I noticed something last night regarding this certain spam, the unsub IP is the same for all! I noticed my evilrules was hitting on 203.197.204.157. Did a quick search:
This has ALL the makings of a spamhost. The main page is just a image for, "Cris inc. - mail worldwide." which would be odd since the site is in India! Whois info at end of this message. I would say pretty much everyone can block that IP at the firewall if they wanted to. I'm thinking on blocking the whole /16 block, as we don't do business with India. I did not contact the ISP. They are likely spammer friendly. inetnum: 203.197.0.0 - 203.197.255.255 netname: VSNL-IN descr: Videsh Sanchar Nigam Ltd - India. descr: Videsh Sanchar Bhawan, M.G. Road descr: Fort, Bombay 400001 country: IN admin-c: IA15-AP tech-c: VT43-AP remarks: Internet Service Provider mnt-by: APNIC-HM mnt-lower: MAINT-VSNL-AP changed: [EMAIL PROTECTED] 19980915 changed: [EMAIL PROTECTED] 20010608 status: ALLOCATED PORTABLE source: APNIC person: IP Administrator address: 10th Floor, 2 MG Road address: Fort Mumbai - 400001 address: India country: IN phone: +91-22-2623620 fax-no: +91-22-2653887 e-mail: [EMAIL PROTECTED] nic-hdl: IA15-AP mnt-by: MAINT-VSNL-AP changed: [EMAIL PROTECTED] 20010605 source: APNIC person: VSNL Tech address: 10th Floor, 2 MG Road address: Fort Mumbai - 400001 address: India country: IN phone: +91-22-2623620 fax-no: +91-22-2653887 e-mail: [EMAIL PROTECTED] nic-hdl: VT43-AP mnt-by: MAINT-VSNL-AP changed: [EMAIL PROTECTED] 20010605 source: APNIC ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
