Re: [AMaViS-user] new trend

[Stephane L. <Ste...@an...>]

On Tue, Apr 13, 2004 at 02:14:10PM +0200, Cami wrote:
> Hi All..
> 
> Anyone else noticed this new trend of subdomains
> being created? This guy has created THOUSANDS
> of subdomains....
> 
> [postwall01][/etc/postfix]# host 3754.lighterthanmail.com
> 3754.lighterthanmail.com has address 69.6.57.4
> [postwall01][/etc/postfix]# host 7349.slipperywhendrunkmarketing.com
> 7349.slipperywhendrunkmarketing.com has address 69.6.57.4
> 
> All pointing to the same ip.. This ip is pumping huges
> amounts of spam into various networks..
> 
> Regards,
> Cami
> 
> 
>       2     3316   3754.lighterthanmail.com
>       2     3316   3971.reefermail.com
>       2     3316   7568.legitclickthrough.com
>       2     3316   6523.bigpipemailer.com

Yes I noticed that trend too. 
They're using wildcards in domain definitions  (* IN A IP) to bypass 
"exact domain name blocking". 
These DNS entries always point to IP non-reachable or without an
SMTP application on it hence growing our MTA queues ... 
You have to check your queues and remove bounces toward such domains. 
 

SL/
---
Stephane Lentz 
Alcanet International, Internet Services