Jump to content

More snowshoe crap from Romania...


goldeneye
 Share

Recommended Posts

Except that this time, it now references to a set of IP address space with no contact info, which has now been sent to nomaster because of the lack of contact info...

8 out my last 13 sent submissions, and that has been since April 24 are for this Romanian snowshoe crap with

The space 94.49.0.0/16 or better yet, the space 94.48.0.0/15 should be totally blocked until that snowshoe spam farm has been kicked out.

The IP addresses (sending and referred) have been this list:

94.49.123.207

94.49.137.17

94.49.123.174

94.49.136.163

94.49.123.143

94.49.136.101

94.49.123.109

94.49.136.40

94.49.121.226

94.49.131.175

94.49.121.136

94.49.131.5

94.49.121.37

94.49.130.70

94.49.120.134

94.49.129.6

And according to robtex...

All of these IP addresses belong to AS47931, ALE-NETWORK, apparently based out of (surprise, surprise) Romania.

And they apparently own these netblocks...

94.48.160.0/24 ALE NETWORK

94.49.120.0/21 ALE NETWORK

94.49.128.0/18 ALE NETWORK

The reason why I am calling for the entire 94.48.0.0/15 netblock to be blocked is every known registered IP block of either 94.48.0.0/16 and 94.49.0.0/16 are known Romanian snowshoe spam farm suspects.

Spamcop - please block the entire 94.48.0.0/15 netblock for these reasons.

Link to comment
Share on other sites

Spamcop - please block the entire 94.48.0.0/15 netblock for these reasons.

I can understand your frustration :) However, the SCBL doesn't work in that way and I guess it would be a massive change in philosophy. So it's pretty unlikely to get attention. But I think there are other DNSBLs that might do what your suggesting so you could implement them in your filtering.

You could post this as a suggestion as new feature request.

Andrew

Link to comment
Share on other sites

<snip>

Spamcop - please block the entire 94.48.0.0/15 netblock for these reasons.

Hi, goldeneye!

...Sorry, that's not how SpamCop works. First, it's important to emphasize that SpamCop itself blocks nothing (except for a very few sources of mail directed to SpamCop e-mail inboxes). IP addresses seen as sources of spam are placed on the SpamCop blacklist programmatically if they meet the criteria for listing and are delisted when they meet the criteria for delisting. See SpamCop FAQ (a link to which appears near the top left of pretty much every SpamCop Forum page) entry labeled "What is on the list?"

Link to comment
Share on other sites

Following up on Andrew's observation:

...But I think there are other DNSBLs that might do what your suggesting so you could implement them in your filtering.

http://multirbl.valli.org/dnsbl-lookup/94.49.121.136.html (etc.)

The much-maligned SORBS picks up this bunch consistently. Spamhaus SBL has a snowshoe component but isn't (so far) picking these.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...