Spamhaus Delisting

nikio · June 19

@Mainfrezzer said:

@kait said:

@Mainfrezzer said:

@kait said:

@nikio said:

@Alyx said:
Worth noting, Spamhaus is not only looking at IPs that are the source of send emails.
If spam is send from different sources, but reference you regularly (hosting phishing sites, C2 stuff, and so on) this counts as well.

That's reguarded. So you take someone's cat picture image board, reference it in your spam emails /C2 scripts and get the site nuked. We really need a better system - I propose we call it IDGAF™. Surely between AI and hordes of compsci graduates we can keep the internet safe without blacklists that yoursunny rightly says should be ignored by mentally strong people.

Ah yes, let's let people host malware and botnet without consequences.

There were consequences for that? Which alternate timeline are we in right now? lol

Hosting malware/c2/phishing gets you blacklisted on spamhaus.

Im sure the state sponsored groups are scared. Surely they stopped doing that

Not only did they stop hosting c2/phishing/mawlare, but they also stopped false-flagging people's cat picture imageboards and edgy political commentary sites commenting on government corruption!

Mainfrezzer · June 19

Got curios and did check spamhaus myself and they seem to actually be pretty sure its, at least for the given range, due to snowshoe spam. with a list of 167 entries

Edit: i did check some of the entries against other dbs, the couple ones i checked had 0 reports, bit odd

Edit2: even on crowdsec, there are only 8 ips listed from that range, with the expected tor exit tags and the obvious fallout of tor crap that comes along.

Levi · June 19

So, this is known malware and c2 host? Shouldn’t be banned from let?

kait · June 19

@Mainfrezzer said:

@kait said:

@Mainfrezzer said:

@kait said:

@nikio said:

@Alyx said:
Worth noting, Spamhaus is not only looking at IPs that are the source of send emails.
If spam is send from different sources, but reference you regularly (hosting phishing sites, C2 stuff, and so on) this counts as well.

That's reguarded. So you take someone's cat picture image board, reference it in your spam emails /C2 scripts and get the site nuked. We really need a better system - I propose we call it IDGAF™. Surely between AI and hordes of compsci graduates we can keep the internet safe without blacklists that yoursunny rightly says should be ignored by mentally strong people.

Ah yes, let's let people host malware and botnet without consequences.

There were consequences for that? Which alternate timeline are we in right now? lol

Hosting malware/c2/phishing gets you blacklisted on spamhaus.

Im sure the state sponsored groups are scared. Surely they stopped doing that

Yeah thats not a good argument to make bud

Mainfrezzer · June 19

@kait said:

@Mainfrezzer said:

@kait said:

@Mainfrezzer said:

@kait said:

@nikio said:

@Alyx said:
Worth noting, Spamhaus is not only looking at IPs that are the source of send emails.
If spam is send from different sources, but reference you regularly (hosting phishing sites, C2 stuff, and so on) this counts as well.

That's reguarded. So you take someone's cat picture image board, reference it in your spam emails /C2 scripts and get the site nuked. We really need a better system - I propose we call it IDGAF™. Surely between AI and hordes of compsci graduates we can keep the internet safe without blacklists that yoursunny rightly says should be ignored by mentally strong people.

Ah yes, let's let people host malware and botnet without consequences.

There were consequences for that? Which alternate timeline are we in right now? lol

Hosting malware/c2/phishing gets you blacklisted on spamhaus.

Im sure the state sponsored groups are scared. Surely they stopped doing that

Yeah thats not a good argument to make bud

That wasnt an argument, im taking the piss, obviously. lmao

kait · June 19

@Mainfrezzer said:

@kait said:

@Mainfrezzer said:

@kait said:

@Mainfrezzer said:

@kait said:

@nikio said:

@Alyx said:
Worth noting, Spamhaus is not only looking at IPs that are the source of send emails.
If spam is send from different sources, but reference you regularly (hosting phishing sites, C2 stuff, and so on) this counts as well.

That's reguarded. So you take someone's cat picture image board, reference it in your spam emails /C2 scripts and get the site nuked. We really need a better system - I propose we call it IDGAF™. Surely between AI and hordes of compsci graduates we can keep the internet safe without blacklists that yoursunny rightly says should be ignored by mentally strong people.

Ah yes, let's let people host malware and botnet without consequences.

There were consequences for that? Which alternate timeline are we in right now? lol

Hosting malware/c2/phishing gets you blacklisted on spamhaus.

Im sure the state sponsored groups are scared. Surely they stopped doing that

Yeah thats not a good argument to make bud

That wasnt an argument, im taking the piss, obviously. lmao

Your taking the piss argument is not the one you want to make...

kait · June 19

@nikio said:

@Mainfrezzer said:

@kait said:

@Mainfrezzer said:

@kait said:

@nikio said:

@Alyx said:
Worth noting, Spamhaus is not only looking at IPs that are the source of send emails.
If spam is send from different sources, but reference you regularly (hosting phishing sites, C2 stuff, and so on) this counts as well.

That's reguarded. So you take someone's cat picture image board, reference it in your spam emails /C2 scripts and get the site nuked. We really need a better system - I propose we call it IDGAF™. Surely between AI and hordes of compsci graduates we can keep the internet safe without blacklists that yoursunny rightly says should be ignored by mentally strong people.

Ah yes, let's let people host malware and botnet without consequences.

There were consequences for that? Which alternate timeline are we in right now? lol

Hosting malware/c2/phishing gets you blacklisted on spamhaus.

Im sure the state sponsored groups are scared. Surely they stopped doing that

Not only did they stop hosting c2/phishing/mawlare, but they also stopped false-flagging people's cat picture imageboards and edgy political commentary sites commenting on government corruption!

Yeah keep believing that. Track record and actions don't lie, words do.

Mainfrezzer · June 19

@kait said:

@Mainfrezzer said:

@kait said:

@Mainfrezzer said:

@kait said:

@Mainfrezzer said:

@kait said:

@nikio said:

@Alyx said:
Worth noting, Spamhaus is not only looking at IPs that are the source of send emails.
If spam is send from different sources, but reference you regularly (hosting phishing sites, C2 stuff, and so on) this counts as well.

That's reguarded. So you take someone's cat picture image board, reference it in your spam emails /C2 scripts and get the site nuked. We really need a better system - I propose we call it IDGAF™. Surely between AI and hordes of compsci graduates we can keep the internet safe without blacklists that yoursunny rightly says should be ignored by mentally strong people.

Ah yes, let's let people host malware and botnet without consequences.

There were consequences for that? Which alternate timeline are we in right now? lol

Hosting malware/c2/phishing gets you blacklisted on spamhaus.

Im sure the state sponsored groups are scared. Surely they stopped doing that

Yeah thats not a good argument to make bud

That wasnt an argument, im taking the piss, obviously. lmao

Your taking the piss argument is not the one you want to make...

Oh no, will there be consequences for that as well? Im still waiting for the ones those evildoers got, that do spread malware and setup those c2/phishing pages.

rpqu · June 19

@nikio said:

@Mainfrezzer said:

@kait said:

@Mainfrezzer said:

@kait said:

@nikio said:

@Alyx said:
Worth noting, Spamhaus is not only looking at IPs that are the source of send emails.
If spam is send from different sources, but reference you regularly (hosting phishing sites, C2 stuff, and so on) this counts as well.

That's reguarded. So you take someone's cat picture image board, reference it in your spam emails /C2 scripts and get the site nuked. We really need a better system - I propose we call it IDGAF™. Surely between AI and hordes of compsci graduates we can keep the internet safe without blacklists that yoursunny rightly says should be ignored by mentally strong people.

Ah yes, let's let people host malware and botnet without consequences.

There were consequences for that? Which alternate timeline are we in right now? lol

Hosting malware/c2/phishing gets you blacklisted on spamhaus.

Im sure the state sponsored groups are scared. Surely they stopped doing that

Not only did they stop hosting c2/phishing/mawlare, but they also stopped false-flagging people's cat picture imageboards and edgy political commentary sites commenting on government corruption!

Yes, Denial of Service by planting evidence and reporting it to relevant stakeholders is surprisingly common

Mainfrezzer · June 19

This is rather entertaining

They got removed like 8 days ago
https://imgur.com/sO19tkm

but still do crap
https://imgur.com/4kXlapk

totally_not_banned · June 19

@Mainfrezzer said:

@kait said:

@Mainfrezzer said:

@kait said:

@nikio said:

@Alyx said:
Worth noting, Spamhaus is not only looking at IPs that are the source of send emails.
If spam is send from different sources, but reference you regularly (hosting phishing sites, C2 stuff, and so on) this counts as well.

That's reguarded. So you take someone's cat picture image board, reference it in your spam emails /C2 scripts and get the site nuked. We really need a better system - I propose we call it IDGAF™. Surely between AI and hordes of compsci graduates we can keep the internet safe without blacklists that yoursunny rightly says should be ignored by mentally strong people.

Ah yes, let's let people host malware and botnet without consequences.

There were consequences for that? Which alternate timeline are we in right now? lol

Hosting malware/c2/phishing gets you blacklisted on spamhaus.

Im sure the state sponsored groups are scared. Surely they stopped doing that

Well, state sponsored actors might be somewhat apathetic but from my impression a good chunk of nonsense is even in 2026 still just kids being kids. Sure, all of this usually isn't just black and white meaning you get certain spectrum where different currents complement each other diverge, converge and so on but it's certainly not like everything instantly comes down to state actors or organized crime. Not like things would suddenly be that easy for those groups anyways even if the people pulling the strings won't be touched.

aluy · June 19

@Mainfrezzer said:
Got curios and did check spamhaus myself and they seem to actually be pretty sure its, at least for the given range, due to snowshoe spam. with a list of 167 entries

Edit: i did check some of the entries against other dbs, the couple ones i checked had 0 reports, bit odd

Edit2: even on crowdsec, there are only 8 ips listed from that range, with the expected tor exit tags and the obvious fallout of tor crap that comes along.

Spamhaus has today responded to us and given us 5 IPs on the given subnet that were spamming which were all assigned to a single service. Service suspended, ptrs removed

Very thankful for all the help!

skimply153 · June 19

@aluy said:
Spamhaus has today responded to us and given us 5 IPs on the given subnet that were spamming which were all assigned to a single service. Service suspended, ptrs removed

Very thankful for all the help!

glad to hear it! hopefully you can get the whole ASN unlisted soon

rustelekom · June 19

@luckypenguin said:

@tentor said: Mind name ones who are known to care?

Most won't want to do business with you. Even shady Romanian ones.
Only the russian terrorists still happily peer with networks no matter how dirty the IPs are.

Your statements are full of hatred and racism. A complaint has already been filed against you.

kait · June 19

@aluy said:

@Mainfrezzer said:
Got curios and did check spamhaus myself and they seem to actually be pretty sure its, at least for the given range, due to snowshoe spam. with a list of 167 entries

Edit: i did check some of the entries against other dbs, the couple ones i checked had 0 reports, bit odd

Edit2: even on crowdsec, there are only 8 ips listed from that range, with the expected tor exit tags and the obvious fallout of tor crap that comes along.

Spamhaus has today responded to us and given us 5 IPs on the given subnet that were spamming which were all assigned to a single service. Service suspended, ptrs removed

Very thankful for all the help!

Proving our point once again, thanks bro.

Levi · June 19

@rustelekom said:

@luckypenguin said:

@tentor said: Mind name ones who are known to care?

Most won't want to do business with you. Even shady Romanian ones.
Only the russian terrorists still happily peer with networks no matter how dirty the IPs are.

Your statements are full of hatred and racism. A complaint has already been filed against you.

Wtf. Romanian hosts indeed can be shady. And it is not related to race or is hateful. Coiciu was well known “I dont’t care” hoster, hostfart is openly buying woman on the street after stealing 20k in btc.

Should we start on ru hosters and recent well known raids and shut downs? Or this also be deemed racist and hateful?

rpqu · June 19

@rustelekom said:

@luckypenguin said:

@tentor said: Mind name ones who are known to care?

Most won't want to do business with you. Even shady Romanian ones.
Only the russian terrorists still happily peer with networks no matter how dirty the IPs are.

Your statements are full of hatred and racism. A complaint has already been filed against you.

@luckypenguin said:

@totally_not_banned said: You forgot the most important non mainstream TLD of all: .cx

I never encountered .cx And by being half russian half ukraninian I know all the warez stuff. During the "good times" it was .biz .info .org

tentor · June 19

@rpqu said:

@rustelekom said:

@luckypenguin said:

@tentor said: Mind name ones who are known to care?

Most won't want to do business with you. Even shady Romanian ones.
Only the russian terrorists still happily peer with networks no matter how dirty the IPs are.

Your statements are full of hatred and racism. A complaint has already been filed against you.

@luckypenguin said:

@totally_not_banned said: You forgot the most important non mainstream TLD of all: .cx

I never encountered .cx And by being half russian half ukraninian I know all the warez stuff. During the "good times" it was .biz .info .org

De-escalating to half racism now

rpqu · June 19

@tentor said:

@rpqu said:

@rustelekom said:

@luckypenguin said:

@tentor said: Mind name ones who are known to care?

Most won't want to do business with you. Even shady Romanian ones.
Only the russian terrorists still happily peer with networks no matter how dirty the IPs are.

Your statements are full of hatred and racism. A complaint has already been filed against you.

@luckypenguin said:

@totally_not_banned said: You forgot the most important non mainstream TLD of all: .cx

I never encountered .cx And by being half russian half ukraninian I know all the warez stuff. During the "good times" it was .biz .info .org

De-escalating to half racism now

LOL.

"If you wish to glimpse inside a human soul and get to know a man, don't bother analyzing his ways of being silent, of talking, of weeping, or seeing how much he is moved by noble ideas; you will get better results if you just watch him laugh. If he laughs well, he's a good man." Fyodor Dostoevsky

rustelekom · June 19

@tentor, @levi, I am more than sure that you have understood my point correctly, and you simply want to hide the LET member's statement, which is clearly racist and hateful, by using irrelevant reasoning. Your attempts are useless, and it's a shame for decent people to defend such participants.

orangevps · June 19

Hi @aluy

I know this is frustrating, but Spamhaus will usually notify you once you're on the Snowshoe list.

I'll share my experience:

CSS Blacklist - usually you won't be notified, you might receive a abuse report from another email service provider like Yahoo, Hotmail, etc.
SBL XBL - This level occurs after your CSS Blacklist has been unresolved for a long time, perhaps 3-7 days (maybe less), and the "bad actors" are sending a large volume of emails.
Snowshoe - The maximum attack level listed, accumulated from a large volume of SBL XBL. This is the maximum level we should be wary of, and they usually don't list your IP directly, for example, a /24. However, let's say your "bad actors" are located around IP range 192.168.1-192.168.9, they will be listed on Snowshoe per /28. Within this range, both your bad actors and your good actors will be listed, resulting in the good neighbors being unable to send email if the recipient enable RBL.

At this Snowshoe level, Spamhaus will begin notifying you via email about abuse of email addresses registered to your IP holder / RDAP. Unfortunately, we haven't experienced this for ASN Drop, and we hope to never be on their list.

To clean up your network, I recommend reviewing IP addresses individually before submitting an appeal to Spamhaus.

There are ongoing attacks occurring within the last 3 hours: https://www.abuseipdb.com/check-block/185.132.53.0/24
Check the broader report: https://www.abuseipdb.com/check/AS211507
Talosintelligence: https://talosintelligence.com/reputation_center/lookup?search=185.132.53.0/24

These three tools should be enough to clean up your network first, and try communicating with your customers.

Next time, don't be traumatized by this incident. If you manage it carefully, you can easily keep all IP addresses safe.

There are a few tools I'd like to suggest after you're succesfuly delisted from ASN Drop. You can use this website to bulk check subnets: https://www.bulkblacklistcheck.com/

Or if you want to do it yourself, Spamhaus actually offers a free query, make sure you install your own DNS (don't forward the DNS request). Simply type:

dig 2.53.132.185.zen.spamhaus.org +short @127.0.0.1
Example results:
127.0.0.2
127.0.0.9

This returned output has multiple meanings: https://www.spamhaus.org/faqs/dnsbl-usage/

As far as I know, since your subnet is listed in their v4 https://www.spamhaus.org/drop/drop_v4.json, you can start communicating this information to your customers if they are using an ISP that uses this Drop ASN to access your network, so they stay safe while you try to resolve this issue.

You can also clean your network, and if you're confident, you can leave it for 3-7 days until the entire network is completely clean. Because even if you're realy sure 100% that you've cleaned your network, Spamhaus and their sensors may still receive reports from various sources. They call this "emission." So, at this level of abuse, please communicate with Spamhaus carefully.

Good luck!

rpqu · June 19

@rustelekom said:
@tentor, @levi, I am more than sure that you have understood my point correctly, and you simply want to hide the LET member's statement, which is clearly racist and hateful, by using irrelevant reasoning. Your attempts are useless, and it's a shame for decent people to defend such participants.

WADR. Just laugh it off because choosing that label is pointless against a state/nation. On what basis it earned the status as a terrorist? Specify the definition and all the nation except the nation with population below 10M qualifies ( technically, those smaller nations were part of larger empire).
So, just 😁. And there's better angle you could play

HostSlick · June 19

@aluy said: And what can I even do now?

Just be patient with them.
Most of time they need ages to reply is because they review if issue persists.
I once waited weeks. But all well, solved.

Hayzee · June 19

On a slightly related note, what are the odds of a nat VPS provider dealing/responding to being listed on Spamhaus/eXploits Blocklist (XBL). Have any of you guys experienced this? I haven't had any issues until now.

Was thinking about making a new post and possibly mentioning the provider but currently waiting to see what happens as I havent got much knowledge on that process.

LEBUserJoe · June 19

@yoursunny said:

@aluy said:

@yoursunny said:
SpamHaus is a mafia.
Since you have blocked the mail ports and won't send mail, you can ignore them altogether.
Your ASN will remain up in their blocklists, but it won't affect you because you don't send mail.

i just dont wanna be listed. it looks bad

Mentally strong people ignore irrelevant blocklists that don't actually cause packet loss.

Facts spamhouse are dog, most blacklists, filters are dog and hurt as much as they solve (Slowly most of the time)

Sad it does affect outbound email as lot of dog services use it as default, that’s the one that hurts. Opensource communtiy likes to provide options, yet all rely on same dog.

tentor · June 19

Any cat filters and services?

mans_xd · June 19

@tentor said:
Any cat filters and services?

@zGato property best cat

tentor · June 19

@mans_xd said:

@tentor said:
Any cat filters and services?

@zGato property best cat

10/10 cat customer

zGato · 9:00AM

@tentor said:

@mans_xd said:

@tentor said:
Any cat filters and services?

@zGato property best cat

10/10 cat customer

Howdy, Stranger!

Categories

In this Discussion

Spamhaus Delisting

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

Spamhaus Delisting

Comments