I just wanted to clear another one of these very high volume guys off of my server that is getting past many of the RBL's on a regular basis and occasionally gets a message through my server. I identified this spammer by the way that he always begins the subject with a capitalized name of the receiver, and then put the IP's together with reverse DNS. This turns out to be an SBL Rosco spammer (repeat offender booted 3 different times), however SBL is quite incomplete at the moment when it comes to this guy's addresses even though he is spamming a great deal (just like the Pexicom guy who ranks in the top 10 senders on SenderBase presently).

Any way, I've got positive hits from reverse DNS for only segments of 7 different class C's, and they don't follow CIDR blocks. I don't have a scanner, but I'm wondering if someone could figure out if these blocks are concurrent (pointed at one server) so that it would be safe to know if blocking the class C's instead of just the blocks that are currently configured. Here's a list of what I have for this guy:

   64.70.22.131 - 64.70.22.160
   64.70.26.208 - 64.70.26.223
   64.70.48.144 - 64.70.48.159
   66.226.4.0 - ?
   66.55.173.16 - 66.55.173.47
   66.55.167.0/24
   216.34.216.135 - 216.34.216.169

On a related note, here's a guy that is spoofing Outblaze (big time) in order to get his porn spam through. Anyone care to code this one up?

http://www.senderbase.org/search?searchBy=organization&searchString=TaiKoo%20Place%2C%20Quarry%20Bay%2C

Matt

--
===================================================
Matthew S. Bramble
President and Technical Coordinator
iGaia Incorporated, Operator of NYcars.com
---------------------------------------------------
Office Phone: (518) 862-9042
Cellular: (518) 229-3375
Fax: (518) 862-9044
E-mail: [EMAIL PROTECTED] or [EMAIL PROTECTED]
===================================================


--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Reply via email to