Hi all,
I've gone through several hundred emails and found a pattern.
the vast majority of these emails are coming from random domain names in the following TLDs:
.bid .stream .trade
I've found 328 such emails, 298 of which come from unique IP addresses. I'm going to add those to my firewall rules on a temporary basis, ready for the overnight influx of spam.
Note that if one has clients dependent on filtering, this IS NOT the right way to deal with spam - it's too easy to block the wrong IPs - but it's ok in an emergency on a temporary basis.
Temporarily, interested parties can grab the sorted and unique list of these IP addresses as follows, to do with as they wish (with full disclaimer and no guarantees):
wget vm3.convergent-ict.com/misc/temp-spam-IPs.lis
Cheers, Laurie.-- --------------------------------------------------------------------- Laurie Brown laurie@brownowl.com ---------------------------------------------------------------------