[anti-abuse-wg] Malware/ransomware current live distribution IPs

On Fri, 1 Jul 2016 06:22:08 +0200
andre at ox.co.za wrote:
> on the dnsbl - superblock.ascams.com it is all mixed - as abuse, as
> the same resources in the same ip's and subnets are re-purposed every
> now and then...even the bot controllers and the bots themselves are
> listed together, currently on spamid.net - I still need to setup
> seperate dnsbl for bots, controllers, etc.  
> 
> So, where you are now getting your payloads may be used for something
> else tomorrow... You will find though, that the superblock.ascams.com
> list will reduce your incoming spam by quite a lot? - you can tell me
> the percentage?
> 
So, I reply to you and list - email to you is bouncing... on a good
reputation ipv4?

Ronald, this must be impacting your email quite a lot?
It is a ipv6 bouce (dnswl) on an ipv4 number... but it does not tell the
recipient how to list/delist...

 rfg at tristatelogic.com
    host server1.tristatelogic.com [69.62.255.118]
    SMTP error from remote mail server after RCPT
TO:<rfg at tristatelogic.com>: 550 5.7.1 Service unavailable; Unverified
Client host [hostacc.com] blocked using black.uribl.com; 127.0.0.1 ->
Query Refused. See http://uribl.com/refused.shtml for more information
[Your DNS IP: 74.125.80.70]

go read the rfc bits, at the  bottom, here: http://spamid.net/?spam=definitions

this "bounce" does not tell the sender how to delist from "black.uribl.com" etc.
or to list - if it is a white list, etc. etc

Andre