On Thursday, June 16, 2005, 6:04:18 PM, Scott wrote: SF> SF> Am I the only one getting blasted by these spam from these SF> IP blocks? Sniffer seems a little behind on catching these. SF> SF> 200.49.48.0/24 200.49.48.0/24 SF> 200.49.49.0/24 200.49.49.0/24 mowz2.com SF> 200.49.50.0/24 200.49.50.0/24 qckcstmr.com SF> 200.49.51.0/24 200.49.51.0/24 srvdupfrsh.com SF> 200.49.52.0/24 200.49.52.0/24 aahtv.com SF> 200.49.53.0/24 200.49.53.0/24 aakai.com SF> 200.49.54.0/24 200.49.54.0/24 aakib.com SF> 200.49.55.0/24 200.49.55.0/24 aakli.com SF> 200.49.56.0/24 200.49.56.0/24 aafix.com SF> 200.49.57.0/24 200.49.57.0/24 aaaae.com SF> 200.49.58.0/24 200.49.58.0/24 SF> 200.49.59.0/24 200.49.59.0/24 SF> SF> Domain names and links seem to be five chars beginning with SF> aa. They also seem to be progressing through the IP blocks. SF> SF> i think they started in on the June 15th and have been spamming pretty consistantly.
We haven't been seeing these (specifically) but we have seen some of them and more like them. I'm going to add rules for this list (not the IPs because I need to research that). Have you submitted these? -- I would have expected to catch them if so, that is, unless some other rule trapped them on the way in. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
