Jump to content

Rerporting-address escalation/update req for CRNET AS9394


moulty
 Share

Recommended Posts

A majority of spam seen at two of my reporting addresses is of the Glavmed / "Canadian Pharmacy" variety (counterfeit/placebo/toxic medications and magical sexual-size-and-performance enhancers). Spamvertised domains are typically pointing by DDNS proxy to targets at 58.218.177.253, 61.235.117.75 and 124.248.32.48.

Nearly all in the last week have pointed to the 61.235.117.75. None of these however are newly compromised addresses.

Spamcop directs reports for hosting to spam[at]ccert.edu.cn, abuse[at]anti-spam.cn, and abuse[at]chinatietong.com. These are nonresponsive.

APNIC's WHOIS record for the net which contains 61.235.117.75 includes some better information.

route: 61.232.0.0/14

descr: PACNET (proxy-registered route object)

origin: AS9394

remarks: This route object is for a PACNET customer route which is

being exported under this origin AS.

This route object was created because no existing route

object with the same origin was found, and since some

PACNET peers filter based on these objects this route

may be rejected if this object is not created.

Please contact abuse[at]pacnet.net if you have any

Concerns regarding spam/Abuses related to this object.

Very actively spammed at present are sites the domains of which are "self-routed" via remote dynamics by "organcamp.ru" -- here's a useful listing from URIBL:

http://rss.uribl.com/ns/organcamp_ru.html

ALL point to 61.235.117.75. A wholesale nip-in-bud by removal of the onerous route-object would be a wonderful thing.

So I am wondering if my peers could include this information and reporting-address in their reports for this spammer - and what if anything I may be able to suggest in order for SC to automate it.

Edited by moulty
Link to comment
Share on other sites

... and what if anything I may be able to suggest in order for SC to automate it.
With any luck SpamCop Admin might have already seen this and is even now pondering your suggestion - for which, thanks. If there's no further comment forthcoming I suggest you check with him in a few days time - that's Don D'Minion - service[at]admin.spamcop.net
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...