Jump to content

Help requested: abuse contact seems to be the spanner himself


Recommended Posts

We get many fraudulent bitcoin spam mails from the same server group 45.144.215.0 - 45.144.215.255. 

Each time, another IP from that group is beeing used - abuse contact for all used servers is ralfnoack1982@gmail.com. I suppose, this could be the spammer himself, since reporting is beeing ignored. 

What kind of reporting makes sense in this case? I allready figured out, that the servers are hosted by nshostu.ru - so i instead started to send my reporting to abuse@nshostu.ru. Any other ideas?

Thanks for your help! 

Best regards 
Sam

 

This one of many exampels: 

Tracking message source: 45.144.215.62:

Routing details for 45.144.215.62
[refresh/show] Cached whois for 45.144.215.62 : ralfnoack1982@gmail.com
Using last resort contacts ralfnoack1982@gmail.com

Yum, this spam is fresh!

Message is 0 hours old
45.144.215.62 not listed in cbl.abuseat.org
45.144.215.62 not listed in dnsbl.sorbs.net
45.144.215.62 not listed in accredit.habeas.com
45.144.215.62 not listed in plus.bondedsender.org
45.144.215.62 not listed in iadb.isipp.com

Link to comment
Share on other sites

1 hour ago, sam_nospam said:

Each time, another IP from that group is beeing used - abuse contact for all used servers is ralfnoack1982@gmail.com. I suppose, this could be the spammer himself, since reporting is beeing ignored. 

That address is coming from the whois at ripe.  Because Europeans tend to do that lately, they tried to limit what can be seen by a query.  I would prefer they use an abuse@ address too.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...