Today’s report is about Linode, but of course this could be about many different providers, and is a reason why the ability to block emails based on the PTR records is important, and it is best when it can be done in the SMTP layer BEFORE you waste the overhead on processing it. Real email operators will (or are supposed to according to Best Practices) change the rDNS to reflect their company, eg mail.companyname.com, however hackers and script kiddies who load bulk email programs and hacks onto vulnerable servers usually can’t modify the rDNS itself, without triggering alerts, or breaking things, and usually the ability to change rDNS is locked down to the system administrator, or their upstream provider.
it could be addresses such as *.static.upstream.com, or it could be generic patterns like the recent outbreaks at SoftLayer, eg.
168.1.29.242-static.reverse.softlayer.com
But in todays case it was the Linode network that was especially active.
45.79.0.153 8 li1099-153.members.linode.com
45.79.68.23 20 li1167-23.members.linode.com
45.79.69.114 7 li1168-114.members.linode.com
45.79.71.113 35 li1170-113.members.linode.com
45.79.88.171 8 li1187-171.members.linode.com
45.79.108.89 6 li1207-89.members.linode.com
45.79.128.228 21 li1227-228.members.linode.com
45.79.136.226 7 li1235-226.members.linode.com
45.79.154.47 8 li1253-47.members.linode.com
45.79.181.254 1 li1280-254.members.linode.com
85.90.244.62 39 li1427-62.members.linode.com
103.3.63.6 31 li819-6.members.linode.com
139.162.27.15 37 li868-15.members.linode.com
139.162.29.190 1 li870-190.members.linode.com
139.162.149.101 1 li1416-101.members.linode.com
139.162.156.90 36 li1423-90.members.linode.com
139.162.159.120 1 li1426-120.members.linode.com
151.236.221.233 35 li585-233.members.linode.com
178.79.139.130 1 li195-130.members.linode.com
The second number is the number of ISP’s that reported the problem.
This might be a PTR pattern that you want to treat as suspect, or choose to block on your email servers. Real email operators on the Linode network will of course have proper rDNS records, and shouldn’t be affected.