Sorry, it was my bad for introducing the topic here.
I didn't realize it was out of scope for mailop.
On 2026-06-17 12:47 PM, Richard W via mailop wrote:
On 2026-06-16 8:57 p.m., Michael Peddemors via mailop wrote:
I know that the list owners prefer we not discuss spam or spammers on
list, however to close off my hurried response..
And just where does this discussion take place now? All the old lists
for us old guys seem to have died away
Richard
Yes, as someone else mentioned, use the DROP lists from SpamHaus and
SpamRats, but this is an interesting actor so adding a few comments..
This actor is currently in the top three watch lists. They have been
able to find new ranges quite consistently, at first it looked like
only bullet proof hosting networks, but soon was obvious that it was
more than that. While the ranges quickly end up on several RBL's
including RATS-SPAM and others, the sheer volume means even a short
two hour lead time from detection to listing to propagation, makes
them quite visible.
I am sure you have seen evidence of them, they are behind the fake
'AAA', 'Omahe Steak House', 'Krogers' and 'Mariott' coupon scams.
They area actually quite sophisticated, and understand email quite
well, and use AI heavily in their email sending methods, both as
bayesian poisoning, and to confuse filters.
And they do more than just abuse IP space, unfortunately this actor
also uses Gmail (really surprised that gmail can't get a handle on
them) which unfortunately also rules out just IP reputation, rate
limiting etc..
Filtering also needs to be a fallback, and this actor is VERY tricky
to filter on.. I know the mThreat team also puts out various filters
(even for spamassassin) to target this actor.
There are some similarities between this actor, and earlier threat
attacks, and it has been suggested that they also might be related to
some known engines that are available for rent, however ...
This actor has been active for a couple of months..
If you want to know more, reach out off list, as this is a bit off
topic, but we know it is affecting lots of people. But for most of
the people out there, use a good RBL and support your favourite RBL
and all the hard work those teams do..
On 2026-06-16 17:31, Michael Peddemors via mailop wrote:
This is the actor the mThreat/SpamRats team is tracking with the nom
de guerre of "JOHINDER"
Two new ranges detected today, been at it for some weeks now..
AI used heavily..
On 2026-06-16 09:03, Mark E. Jeftovic via mailop wrote:
We're getting a crap-tonne of garbage mailings from 162.217.160.0 -
162.217.167.255 which is all Electronic Transaction Consultants
Corporation (etcc.com) now owned by Quarterhill - publicly traded
on the TSX.
Tens of thousands of messages per day, we've blocked the entire range.
We're going to start publishing our email intelligence findings
starting with this one, it's just odd given the public nature of
the operator.
Anybody know anything about them in terms of their mailing practices?
(I have messaged their ARIN contact - if this is a network
compromise, it's basically everything)
- mark
--
Mark E. Jeftovic <[email protected]>
Co-founder & CEO easyDNS Technologies Inc.
+1-(416)-535-8672 ext 225
/"Never expect a thing you do not want,
and never desire a thing you do not expect."
-- Bob Proctor /
_______________________________________________
mailop mailing list
[email protected]
https://easydns.urlsand.com/?u=https%3A%2F%2Flist.mailop.org%2Flistinfo%2Fmailop&e=e7eb7067&h=8771eab6&f=y&p=y&m=4ggVF657jqzHPMS
_______________________________________________
mailop mailing list
[email protected]
https://easydns.urlsand.com/?u=https%3A%2F%2Flist.mailop.org%2Flistinfo%2Fmailop&e=e7eb7067&h=8771eab6&f=y&p=y&m=4ggVF657jqzHPMS
_______________________________________________
mailop mailing list
[email protected]
https://easydns.urlsand.com/?u=https%3A%2F%2Flist.mailop.org%2Flistinfo%2Fmailop&e=e7eb7067&h=8771eab6&f=y&p=y&m=4ggVF657jqzHPMS
--
Mark E. Jeftovic <[email protected]>
Co-founder & CEO easyDNS Technologies Inc.
+1-(416)-535-8672 ext 225
/"Never expect a thing you do not want,
and never desire a thing you do not expect."
-- Bob Proctor /
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
