Hi -

I'm looking for some advice on combatting a spammer. My mail server
(and no doubt others') has been used this weekend to sent countless
thousand spam messages. I only found this as I get the reports of
failed outbound messages.

Ideally I'd love toshut this guy down - any advice on how?

I would have liked to close my own server, but I need it for genuine
business activity. I'm exploring a solution further with my ISP.

For reference, the text below is going out. Seems to be from some
sort of self-professed Internet marketer (dirkscrazyweek.com).
Evidently he doesn't have the conviction to actually list direct
contact information, or use his own server to send his trash. Anyone
else have the same problem?

He also seems to be hiding behind whoisguard. I have seen suggestions
that this company is engaged in criminal activity - any truth to this?

Thanks,

~ Mad

Oferta que vale la pena mirar.

Sites found as of 5/11/2008 4:26:36 PM CST
csv format with header

----
Domain, IP, DNS, Registrar
achiequiet.com,[botnet],WKAKEKOD.COM,XIN NET TECHNOLOGY CORPORATION
delightedevery-person.com,[botnet],WKAKEKOD.COM,XIN NET TECHNOLOGY CORPORATION
every-persondelighted...

Drop me a line, please?

Join HideDragon affiliate program, earn 50%% commission from now!

This is a company of software. We are sincerely hoping to make
agreement with

you in selling of this product, as our experience, the other sales
agents of our

product can make $10000 as commission each month.

Now we have a new product named HideDragon, which is software of
quick hide

window like boss key. It is a kind of software setting in CP screen
privacy

protection.

As click on mouse middle button, users can hide the desktop windows
quickly and re-

display the window by clicking the middle button again that is why
HideDragon is in

featuring complement with your products of your company. HideDragon is
very popular in

white-collars. If we cooperate with each other by packaging HideDragon
with your

I have heaps of log entries that look like below. Each IP address tries
only 1 to 4 times. It looks like a new bot army is trying to crack
servers without triggering detection. It's not the usual attack where
one server tries hundreds of times on a small set of addresses.

If you have any intrusion detection systems expecting a single IP
address, they won't work anymore.

secure.log.4:May 7 02:34:36 pixelmemory sshd[30928]: error: PAM:
Authentication failure for root from 200.114.248.28
secure.log.4:May 7 02:36:02 pixelmemory sshd[30934]: error: PAM:
Authentication...

It is another *presentation format* with added per country and ASN summaries
of data published at http://www.spamcop.net/w3m?action=hoshame
* ASN info: asn.routeviews.org http://www.routeviews.org/
* Country info: zz.countries.nerd.dk http://countries.nerd.dk/

Top 200 targets of spamcop.net spam reports
For *the week* ending Sun May 11 07:05:34 2008 UTC
----------------------------------------------------
Total spamcop.net spam reports volume: 88917832
Top200 share of all spamcop.net spam reports: 4.03%% (3586574/88917832)
The worst country: TW 47.0%% [TAIWAN]
The worst ASN: AS3462 34.5%% (TW)
The worst routing prefix: 118.169.0.0/16 33.5%% (TW AS3462)
The worst IP: 202.75.56.216 (MY AS17971 202.75.56.0/22)

*Top12 IP Adresses (The Dirtiest Dozen)*
#;IP;Country;ASN;prefix;spamcop.net spam reports;age;duration;reverse DNS
1 202.75.56.216 MY AS17971 202.75.56.0/22 127911 23.0 h 88.7 d
2 202.75.56.212...

Business for Sale at Franchise Works
Start your own business. FranchiseWorks.com provides you with free
information and an extensive directory on some of the great franchises
and business opportunities.
http://www.ogogosina.cn/Business.htm