My detective work for the day.
Looking through my MT Blacklist log, I can see that a lot of the bad guy hits are coming from IP 213.91.*.*
Querying the most recent IP address through ARIN, I find that the 213.0.0.0 – 213.255.255.255 block is controlled by the RIPE Network Coordination Centre in beautiful Amsterdam. RIPE is a Regional Internet Registry (Réseaux IP Européens), and they have their own database of folks routing through them.
Querying the RIPE database shows me that range 213.91.128.0 – 213.91.255.255 belongs to Bulgarian Telecommunications Company Plc., located in beautiful downtown Sofia, the honorable Bisser Tzonev, Ilia Koukov, and Lyubomir Georgiev presiding (or at least as technical contacts).
Going to their site is pretty much of a Cyrillic dead end for me. Or is it?
So I’ve sent them a nice little note, asking for their assistance in blocking this sort of stuff. I’ll let you know what, if any, response I receive.