[anti-abuse-wg] Malware/ransomware current live distribution IPs

On Thu, 30 Jun 2016 14:08:43 -0700
"Ronald F. Guilmette" <rfg at tristatelogic.com> wrote:
> In message <15295.1467317095 at server1.tristatelogic.com>, I wrote:
> >>If you would like to add superblock.ascams.com - these seem like
> >>good links:
> >>
> >>Exim : http://www.exim.org/howto/rbl.html
> >>postfix :https://www.howtoforge.com/block_spam_at_mta_level_postfix
> >Note: The specific domains and IPs I have just posted
> >are pointless to block in mail server configs, because the final
> >"landing page" domains that are actually spreading the infectious
> >agents are never seen, and will never be seen in e-mails.  Rather,
> >there _is_ spam... lots of it... trying to get people to go to these
> >infection domains, but only via a sequence of one or two redirections
> >(through other domains) first.
> Conveniently, to further this point, these same spammers just sent me
> ANOTHER one of their standard spams.  ** WARNING **  Browsing to the
> URL below may result in infection!
> 
on the dnsbl - superblock.ascams.com it is all mixed - as abuse, as
the same resources in the same ip's and subnets are re-purposed every
now and then...even the bot controllers and the bots themselves are
listed together, currently on spamid.net - I still need to setup
seperate dnsbl for bots, controllers, etc.  

So, where you are now getting your payloads may be used for something
else tomorrow... You will find though, that the superblock.ascams.com
list will reduce your incoming spam by quite a lot? - you can tell me
the percentage?

Regards

Andre