Michael C. Toren on 19 Jan 2004 20:34:02 -0000


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: GRRR! Re: [PLUG] Hi


On Mon, Jan 19, 2004 at 09:06:21AM -0500, Ian Reinhart Geiser wrote:
> Someone has been doing this for months now, and I get tons of bounced
> messages.  Is there anyway to protect from this other than shutting down
> the address?  I have found out this email address has made a few
> blacklists.  They are mostly forged from .mx and .biz domains.

At least two messages were sent, one to the list, and one to plug-admin.
In both cases, according to the Received: header appended by my server,
the IP address in question was 216.254.118.44, a speakeasy.net customer:

	Received: from unknown (HELO baldrick) (216.254.118.44)
	  by mail.netisland.net with SMTP; 19 Jan 2004 13:02:53 -0000

My understanding is that speakeasy.net hands out mostly static IPs, which
should make it fairly trivial for them to track it down if you contact
their abuse department.

-mct
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug