Post scriptum : 1. More precisely, the average inlog file size has tripled on october 6th, 2003 2. This might be the period I started having smtprcv stopping once or twice a day Benoit
----- Original Message ----- From: "Benoit Sarton" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Wednesday, October 29, 2003 7:35 PM Subject: inlog files filled with err 550 | I'm getting more than 10000 spams sent at fake adresses every day | ( looks like they are pseudo-randomly generated ) | One inlog file is more than 4 Mo per day, when it was 200/300k a month ago. | I had to hack a small program to tell the hit-parade of the source ip or | class C ( since visual analysis is not possible any more), but there is a | large dispersion of theses sources. | For example, for today at 7pm I get this : | logs : 8337 | Err 550 from 195.188.213.0/32 : 200 | Err 550 from 194.25.134.0/32 : 196 | Err 550 from 195.228.242.0/32: 179 | etc | | I'm wondering if this is a kind of virus, or 'brute force spam' trying to | reach a real adress once every 1000 tries, or both ? | | Strangely all fake adresses have similar patterns, such as name_<two random | letters>@domain | For example : | [EMAIL PROTECTED] | [EMAIL PROTECTED] | etc | do you suffer the same problem, with a recent acceleration these last 20 | days ? | | Benoit | | This is the discussion list for the IMS Free email server software. | To unsubscribe send mailto:[EMAIL PROTECTED] | | Delivered by Rockliffe MailSite | http://www.rockliffe.com/mailsite | Rock Solid Software (tm) | This is the discussion list for the IMS Free email server software. To unsubscribe send mailto:[EMAIL PROTECTED] Delivered by Rockliffe MailSite http://www.rockliffe.com/mailsite Rock Solid Software (tm)
