1. Forum
  2. Usenet
  3. NEWS.ADMIN.NET-ABUSE.EMAI

  • Spamcop-Top200 Weekly 2021-12-31 : RU(24:613_744); AS10429/BR(35:428_60

    From A. Filip@21:1/5 to All on Fri Dec 31 09:45:43 2021
    Spamcop.net Top200 source: https://www.spamcop.net/hoshame.shtml
    IPv4 reports for the week ending 2021-12-31T09:45:43+00:00
    IPv6 reports for the week ending 2021-12-31T09:45:44+00:00
    IP address to country and ASN mapping by whois.cymru.com
    Stats generated for 200 IPv4 addresses and 1 IPv6 adresses
    Cutoff at Spamcop.net 200:IPv4 : 5188 reports
    Spamcop.net 1:IPv6 : 10709 reports

    #### Top entries with reports count
    #### [Top-IP: Top 10 IPv4&IPv6 + Top 1 IPv6 + DNSWL listed]
    #No. Reports Age AS IP_Address
    1. 1:IPv4 220_291 42 hours TW AS4780 175.181.186.238
    2. 2:IPv4 189_716 2.7 days RU AS12389 77.40.91.69
    3. 3:IPv4 61_764 3 hours SE AS2119/NO 85.224.174.245
    4. 4:IPv4 46_137 2 hours RU AS39593 136.169.210.223
    5. 5:IPv4 43_989 2 hours US AS8075 20.206.96.201
    6. 6:IPv4 38_685 3 hours US AS20473 95.179.207.63
    7. 7:IPv4 37_581 4.4 days CN AS9808 223.73.146.190
    8. 8:IPv4 35_768 4 hours DE AS58329 31.214.157.36
    9. 9:IPv4 33_107 3 hours KR AS17858 125.251.116.4
    10. 10:IPv4 32_462 3 hours BR AS10429 201.28.135.246
    34. 34:IPv4 18_451 3 hours US AS15169 209.85.220.41
    https://dnswl.org/s/?s=209.85.220.41 Trust=none google.com
    80. 80:IPv4 12_432 4 hours US AS15169 209.85.220.65
    https://dnswl.org/s/?s=209.85.220.65 Trust=none google.com
    101. 1:IPv6 10_709 2 hours FR AS16276 2001:41d0:8:c5b3:0:0:0:0
    201. 200:IPv4 5_188 - - -
    2_150_761 - - *

    #### Entries and reports count by AS
    #### [Top-AS: Top 10 ASes + listed in Top-IP]
    #No. Reports AS_name_and_country
    1. AS10429 35 428_600 TELEFONICA BRASIL S.A, BR
    [Top-IP:10]
    2. AS12389 6 305_888 ROSTELECOM-AS, RU
    [Top-IP:2]
    3. AS4780 1 220_291 SEEDNET Digital United Inc., TW
    [Top-IP:1]
    4. AS2119 3 104_057 TELENOR-NEXTEL Telenor Norge AS, NO
    [Top-IP:3]
    5. AS39593 3 90_333 ML-AS, RU
    [Top-IP:4]
    6. AS45382 4 57_050 EHOSTIDC-AS-KR EHOSTICT, KR
    7. AS8075 2 53_662 MICROSOFT-CORP-MSN-AS-BLOCK, US
    [Top-IP:5]
    8. AS28787 2 41_959 BAKINTER-AS Bakinternet ISP, Azerbaijan, AZ
    9. AS35900 2 41_016 DIGI-BDS-ASN, BB
    10. AS18881 5 40_123 TELEFONICA BRASIL S.A, BR
    11. AS20473 1 38_685 AS-CHOOPA, US
    [Top-IP:6]
    12. AS9808 1 37_581 CMNET-GD Guangdong Mobile Communication
    Co.Ltd., CN
    [Top-IP:7]
    13. AS58329 1 35_768 RACKPLACE, DE
    [Top-IP:8]
    14. AS17858 1 33_107 POWERVIS-AS-KR LG POWERCOMM, KR
    [Top-IP:9]
    16. AS15169 2 30_883 GOOGLE, US
    [Top-IP:34(dnswl-none),80(dnswl-none)]
    18. AS16276 2 28_392 OVH, FR
    [Top-IP:101(1:IPv6)]
    121. - 1 5_188 -
    * 129 1_344_458

    #### Entries and reports count by country
    #### [Top-Country: Top 5 countries + listed in Top-IP + listed in Top-AS]
    #No. Reports ASes_with_stats
    1. RU 24 613_744 AS12389(6:305_888) AS39593(3:90_333)
    AS31133(4:29_281) AS20485(1:27_769)
    AS50556(1:24_568) AS42610(1:20_129)
    AS210240(1:18_699) AS35401(1:17_142)
    AS44812(1:16_786) AS48371(1:15_051)
    AS12714(1:14_514) AS8369(1:14_312)
    AS198541(1:13_089) AS31200(1:6_183)
    [Top-IP:2,4 + Top-AS:2,5]
    -. eu 34 524_732 SE(8:162_383) DE(3:68_592) BG(5:66_053)
    DK(3:40_739) CZ(2:36_928) NL(2:34_785) FR(3:34_318)
    BE(2:22_208) RO(2:19_820) AT(1:19_532) PL(1:7_549)
    ES(1:6_178) SI(1:5_647)
    [Top-IP:3,8,101(1:IPv6)]
    2. BR 43 486_835 AS10429(35:428_600) AS18881(5:40_123)
    AS22177(1:6_047) AS16735(1:6_042) AS269168(1:6_023)
    [Top-IP:10 + Top-AS:1,10]
    3. US 25 289_153 AS8075(2:53_662) AS20473(1:38_685)
    AS15169(2:30_883) AS6128(2:18_886)
    AS20115(2:18_015) AS7018(1:17_722)
    AS14061(1:15_165) AS16591(2:12_303)
    AS11776(2:10_819) AS40285(1:9_676) AS7922(1:8_452)
    AS7459(1:7_982) AS11427(1:7_791) AS19108(1:7_715)
    AS33363(1:7_067) AS12083(1:6_960) AS11272(1:6_278)
    AS4922(1:5_853) AS14638(1:5_239)
    [Top-IP:5,6,34(dnswl-none),80(dnswl-none) +
    Top-AS:7]
    4. TW 2 227_831 AS4780(1:220_291) AS3462(1:7_540)
    [Top-IP:1 + Top-AS:3]
    5. SE 8 162_383 AS2119/NO(3:104_057) AS39651(2:23_000)
    AS45011(1:18_404) AS8473(2:16_922)
    [Top-IP:3]
    6. KR 9 115_491 AS45382(4:57_050) AS17858(1:33_107)
    AS4766(4:25_334)
    [Top-IP:9 + Top-AS:6]
    7. NO 4 112_824 AS2119(3:104_057) AS8473/SE(1:8_767)
    [Top-IP:3 + Top-AS:4]
    9. DE 3 68_592 AS58329(1:35_768) AS3320(1:20_960)
    AS51167(1:11_864)
    [Top-IP:8]
    11. AZ 4 59_274 AS28787(2:41_959) AS29049(2:17_315)
    [Top-AS:8]
    12. CN 2 47_241 AS9808(1:37_581) AS4837(1:9_660)
    [Top-IP:7]
    13. BB 2 41_016 AS35900(2:41_016)
    [Top-AS:9]
    17. FR 3 34_318 AS16276(2:28_392) AS12322(1:5_926)
    [Top-IP:101(1:IPv6)]
    57. - 1 5_638 -

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From The Doctor@21:1/5 to All on Fri Dec 31 14:22:09 2021
    I wonder how I can set up my spam box as honeypots for spamcop?
    --
    Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
    Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
    Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b Merry Christmas 2021 and Happy New Year 2022 Beware https://mindspring.com

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From David Ritz@21:1/5 to The Doctor on Fri Dec 31 14:08:02 2021
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    On Friday, 31 December 2021 14:22 -0000,
    in article <sqn3mh$1fmd$58@gallifrey.nk.ca>,
    The Doctor <doctor@doctor.nl2k.ab.ca> wrote:

    I wonder how I can set up my spam box as honeypots for spamcop?

    Start here: https://www.spamcop.net/

    Do note, one still needs to manually intervene for each and every
    email you submit. Submissions are not script friendly.

    - --
    David Ritz <dritz@mindspring.com>
    "There will be more spam." -- Paul Vixie

    -----BEGIN PGP SIGNATURE-----

    iF0EARECAB0WIQSc0FU3XAVGYDjSGUhSvCmZGhLe6wUCYc9jIgAKCRBSvCmZGhLe 63PrAJ9GevfwDwj/dVgMXmRnrwTixMr5agCgn3I5ZjmeaKrHH6iPUGlZ0/5gteY=
    =+WM8
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andrzej Adam Filip@21:1/5 to David Ritz on Sat Jan 1 09:36:48 2022
    David Ritz <dritz@mindspring.com> wrote:
    On Friday, 31 December 2021 14:22 -0000,
    in article <sqn3mh$1fmd$58@gallifrey.nk.ca>,
    The Doctor <doctor@doctor.nl2k.ab.ca> wrote:

    I wonder how I can set up my spam box as honeypots for spamcop?

    Start here: https://www.spamcop.net/

    Do note, one still needs to manually intervene for each and every
    email you submit. Submissions are not script friendly.

    AFAIK standard recommendation for "nos own scripting" is to
    a) use spamassassin spamcop plugin to submit spam to spamcop.net via SMTP
    b) use perl modules/scripts to complete retorting
    WWW::Mechanize::Scpamcop [A] or spamcup [B]
    *WARNING:* Spamcop.net DOES not support submitting spam via encrypted
    SMTP connections

    I personally use my own perl script (250 lines of "naked" code) to
    a) submit spam *via https*
    b) complete reporting *via https* after a few minutes
    [ to avoid over optimistic estimates of "should be ready"]
    The second phase using "per single" spam links gathered in the first
    phase - it avoids sporadic problem with processing "one by one" in
    uncopleted chain
    Is anybody here interested in being beta tester or joining development
    and maintenance of the public version?

    [A] https://metacpan.org/pod/WWW::Mechanize::SpamCo
    [B] https://metacpan.org/dist/App-SpamcupNG/view/bin/spamcup

    --
    A. Filip

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andrzej Adam Filip@21:1/5 to The Doctor on Sat Jan 1 09:44:24 2022
    doctor@doctor.nl2k.ab.ca (The Doctor) wrote:
    I wonder how I can set up my spam box as honeypots for spamcop?

    Which OS do you use? [Which free SMTP server do you use/prefer?]

    Which part need clarification:
    a) configuring catch-all (email addresses) email domain in SMTP server
    b) advertising spamtrap email addresses
    c) *automatic* reporting to spamcop

    Full version may be a too long story for usenet post.

    How to create a complicated thing? Put together enough simple things :-)

    --
    A. Filip

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From The Doctor@21:1/5 to anfi@onet.eu on Sat Jan 1 14:34:59 2022
    In article <anfi+ttk1gumzff-m116@wp.eu>,
    Andrzej Adam Filip <anfi@onet.eu> wrote:
    doctor@doctor.nl2k.ab.ca (The Doctor) wrote:
    I wonder how I can set up my spam box as honeypots for spamcop?

    Which OS do you use? [Which free SMTP server do you use/prefer?]

    FreeBSD / exim


    Which part need clarification:
    a) configuring catch-all (email addresses) email domain in SMTP server
    b) advertising spamtrap email addresses
    c) *automatic* reporting to spamcop

    Full version may be a too long story for usenet post.

    How to create a complicated thing? Put together enough simple things :-)


    All right, I do habve a Mb designated for spam in mbox format.

    --
    A. Filip


    --
    Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
    Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
    Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b Merry Christmas 2021 and Happy New Year 2022 Beware https://mindspring.com

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From The Doctor@21:1/5 to anfi@onet.eu on Sat Jan 1 14:33:32 2022
    In article <anfi+jjl2swkbjf-m116@wp.eu>,
    Andrzej Adam Filip <anfi@onet.eu> wrote:
    David Ritz <dritz@mindspring.com> wrote:
    On Friday, 31 December 2021 14:22 -0000,
    in article <sqn3mh$1fmd$58@gallifrey.nk.ca>,
    The Doctor <doctor@doctor.nl2k.ab.ca> wrote:

    I wonder how I can set up my spam box as honeypots for spamcop?

    Start here: https://www.spamcop.net/

    Do note, one still needs to manually intervene for each and every
    email you submit. Submissions are not script friendly.

    AFAIK standard recommendation for "nos own scripting" is to
    a) use spamassassin spamcop plugin to submit spam to spamcop.net via SMTP

    Need to get this one!!

    b) use perl modules/scripts to complete retorting
    WWW::Mechanize::Scpamcop [A] or spamcup [B]
    *WARNING:* Spamcop.net DOES not support submitting spam via encrypted
    SMTP connections

    I personally use my own perl script (250 lines of "naked" code) to
    a) submit spam *via https*
    b) complete reporting *via https* after a few minutes
    [ to avoid over optimistic estimates of "should be ready"]
    The second phase using "per single" spam links gathered in the first
    phase - it avoids sporadic problem with processing "one by one" in
    uncopleted chain
    Is anybody here interested in being beta tester or joining development
    and maintenance of the public version?

    [A] https://metacpan.org/pod/WWW::Mechanize::SpamCo
    [B] https://metacpan.org/dist/App-SpamcupNG/view/bin/spamcup

    --
    A. Filip


    --
    Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca
    Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
    Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b Merry Christmas 2021 and Happy New Year 2022 Beware https://mindspring.com

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)