
these random generators and the associated "postmaster" and 550 messages. In
my case,
about a year ago, before things got this bad, it eliminated about 2000
postmaster messages
per day from my inbox.
Although we took a different approach to control it, I thought that you
would like
to know that you are not alone in seeing this much junk.
Postini has some nice statistics and stats and even origin maps with some
of the top
source IP's listed. See www.postini.com in general and
http://www.postini.com/stats/ for
some nice details.
Rich
Hocking Internet Technologies, Ltd.
-----Original Message-----
From: Kerry Barlow <[EMAIL PROTECTED]>
To: [email protected] <[email protected]>
Date: Wednesday, October 29, 2003 1:49 PM
Subject: Re: inlog files filled with err 550
>I also have seen my spam increase drasticly the past months. TF is helping,
>but causing other problems with much needed mail being trashed as well. Of
>course this needed mail by my customers is always some BS automated mailing
>service or something non-standard.
>Is there a link I can send my customers to, so that they can read up on this
>bad industry problem?
>Right now they are just hearing it from my own words. I would like some as
>it were verification that there truly is a problem going on for all ISP's
>-Kerry
>
>
>At 07:46 PM 10/29/03 +0100, you wrote:
>>Post scriptum :
>>1. More precisely, the average inlog file size has tripled on october 6th,
>>2003
>>2. This might be the period I started having smtprcv stopping once or twice
>>a day
>>Benoit
>>
>>
>>----- Original Message -----
>>From: "Benoit Sarton" <[EMAIL PROTECTED]>
>>To: <[email protected]>
>>Sent: Wednesday, October 29, 2003 7:35 PM
>>Subject: inlog files filled with err 550
>>
>>
>>| I'm getting more than 10000 spams sent at fake adresses every day
>>| ( looks like they are pseudo-randomly generated )
>>| One inlog file is more than 4 Mo per day, when it was 200/300k a month
>>ago.
>>| I had to hack a small program to tell the hit-parade of the source ip or
>>| class C ( since visual analysis is not possible any more), but there is a
>>| large dispersion of theses sources.
>>| For example, for today at 7pm I get this :
>>| logs : 8337
>>| Err 550 from 195.188.213.0/32 : 200
>>| Err 550 from 194.25.134.0/32 : 196
>>| Err 550 from 195.228.242.0/32: 179
>>| etc
>>|
>>| I'm wondering if this is a kind of virus, or 'brute force spam' trying to
>>| reach a real adress once every 1000 tries, or both ?
>>|
>>| Strangely all fake adresses have similar patterns, such as name_<two
>>random
>>| letters>@domain
>>| For example :
>>| [EMAIL PROTECTED]
>>| [EMAIL PROTECTED]
>>| etc
>>| do you suffer the same problem, with a recent acceleration these last 20
>>| days ?
>>|
>>| Benoit
>>|
>>| This is the discussion list for the IMS Free email server software.
>>| To unsubscribe send mailto:[EMAIL PROTECTED]
>>|
>>| Delivered by Rockliffe MailSite
>>| http://www.rockliffe.com/mailsite
>>| Rock Solid Software (tm)
>>|
>>
>>This is the discussion list for the IMS Free email server software.
>> To unsubscribe send mailto:[EMAIL PROTECTED]
>>
>> Delivered by Rockliffe MailSite
>> http://www.rockliffe.com/mailsite
>> Rock Solid Software (tm)
>>
>>
>Very respectfully, your obedient servant.
>Brig. Gen. Johnston Pettigrew
>
>[EMAIL PROTECTED]
>WWW server hosting Http://mntnweb.com
>Kerry Barlow
>p.o. box 21
>kirkwood ny
>13795
>607-775-1575
>
>
>
>This is the discussion list for the IMS Free email server software.
> To unsubscribe send mailto:[EMAIL PROTECTED]
>
> Delivered by Rockliffe MailSite
> http://www.rockliffe.com/mailsite
> Rock Solid Software (tm)
>
This is the discussion list for the IMS Free email server software.
To unsubscribe send mailto:[EMAIL PROTECTED]
Delivered by Rockliffe MailSite
http://www.rockliffe.com/mailsite
Rock Solid Software (tm)
