On Thursday, May 9, 2002, at 11:35 AM, Mark S. Strom wrote: > Two days ago, they were coming from IP addreses in the 62.150.189
are you sure it was 62.150.189? That makes little sense. 62.0.0.0 is a European IP address admined by RIPE. > range > (which resolved to ones owned by qwest.net). After a couple of emails to > [EMAIL PROTECTED] went unanswered, I entered this block in the blacklist. > Today they returned, same names on their mail servers (mail03.ums01.com and > mail04.ums01.com) but from addresses in the 63.150.189 range! So I've BL' > d > these too. First, complain to qwest (this is a waste of time, but a necessary step). Then, blacklist the right IP range this time (nothing against you but all the reports I can turn up are in the 63.150.189.0/24 range so I think you made a mistake previously) When Qwurst moves the spammers to a new IP block you can either follow the move or simply add Qwest to your blacklist. 63.144.0.0 - 63.151.255.255 for a start with a note about ums01 spam. I hate to say it, but your post is a perfect advertisement for the SPEWS "daisy cutter" methods of blacklisting every possible IP address. <http://groups.google.com/groups?num=100&hl=en&lr=lang_en&newwindow=1&q=ums01. %2Bcom+group%3Anews.admin.net-abuse.sightings> Post your spam message to news.admin.net-abuse.sightings including all the headers. You can block out out any personal info in the headers, but doin' t delete anything. looks like they used to be at 209.120.219.69 which is Data Delivery Direct. Even sounds like a spammer. -- You are responsible for your rose. ############################################################# This message is sent to you because you are subscribed to the mailing list <[EMAIL PROTECTED]>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
