[Dshield] Spammer

Darren Gasser kaos at earthlink.net
Wed Oct 29 18:21:25 GMT 2003


KennethSoong at tagtechnology.com.sg wrote:
> Hi!!
>      I seem notice a particular spammer from IP range of 61.11.0.0/16
> using
> our MS Exchanger 2000 Server to relay their emails.

By all means, shut off relaying immediately if you haven't already.

Do you have more specific netblocks?  A /16 is almost certainly not entirely
owned by one entity.  You can check some of the specific IPs with the major
spam blocklists like the SBL (http://www.spamhaus.org/sbl/) or SPEWS
(http://www.spews.org) to see if they've tracked those sources back to one
particular spammer or spamgang.

-Darren




More information about the list mailing list