From the symptoms you describe, I would say this matches somebody running a joejob (https://en.wikipedia.org/wiki/Joe_job) campaign and most likely bought a bottom of the barrel spamto: list with a generous helping of outdated or never-existed-in-the-first-place addresses.
DMARC reporting might help identify the sources, if you and the target domains have the required bits configured. A point of idle curiosity: Are the bounce-to addresses live addresses in your domain, or random, made-up ones (I have seen a few varieties of both over the years)? - Peter -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team https://bsdly.blogspot.com/ https://www.bsdly.net/ https://www.nuug.no/ "Remember to set the evil bit on all malicious network traffic" delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds. _______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
