[anti-abuse-wg] vacancesloisirs.fr

Look pretty spammer friendly

http://www.spamhaus.org/sbl/listings/as24679.net
http://www.spamhaus.org/sbl/listings/hostway.com
http://www.spamhaus.org/sbl/listings/hostway.de 


-----Original Message-----
From: anti-abuse-wg-bounces at ripe.net [mailto:anti-abuse-wg-bounces at ripe.net] On Behalf Of Thor Kottelin
Sent: 29 August 2012 14:48
To: anti-abuse-wg at ripe.net
Subject: Re: [anti-abuse-wg] vacancesloisirs.fr

> -----Original Message-----
> From: anti-abuse-wg-bounces at ripe.net [mailto:anti-abuse-wg- 
> bounces at ripe.net] On Behalf Of Thor Kottelin
> Sent: Wednesday, August 29, 2012 3:44 PM
> To: anti-abuse-wg at ripe.net

> > -----Original Message-----
> > From: anti-abuse-wg-bounces at ripe.net [mailto:anti-abuse-wg- 
> > bounces at ripe.net] On Behalf Of Reza Farzan
> > Sent: Wednesday, August 29, 2012 3:26 PM
> > To: anti-abuse-wg at ripe.net
> > Cc: info at vacancesloisirs.fr
>
> > Based on my rudimentary research, the spamvertised website 
> > "vacancesloisirs.fr" resides on this IP address: 193.238.229.26 
> > which belongs to Hostway in Germany:
>
> > inetnum:      193.238.228.0 - 193.238.231.255
> >
> > netname:     HOSTWAY-1
> >
> > descr:           Hostway Deutschland GmbH
>
> > Their NOC, however, denies that the IP is theirs, and they are
> not
> > responsible for this domain.
>
> The sites vacancesloisirs.fr and www.vacancesloisirs.fr are clearly 
> live on 193.238.229.26, i.e. on the Hostway Deutschland GmbH network 
> you mention.
> Spam support providers often lie.

PS. That IP address has been on Spamhaus' SBL blacklist for more than two weeks now: http://www.spamhaus.org/sbl/query/SBL150849. This makes it particularly difficult to believe that the provider would be unaware of the problem.

--
Thor Kottelin
http://www.anta.net/