Subject: [Asrg] What this?

From: Reinhold Jordan <[email-masked]>
Date: Thu, 24 Apr 2003 10:56:05 +0200

Hi all,

can anybody tell me, why spammers try to send a mail with a lot
of wrong IPs? I found this in my logfile (receiver-address changed):
 
reject by critical domain from [email-masked] at 148.244.66.88 to [email-masked]
reject by critical domain from [email-masked] at 148.244.79.22 to [email-masked]
reject by critical domain from [email-masked] at 165.228.2.70 to [email-masked]
reject by critical domain from [email-masked] at 165.228.2.70 to [email-masked]
reject by critical domain from [email-masked] at 200.158.126.71 to [email-masked]
reject by critical domain from [email-masked] at 200.193.153.22 to [email-masked]
reject by critical domain from [email-masked] at 200.44.123.202 to [email-masked]
reject by critical domain from [email-masked] at 200.44.123.202 to [email-masked]
reject by critical domain from [email-masked] at 200.44.157.34 to [email-masked]
reject by critical domain from [email-masked] at 203.170.167.156 to [email-masked]
reject by critical domain from [email-masked] at 203.170.167.156 to [email-masked]
reject by critical domain from [email-masked] at 203.170.167.156 to [email-masked]
reject by critical domain from [email-masked] at 203.170.167.156 to [email-masked]
reject by critical domain from [email-masked] at 203.58.188.186 to [email-masked]
reject by critical domain from [email-masked] at 207.237.185.232 to [email-masked]
reject by critical domain from [email-masked] at 207.237.185.232 to [email-masked]
reject by critical domain from [email-masked] at 210.82.117.77 to [email-masked]
reject by critical domain from [email-masked] at 210.90.75.129 to [email-masked]
reject by critical domain from [email-masked] at 212.171.107.232 to [email-masked]
reject by critical domain from [email-masked] at 212.171.107.232 to [email-masked]
reject by critical domain from [email-masked] at 212.171.107.232 to [email-masked]
reject by critical domain from [email-masked] at 212.210.198.85 to [email-masked]
reject by critical domain from [email-masked] at 212.70.45.130 to [email-masked]
reject by critical domain from [email-masked] at 213.26.178.226 to [email-masked]
reject by critical domain from [email-masked] at 213.9.244.4 to [email-masked]
reject by critical domain from [email-masked] at 217.126.204.170 to [email-masked]
reject by critical domain from [email-masked] at 217.37.97.145 to [email-masked]
reject by critical domain from [email-masked] at 217.96.185.91 to [email-masked]
reject by critical domain from [email-masked] at 217.96.185.91 to [email-masked]
reject by critical domain from [email-masked] at 217.96.185.91 to [email-masked]
reject by critical domain from [email-masked] at 217.96.185.91 to [email-masked]
reject by critical domain from [email-masked] at 217.99.123.40 to [email-masked]
reject by critical domain from [email-masked] at 24.210.57.243 to [email-masked]
reject by critical domain from [email-masked] at 4.34.224.230 to [email-masked]
reject by critical domain from [email-masked] at 4.34.224.230 to [email-masked]
reject by critical domain from [email-masked] at 4.65.220.43 to [email-masked]
reject by critical domain from [email-masked] at 4.65.220.43 to [email-masked]
reject by critical domain from [email-masked] at 61.84.242.111 to [email-masked]
reject by critical domain from [email-masked] at 62.139.107.122 to [email-masked]
reject by critical domain from [email-masked] at 65.71.90.137 to [email-masked]
reject by critical domain from [email-masked] at 66.183.107.148 to [email-masked]
reject by critical domain from [email-masked] at 80.80.98.231 to [email-masked]
reject by critical domain from [email-masked] at 80.80.98.231 to [email-masked]

Regards, Reinhold

-- 
                       Reinhold Jordan
WWW: http://reinhold.bachrain.de    Mail: [email-masked]
"Do you pine for the nice days of minix-1.1, when men were men
and wrote their own device drivers?"                     Linus
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Sat, 26 Apr 2003 21:53:18 -0400

On Thu, Apr 24, 2003 at 10:56:05AM +0200, Reinhold Jordan wrote
> reject by critical domain from [email-masked] at [various IP addresses] to [email-masked]

  You're not the only one.  Here's a series of attempts from all over
the place...

Mar 30 00:34:27 manson filt-smtpd[31485]: DENYMAIL: ([email-masked]) -> ([email-masked]) [80.181.194.122]: 550 BLOCKED: See http://www.monkeys.com/upl/listed-ip-0.cgi?ip=80.181.194.122
Mar 31 00:39:49 manson filt-smtpd[15822]: DENYMAIL: ([email-masked]) -> ([email-masked]) [202.155.16.242]: 550 202.155.16/24 is in id, rejected based on geographical location
Mar 31 02:36:05 manson filt-smtpd[21611]: DENYMAIL: ([email-masked]) -> ([email-masked]) [203.191.33.32]: 550 BLOCKED: See http://www.monkeys.com/upl/listed-ip-0.cgi?ip=203.191.33.32
Mar 31 02:36:05 manson filt-smtpd[21610]: DENYMAIL: ([email-masked]) -> ([email-masked]) [203.191.33.32]: 550 BLOCKED: See http://www.monkeys.com/upl/listed-ip-0.cgi?ip=203.191.33.32
Mar 31 02:57:06 manson filt-smtpd[22646]: DENYMAIL: ([email-masked]) -> ([email-masked]) [218.98.164.36]: 550 218.98/16 is in cn, rejected based on geographical location
Mar 31 02:57:12 manson filt-smtpd[22678]: DENYMAIL: ([email-masked]) -> ([email-masked]) [203.191.33.32]: 550 BLOCKED: See http://www.monkeys.com/upl/listed-ip-0.cgi?ip=203.191.33.32
Mar 31 02:57:12 manson filt-smtpd[22671]: DENYMAIL: ([email-masked]) -> ([email-masked]) [213.107.96.117]: 550 BLOCKED: See http://www.monkeys.com/upl/listed-ip-0.cgi?ip=213.107.96.117
Mar 31 02:58:15 manson filt-smtpd[22704]: DENYMAIL: ([email-masked]) -> ([email-masked]) [193.251.188.17]: 550 193.251/16 is in fr, rejected based on geographical location
Mar 31 02:58:15 manson filt-smtpd[22705]: DENYMAIL: ([email-masked]) -> ([email-masked]) [193.251.188.17]: 550 193.251/16 is in fr, rejected based on geographical location
Mar 31 03:17:07 manson filt-smtpd[23686]: DENYMAIL: ([email-masked]) -> ([email-masked]) [218.184.98.210]: 550 218.184/16 is in tw, rejected based on geographical location
Mar 31 03:36:11 manson filt-smtpd[24702]: DENYMAIL: ([email-masked]) -> ([email-masked]) [202.155.16.242]: 550 202.155.16/24 is in id, rejected based on geographical location
Mar 31 03:36:44 manson filt-smtpd[24713]: DENYMAIL: ([email-masked]) -> ([email-masked]) [202.155.16.242]: 550 202.155.16/24 is in id, rejected based on geographical location
Mar 31 03:36:49 manson filt-smtpd[24701]: DENYMAIL: ([email-masked]) -> ([email-masked]) [193.251.188.17]: 550 193.251/16 is in fr, rejected based on geographical location
Mar 31 03:36:58 manson filt-smtpd[24706]: DENYMAIL: ([email-masked]) -> ([email-masked]) [193.251.188.17]: 550 193.251/16 is in fr, rejected based on geographical location

  Here's my theory.  Well-organized spam-gangs have compromised many
thousands of personal computers all over the world.  They run a central
system somewhere that attempts to spam from one compromised machine, and
if one transmission attempt fails, they try from the next compromised
machine, etc, until they manage to deliver (or run out of compromised
machines).  It's a testament to the effectiveness of various DNSbls that
things have gotten to the point where spammers need to put forth this
much effort to get past some people's filters.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg