Comments on: Is One Of These IP Addresses Yours?

By: Anybody Wanna Join Me In A “Day Without Email” (SMTP)? » Alpha Gecko

Wed, 17 Dec 2008 20:18:14 +0000

[...] been getting lots of spam bounce traffic since back in June, and have implemented countermeasures that have drastically reduced the impact [...]

By: Seamus

Seamus — Sat, 04 Oct 2008 05:14:29 +0000

66.228.115.231 is the IP Address of numerous sites owned by Brian Krassenstein, a well known spammer and scammer. He was the one responsible for the Idetrorce spam bot that hit bloggers by storm with spam comments and he has a long history of spamming for hyip’s (ponzi schemes).

He currently operates Talkgold.com forums and a pyramid scheme named TeamEarners.com amongst other schemes. If you receive any more spam from his network, contact abuse [at] softlayer and let them know or contact the FBI’s cybercrimes division who are already investigating his activities.

By: robson

robson — Wed, 23 Jul 2008 14:24:08 +0000

5) someone send a email with forged envelope adress (SMTP command MAIL FROM:) nonexistent@your.domain to nonexistent@other.dmain and other.domain sent a bounce message to nonexistent@your.domain saying “message cannot be delivered”. If other.domain uses SPF and your.domain has SPF record set to accept envelope address @your.domain only from some IP range, then those mail is rejected by other.domain and no bounce message is generated.

By: Antone Roundy

Antone Roundy — Mon, 21 Jul 2008 15:37:48 +0000

I never actually saw any of the emails — my server is configured to reject them before the data is sent if the address to which they’re being sent doesn’t exist. I just had it track the IP addresses of the computers that were trying to send such messages.

I have SPF turned off at the moment (…don’t remember for sure why I did that).

Would you care to elaborate on your last sentence? If an email to a non-existent address came to me from a particular IP address, I can imagine 4 possibilities:

1) Somebody accidentally entered the wrong address.

2) They were sending spam.

3) The computer has been cracked or infected and someone else is using it to send spam.

4) It’s an open relay and is being abused to send spam. (Oh yeah, didn’t mention that possibility above).

I don’t see how SPF would make a difference.

By: robson

robson — Mon, 21 Jul 2008 15:24:47 +0000

Please forward spam received from 89.171.112.121 (if you still have a copy). Do you use SPF? If not, then some of these guys are probably neither spammers or hacked.

By: shamess

shamess — Sat, 21 Jun 2008 22:06:50 +0000

Mine isn’t there! Got close a few times though… Fortunately, email addresses associated with my server aren’t really public (or even used)… so I doubt I’ll ever have bandwidth problems from spam.

Well… hopefully!