[Mimedefang] Anyone noticing...

[Damrose, Mark]

> -----Original Message-----
> From: Ashley M. Kirchner
> 
>     ...spam e-mails coming from an e-mail <ret at ...> where the 
> domain name is generally has the word 'deluxe', 'luxury', or 
> some form thereof in it?  Over the past few days I've gotten 
> hundreds upon hundreds of hits from:
> 
>     ret at luxurylinedeals.com             ret at netdeluxeview.com
>     ret at greatrealluxury.com             ret at lightluxurybay.com
>     ret at microluxecity.com               ret at edgeluxeview.com
>     ret at deskdeluxering.com              ret at audioluxelink.com
>     ret at gooddeluxedealsgroup.com        ret at Bluedeluxesystems.com
>     ret at deluxescope.com                 ret at netluxemedia.com
>     ret at driveluxejet.com                ret at deluxedealsonline.com
>     ret at wadedeluxe.com

I don't know if it's the same place, but I've got a bunch of these
going back to Dec 20 (as far back as my logs go).

ret at amoroot.info
ret at bigggtimez007.info
ret at bigggtimez016.info
ret at bigtownrewards.net
ret at boardabj.com
ret at cinquegreatpromotions5.com
ret at cinquegreatpromotions8.com
ret at coolorangedeals.com
ret at farwestpublishing.net
ret at greatpromotionalservices4.com
ret at idealdealsonline.com
ret at incentives365.net
ret at luckiebargainz016.info
ret at purscrib.info
ret at quattrogreatpromotions13.com
ret at reachahead6.com
ret at seethis011.info
ret at seethis013.info
ret at settegreatpromotions15.com
ret at settegreatpromotions6.com
ret at skyhighdeals.net
ret at southbeachoffers.net
ret at supersalesforce.net
ret at tregreatpromotions3.com
ret at tregreatpromotions6.com
ret at unogreatpromotions26.com
ret at vealica.info
ret at wieldreda.info
ret at xpectdealz00.com

I'm guessing the ret@ e-mail is a particular spam bot signature.

All of mine have been coming from the same netblock (morphed a 
couple of times).  It's currently 216.22.47.0/24.

All of these have hit e-mail addresses that return
to:elgin.cc.il.us    ERROR:5.1.2:"550 elgin.cc.il.us no longer accepting
mail.  Use elgin.edu."