I’ve noticed a pattern in the last year or so with attack emails containing various zip files claiming any number of good reasons to open them and they all have been originating as attacks from domains starting with the letter “R”. I’ve included a list below of the suspect domains which I am currently blocking on my server. If any of these domains are valid, have your webmaster check for compromised email accounts. In the case of spoofing there’s not much that can be done, but it is a curious pattern. If you’ve seen a similar pattern, please contact me.
*@radar3000.com
*@radec.com
*@radiancy.com
*@radmusic.com
*@rahbek.com
*@ramblinexpress.com
*@ranchero.srl.ford.com
*@ranchosanandres.com
*@randyeastwood.com
*@raskrutka.com
*@raysrock.com
*@rbinc.com
*@rcacwv.com
*@rcfoster.com
*@rconestop.com
*@rcsworks.com
*@rcwm.com
*@rebekaharamini.com
*@redeye.com
*@reflomax.com
*@regerar.com
*@regionalreporting.com
*@reigjofre.com
*@relaiscavalcanti.com
*@remed.com
*@remericahometown3.com
*@remotereality.com
*@remus-online.com
*@renault-pdj.com
*@renre.com
*@rentsys.com
*@reque-gallego.com
*@resaleweekly.com
*@resgen.com
*@rettigicc.com
*@review.com
*@rgbinternet.com
*@rh.com
*@rhccmeetings.com
*@ribbitt.com
*@richardselectric.com
*@rickard.uk.com
*@riddleinternational.com
*@rightflorida.com
*@rikandvik.com
*@riverstates.com
*@rjtrucks.com
*@robertinventor.com
*@robil.com
*@robohand.com
*@rofllp.com
*@roguedisposal.com
*@ronaspharma.com
*@ronghai.com
*@rossoscarlatto.com
*@rossward.com
*@rotasign.com
*@rotem.com
*@rotortug.com
*@rotulosrodriguez.com
*@roudeau.com
*@rouit.com
*@rowbarinc.com
*@roxancoffman.com
*@roxschool.com
*@royaltyfoods.com
*@roycelyndsay.com
