It sure looks like 85.182.50.86 is at least attempting to push a bunch of
traffic through your server. Are you logging all services to the syslog
server? Maybe it is showing up in more than one place, like the SMTP and
spam logs. If not, you may only be getting two lines because they are trying
and failing, but I would expect IMail to log the final resolution. So the
next question is whether these messages are building up in your spool.
85.182.50.8 is listed in CBL and Dynablock. It is not listed in
senderbase.org, although other addresses in the /24 block are.
You are not listed anywhere I found, so these may not be getting out from
your server, particularly if this activity has been going on for some time.
Here is the data on that IP from RIPE.
-Dave Doherty
Skywaves, Inc.
--------------------------------------------------------
% Information related to '85.176.0.0 - 85.182.127.255'
inetnum: 85.176.0.0 - 85.182.127.255
netname: HANSENET-ADSL
descr: ALICE DSL
descr: HanseNet Telekommunikation GmbH
descr: ADSL Pool Customers
country: DE
admin-c: HNT-RIPE
tech-c: HNST-RIPE
status: ASSIGNED PA
remarks: -------------------------------------------------------------
remarks: PLEASE CONTACT [EMAIL PROTECTED] IN CASE OF HACK ATTACKS,
remarks: ILLEGAL ACTIVITY, VIOLATION, SCANS, PROBES, SPAM, ETC.
remarks: -------------------------------------------------------------
mnt-by: HANSENET-NOC
source: RIPE # Filtered
role: HanseNet IP Coordination
address: HanseNet Telekommunikation GmbH
address: Ueberseering 33 A
address: D-22297 Hamburg
address: Germany
phone: +49 40 23726 0
fax-no: +49 40 23726 193996
e-mail: [EMAIL PROTECTED]
admin-c: DM3738-RIPE
tech-c: TINO1-RIPE
nic-hdl: HNT-RIPE
mnt-by: HANSENET-MNT
source: RIPE # Filtered
role: HanseNet Security Team
address: HanseNet Telekommunikation GmbH
address: Ueberseering 33 A
address: D-22297 Hamburg
address: Germany
phone: +49 40 23726 0
fax-no: +49 40 23726 193996
e-mail: [EMAIL PROTECTED]
admin-c: DM3738-RIPE
tech-c: TINO1-RIPE
nic-hdl: HNST-RIPE
mnt-by: HANSENET-MNT
source: RIPE # Filtered
% Information related to '85.176.0.0/13AS13184'
route: 85.176.0.0/13
descr: HANSENET
origin: AS13184
mnt-by: HANSENET-MNT
source: RIPE # Filtered
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
