Dave,
That is really not that uncommon. I see this with very aggressive spammers
who are trying to get the most spam through in the least amount of time and
have no disregard for crashing the server they are sending spam to...
Darrell
-------------------------------------------
Check out http://www.invariantsystems.com for utilities for Declude, Imail,
mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI
integration, MRTG Integration, and Log Parsers.
Dave Beckstrom writes:
Yesterday I took a snapshot of the SMTP connections active on our server. I
then did a reverse IP to find out where they were from.
Below are the results. You can see someone from Thailand had 5 SMTP
connections active and Spain had 4. You can also see that only 3 of the IPS
connected were for potentially legitimate email. We don't get any
legitimate email from other Countries so everything not from the USA would
be spam.
Any idea why a spammer would open more than one SMTP connection?
202.139.211.241 5 Thailand
88.0.230.26 4 Spain
71.55.71.138 2 USA
87.219.166.9 2 Spain
213.85.39.108 1 Russian Federation
84.77.107.183 1 Spain
83.131.106.234 1 Croatia
84.61.135.61 1 Germany
83.84.74.219 1 Netherlands
90.9.36.180 1 France
83.167.108.79 1 Russian Federation
67.172.162.33 1 USA
84.54.248.96 1 Russian Federation
86.75.242.215 1 France
201.208.171.250 1 Venezuela
88.204.240.177 1 Kazakstan
82.158.0.237 1 Spain
69.30.246.125 1 USA
200.168.86.224 1 Brazil
83.167.108.44 1 Russian Federation
75.41.79.203 1 USA
200.206.252.123 1 Brazil
84.60.109.148 1 Germany
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
