[anti-abuse-wg] Malware/ransomware current live distribution IPs

On Fri, 01 Jul 2016 10:07:46 +0530
Suresh Ramasubramanian <ops.lists at gmail.com> wrote:
> On 01/07/16, 10:02 AM, "anti-abuse-wg-bounces at ripe.net on behalf of
> andre at ox.co.za" <anti-abuse-wg-bounces at ripe.net on behalf of
> andre at ox.co.za> wrote:
> > Client host [hostacc.com] blocked using black.uribl.com; 127.0.0.1
> > -> this "bounce" does not tell the sender how to delist from 
> > "black.uribl.com" etc.
> I am not sure why a URL in the 5xx error is not an acceptable
> substitute for, say, a blog post or a longform New Yorker style essay
> on who URIBL are, why they’re blocking what’s probably your webhost
> etc.
> 
nice is dnsbl.ascams.com - but although 100% accuracy it is
only a fresh spam list - this is also what the node messages look like
if you were to get your own dnsbl or dnsbl from dumpspam.com

have a look at the bounce message & web link
dig TXT @dnsbl.ascams.com 247.241.106.184.dnsbl.ascams.com

Andre