Has inpaths format changed?

[John F. Morse]

Since I haven't heard anything from anybody, I'll send this again.

Recently I have noticed a change in the format of the daily inpaths e-mail 
messages from all of my servers.

Prior to July 17, the first half of the messages used a FQDN for the news
server as shown in these few example lines from July 16:


4351 newsgate.cistron.nl
7694 feeder3.cambriumusenet.nl
21470 lightspeed.eweka.nl
2140 feed118.news.tele.dk
2 nntp.totallyobjects.com
79 textnews.euro.net
30 news.nnrp.de
304 jeffrey.matabio.net
21 ntnu.no



Starting with the July 17th inpaths e-mail reports, the news servers now have
what appears to be an encrypted name, like the following sample:


1 4no10958447pbo.1
1 u3no2499556qai.0
1 r1no7166850qas.0
1 r1no1993256qas.0
1 u3no4601951qai.0
1 p10ni85011709pbh.1
1 p10ni4855325pbh.1
1 b9ni62456434pbl.0
1 a15ni29416995qag.0


I have changed nothing on any of my INN servers.

Additionally, I find that the inpaths e-mail messages were running around
85k to 90k in size each day, for each server.

Since the trouble started on July 17, the message size is growing each day. 
Today they are over 700k.

Anyone else experiencing this?

These odd hostnames are now appearing at the Top1000 site as well.

http://top1000.anthologeek.net/top1000.current.txt

Could they be a munged FQDN to evade EMP (phn path) spam traps?


-- 
John

_______________________________________________
inn-workers mailing list
inn-workers at lists.isc.org
https://lists.isc.org/mailman/listinfo/inn-workers