A new block under AT&T, listed as being owned by:
The Karcher Group Inc. ATTIS-9951800 (NET-99-51-80-0-1) 99.51.80.0 -
99.51.81.255
Just started an email marketing campaign to addresses stripped from the web..
We wouldn't run out of IP's if this didn't keep happening..
So called CAN-SPAM compliant of course..
Return-Path: <618882010@return.signtabulararrayoffice.com>
Delivered-To: support@linuxmagic.com
Received: (qmail 25942 invoked from network); 3 Nov 2009 05:26:41 -0000
Received: from unknown (HELO mail23.collegeloanassociates.com) (99.51.80.247)
by thundercracker.cityemail.com with SMTP; Mon, 02 Nov 2009 21:26:41 -0800
DKIM-Signature: v=1; a=rsa-sha1; d=signtabulararrayoffice.com; s=default;
c=simple/simple;
q=dns/txt; i=@signtabulararrayoffice.com; t=1257225979;
h=From;
bh=dua1L4dgTnW3vCenQjnlynXJ0yk=;
b=jxhpH/zBQxVZ5O4+8Yd2Va5Dj3v6Soasndd6moffduE1XIfNz7UzYntYdA6AwGZ1
qLBFmNjyNyTKjdeCc9vDa/ApxFy6LrsPMpsRjbyOjh8Io3951KpzLOPD3BwcYYsf;
DomainKey-Signature: q=dns; a=rsa-sha1; c=nofws;
s=default; d=signtabulararrayoffice.com;
h=Received:Date:From:To:Message-id:Mime-Version:Subject:X-Ver:X-
CampaignDetail:X-Edata1:X-Log:Errors-To:List-Unsubscribe:Content-Type;
b=PhZXM6t8AayFvb3UDWPYbhL98WpXfcC/g95pqhVM2gNwjRd6hnTO+w1PB2z2Xv8/
5L7acKRTMWdCNZ8Ql1doxzrZ0QYt5u4bd48rbyQiUmMU69ToMXnvFw5mKxLtX5H+
Received: from 316-99.51.80.247 (316-99.51.80.247-s [192.168.1.75]) by
signtabulararrayoffice.com for support@linuxmagic.com; Tue, 03 Nov 2009
00:26:19 -0500
I don't see how this relates to IPv4-runout. The allocation (to AT&T) isn't all that new...and when they cancel this spammer, the space will undoubtedly be assigned to another customer.
Just started an email marketing campaign to addresses stripped from the
web..
We wouldn't run out of IP's if this didn't keep happening..
I don't see how this relates to IPv4-runout. The allocation (to AT&T) isn't
all that new...and when they cancel this spammer, the space will undoubtedly
be assigned to another customer.
And the new customer will suffer from blocklists until he asks AT&T
for a new space, which will most likely be granted, consuming the
previous spammer allocation for ever.
Rubens
It was mentioned that this might be offtopic for this list, however I did want
to get a feel for the attitudes of network operators, in light of the recent
discussions regarding the Russian Operators.. and blocking routing et al..
At what point does it become an issue to the point where operators demand that
others are responsible for the activiities coming from their networks?
Wanted to start a thread on this issue..
It was mentioned that not routing operators who are puported to be
owned/operated/supported by criminal activities, in conjunction with the
Russian IP's, and the controversy on the Hurricane Electric actions..
I think this is on topic.. However, if others think it isn't I will not post
to this subject here further...
I do know that there is a lot of chatter on this list, so I fully understand
if it needs to be kept for strictly technical problems, rather than
discussions.
-- Michael --
I think this is fairly much off topic, but.. I'd say this:
1) did you send in proper complaints to att/Sbc for the activity you
allege comes from this ip block?
2) did you get back an auto-ack?
3) did this activity start prior to today? (looking at the headers in
the original post)
If so, then I'm sure ATT will do the right thing in the next little
while... they can't turn off (for a variety of reasons) a customer
that seems may have been 'ok' for 7 months time (judging by the
reg-date for the block in question) with only a single
complaint/event.
Complaining about this on nanog-l certainly won't get any of your
concerns about this SBCIS customer addressed though.
-Chris
(note I don't see in my personal spamtraps content from this address range)
Jon Lewis wrote:
A new block under AT&T, listed as being owned by:
The Karcher Group Inc. ATTIS-9951800 (NET-99-51-80-0-1) 99.51.80.0 -
99.51.81.255
Just started an email marketing campaign to addresses stripped from the web..
There's a far more succinct term for "email marketing campaign"...
We wouldn't run out of IP's if this didn't keep happening..
I don't see how this relates to IPv4-runout. The allocation (to AT&T) isn't all that new...and when they cancel this spammer, the space will undoubtedly be assigned to another customer.
And that other customer will find that it's poisoned space and will need to look for another subnet.
I don't buy that once IP space has been used by a spammer it's ruined forever. Only if abuse complaints are ignored for a considerable time are the IPs likely to end up widely privately blacklisted. Even then, I don't believe "space is widely blacklisted, please give us more" is a valid justification for going to ARIN for more IPs.
We've terminated spammer customers...and reused their assignments.
e-mail spam from 99.51.80.0/23 starting 04/15/2009, and from
99.51.84.0/24 starting 09/21/2009.
I don't think AT&T cares, since I complained about a massive snowshoe
spamming campaign a couple of months ago--no action taken it
seems--and they have netblocks all over the place there. A bunch of
customers were calling me since their junk was being scored low by
spamassassin and ending up in inboxes. Blah! I've seen spam from
each one of their blocks at at&t.
99.155.208-209
99.51.80-81
99.170.198-199
99.16.32-39
Just filter it and move on- business as usual. If we barked up every tree
we'd never get any real work done.
99.16.32.0/21 REJECT
99.51.80.0/23 REJECT
99.155.208.0/23 REJECT
99.170.198.0/23 REJECT
will do nicely, thank-you.