I know that the list owners prefer we not discuss spam or spammers on
list, however to close off my hurried response..
Yes, as someone else mentioned, use the DROP lists from SpamHaus and
SpamRats, but this is an interesting actor so adding a few comments..
This actor is currently in the top three watch lists. They have been
able to find new ranges quite consistently, at first it looked like only
bullet proof hosting networks, but soon was obvious that it was more
than that. While the ranges quickly end up on several RBL's including
RATS-SPAM and others, the sheer volume means even a short two hour lead
time from detection to listing to propagation, makes them quite visible.
I am sure you have seen evidence of them, they are behind the fake
'AAA', 'Omahe Steak House', 'Krogers' and 'Mariott' coupon scams.
They area actually quite sophisticated, and understand email quite well,
and use AI heavily in their email sending methods, both as bayesian
poisoning, and to confuse filters.
And they do more than just abuse IP space, unfortunately this actor also
uses Gmail (really surprised that gmail can't get a handle on them)
which unfortunately also rules out just IP reputation, rate limiting etc..
Filtering also needs to be a fallback, and this actor is VERY tricky to
filter on.. I know the mThreat team also puts out various filters (even
for spamassassin) to target this actor.
There are some similarities between this actor, and earlier threat
attacks, and it has been suggested that they also might be related to
some known engines that are available for rent, however ...
This actor has been active for a couple of months..
If you want to know more, reach out off list, as this is a bit off
topic, but we know it is affecting lots of people. But for most of the
people out there, use a good RBL and support your favourite RBL and all
the hard work those teams do..
On 2026-06-16 17:31, Michael Peddemors via mailop wrote:
This is the actor the mThreat/SpamRats team is tracking with the nom de
guerre of "JOHINDER"
Two new ranges detected today, been at it for some weeks now..
AI used heavily..
On 2026-06-16 09:03, Mark E. Jeftovic via mailop wrote:
We're getting a crap-tonne of garbage mailings from 162.217.160.0 -
162.217.167.255 which is all Electronic Transaction Consultants
Corporation (etcc.com) now owned by Quarterhill - publicly traded on
the TSX.
Tens of thousands of messages per day, we've blocked the entire range.
We're going to start publishing our email intelligence findings
starting with this one, it's just odd given the public nature of the
operator.
Anybody know anything about them in terms of their mailing practices?
(I have messaged their ARIN contact - if this is a network compromise,
it's basically everything)
- mark
--
Mark E. Jeftovic <[email protected]>
Co-founder & CEO easyDNS Technologies Inc.
+1-(416)-535-8672 ext 225
/"Never expect a thing you do not want,
and never desire a thing you do not expect."
-- Bob Proctor /
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
--
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
