[Security-wg] Re: Abuse mailboxes are increasingly no longer monitored and are being replaced by (bad) forms

[Jeroen Massar via Security-wg]

> On 3 Aug 2026, at 13:54, Suresh Ramasubramanian <ops.li...@gmail.com> wrote:
> 
> If a space is in an email oriented blocklist like say Spamhaus, it just gets 
> used for some other kind of abuse ..  DDoS C2, account farming, host illegal 
> content and so on.   Or if spam, then spam through some messaging or social 
> media platform rather than through email.

Yep, that is why Spamhaus DROP exists: 
https://www.spamhaus.org/blocklists/do-not-route-or-peer/
(btw, as per the text there, do migrate to the JSON editions!)

Which is a very rough hammer. As updates to entries are infrequent, one really 
has to be a bad seed to be listed there.

I can recommend fetching the JSONs, making a delta with the previous version 
one has, and then adding a approve/deny option to your NOC interface of choice 
so that a live person reviews "who is that entity, why are they considered so 
bad" and then approves new listings. Though running blind by trusting Spamhaus 
is fine too of course ;)



Maybe one thing in this field is to have, like adblockers, more such lists that 
are trusted, be that from the various NOGs or other groups. Spamhaus are great 
at what they do, but alternatives (that do have the legal protections needed 
for these kind of lists) would be a good thing. And in such a situation, merge 
those lists, rate&rank yourself how evil one considers those entities and... 
drop.

Do note any other such good entities for consideration if one knows any solid 
ones.

Regards,
 Jeroen



-----
To unsubscribe from this mailing list or change your subscription options, 
please visit: https://mailman.ripe.net/mailman3/lists/security-wg.ripe.net/
As we have migrated to Mailman 3, you will need to create an account with the 
email matching your subscription before you can change your settings. 
More details at: https://www.ripe.net/membership/mail/mailman-3-migration/