Jump to content
Sign in to follow this  
goldeneye

More snowshoe crap from Romania...

Recommended Posts

Except that this time, it now references to a set of IP address space with no contact info, which has now been sent to nomaster because of the lack of contact info...

8 out my last 13 sent submissions, and that has been since April 24 are for this Romanian snowshoe crap with

The space 94.49.0.0/16 or better yet, the space 94.48.0.0/15 should be totally blocked until that snowshoe spam farm has been kicked out.

The IP addresses (sending and referred) have been this list:

94.49.123.207

94.49.137.17

94.49.123.174

94.49.136.163

94.49.123.143

94.49.136.101

94.49.123.109

94.49.136.40

94.49.121.226

94.49.131.175

94.49.121.136

94.49.131.5

94.49.121.37

94.49.130.70

94.49.120.134

94.49.129.6

And according to robtex...

All of these IP addresses belong to AS47931, ALE-NETWORK, apparently based out of (surprise, surprise) Romania.

And they apparently own these netblocks...

94.48.160.0/24 ALE NETWORK

94.49.120.0/21 ALE NETWORK

94.49.128.0/18 ALE NETWORK

The reason why I am calling for the entire 94.48.0.0/15 netblock to be blocked is every known registered IP block of either 94.48.0.0/16 and 94.49.0.0/16 are known Romanian snowshoe spam farm suspects.

Spamcop - please block the entire 94.48.0.0/15 netblock for these reasons.

Share this post


Link to post
Share on other sites
Spamcop - please block the entire 94.48.0.0/15 netblock for these reasons.

I can understand your frustration :) However, the SCBL doesn't work in that way and I guess it would be a massive change in philosophy. So it's pretty unlikely to get attention. But I think there are other DNSBLs that might do what your suggesting so you could implement them in your filtering.

You could post this as a suggestion as new feature request.

Andrew

Share this post


Link to post
Share on other sites
<snip>

Spamcop - please block the entire 94.48.0.0/15 netblock for these reasons.

Hi, goldeneye!

...Sorry, that's not how SpamCop works. First, it's important to emphasize that SpamCop itself blocks nothing (except for a very few sources of mail directed to SpamCop e-mail inboxes). IP addresses seen as sources of spam are placed on the SpamCop blacklist programmatically if they meet the criteria for listing and are delisted when they meet the criteria for delisting. See SpamCop FAQ (a link to which appears near the top left of pretty much every SpamCop Forum page) entry labeled "What is on the list?"

Share this post


Link to post
Share on other sites

Following up on Andrew's observation:

...But I think there are other DNSBLs that might do what your suggesting so you could implement them in your filtering.

http://multirbl.valli.org/dnsbl-lookup/94.49.121.136.html (etc.)

The much-maligned SORBS picks up this bunch consistently. Spamhaus SBL has a snowshoe component but isn't (so far) picking these.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×