Jump to content

More snowshoe crap from Romania...


goldeneye

Recommended Posts

Except that this time, it now references to a set of IP address space with no contact info, which has now been sent to nomaster because of the lack of contact info...

8 out my last 13 sent submissions, and that has been since April 24 are for this Romanian snowshoe crap with

The space 94.49.0.0/16 or better yet, the space 94.48.0.0/15 should be totally blocked until that snowshoe spam farm has been kicked out.

The IP addresses (sending and referred) have been this list:

94.49.123.207

94.49.137.17

94.49.123.174

94.49.136.163

94.49.123.143

94.49.136.101

94.49.123.109

94.49.136.40

94.49.121.226

94.49.131.175

94.49.121.136

94.49.131.5

94.49.121.37

94.49.130.70

94.49.120.134

94.49.129.6

And according to robtex...

All of these IP addresses belong to AS47931, ALE-NETWORK, apparently based out of (surprise, surprise) Romania.

And they apparently own these netblocks...

94.48.160.0/24 ALE NETWORK

94.49.120.0/21 ALE NETWORK

94.49.128.0/18 ALE NETWORK

The reason why I am calling for the entire 94.48.0.0/15 netblock to be blocked is every known registered IP block of either 94.48.0.0/16 and 94.49.0.0/16 are known Romanian snowshoe spam farm suspects.

Spamcop - please block the entire 94.48.0.0/15 netblock for these reasons.

Link to comment
Share on other sites

Spamcop - please block the entire 94.48.0.0/15 netblock for these reasons.

I can understand your frustration :) However, the SCBL doesn't work in that way and I guess it would be a massive change in philosophy. So it's pretty unlikely to get attention. But I think there are other DNSBLs that might do what your suggesting so you could implement them in your filtering.

You could post this as a suggestion as new feature request.

Andrew

Link to comment
Share on other sites

<snip>

Spamcop - please block the entire 94.48.0.0/15 netblock for these reasons.

Hi, goldeneye!

...Sorry, that's not how SpamCop works. First, it's important to emphasize that SpamCop itself blocks nothing (except for a very few sources of mail directed to SpamCop e-mail inboxes). IP addresses seen as sources of spam are placed on the SpamCop blacklist programmatically if they meet the criteria for listing and are delisted when they meet the criteria for delisting. See SpamCop FAQ (a link to which appears near the top left of pretty much every SpamCop Forum page) entry labeled "What is on the list?"

Link to comment
Share on other sites

Following up on Andrew's observation:

...But I think there are other DNSBLs that might do what your suggesting so you could implement them in your filtering.

http://multirbl.valli.org/dnsbl-lookup/94.49.121.136.html (etc.)

The much-maligned SORBS picks up this bunch consistently. Spamhaus SBL has a snowshoe component but isn't (so far) picking these.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...