There aren't many sites in this block, and they are almost all either in 62.122.73.0/24 and 62.122.75.0/24 (but blocking the /21 is safer).. but the vast majority of sites are rated deep red at MyWOT (a full list of sites and ratings can be downloaded here).
Who owns the block? The RIPE WHOIS details are:
inetnum: 62.122.72.0 - 62.122.79.255
netname: RELNET-NET
descr: "Leksim" Ltd.
country: EU
remarks: trouble: spam/scam/abuse issues send *ONLY* to: abuse@rel-net.eu
org: ORG-TA388-RIPE
admin-c: JT384-RIPE
tech-c: BS594-RIPE
tech-c: MR10655-RIPE
status: ASSIGNED PI
mnt-by: RELNET
mnt-by: RIPE-NCC-END-MNT
mnt-lower: RIPE-NCC-END-MNT
mnt-routes: RELNET
mnt-domains: RELNET
source: RIPE # Filtered
mnt-routes: ROOT-MNT
organisation: ORG-TA388-RIPE
org-name: "Leksim" Ltd.
org-type: OTHER
address: Stationsplein 30, 2910 MJ Capelle aan den IJssel, The Netherlands
phone: +31 10 2391391
fax-no: +31 10 2391392
admin-c: JT384-RIPE
tech-c: BS594-RIPE
mnt-ref: RELNET
mnt-by: RELNET
source: RIPE # Filtered
person: Justin Thomson
address: Stationsplein 30
address: 2910 MJ Capelle aan den IJssel
address: THE NETHERLANDS
abuse-mailbox: abuse@rel-net.eu
mnt-by: RELNET
phone: +31 10 2391391
nic-hdl: JT384-RIPE
source: RIPE # Filtered
person: Bernd Spiess
address: Gabelsberger Strasse 15
address: 9021 Klagenfurt
address: AUSTRIA
mnt-by: RELNET
phone: +43 46 3223501
nic-hdl: BS594-RIPE
source: RIPE # Filtered
person: Marcel Russo
address: 31, z.a. am Bann
address: L-3375 Leudelange
address: LUXEMBURG
mnt-by: RELNET
phone: + 352 2551301
nic-hdl: MR10655-RIPE
source: RIPE # Filtered
But is this "Leksim Ltd" or Relnet? Relnet's contact details (for rel-net.eu, relnet.eu, relnet.hu) are very different:
domain: relnet.hu
registrant: Relnet Technologia Ltd.
registrant: Relnet Technológia Kft.
tech-c: Dávid András
address: Véső 7
address: 1133 Budapest
address: HU
phone: 06-70-452-4603
fax-no: 06-1-350-1355
e-mail: hostmaster@relnet.hu
hun-id: 2000466058
registrant: Relnet Technologia Ltd.
registrant: Relnet Technológia Kft.
tech-c: Dávid András
address: Véső 7
address: 1133 Budapest
address: HU
phone: 06-70-452-4603
fax-no: 06-1-350-1355
e-mail: hostmaster@relnet.hu
hun-id: 2000466058
If you Google the first three names you get some very telling results.
Blocking the /21 is probably the best idea. I can identify the following domains in this block in case you want to block by domain name, or for more detail download the CSV version.
abussgf.com
adnologi.com
apicurl.com
asherhiftn.com
banner-count.com
belliali.com
best-figure.com
biznage.com
blank-record.com
cahodofo.com
chethole.com
clckil.com
clckli.com
cr0zybaner.com
cr0zybanner.com
croozybannir.com
crozybannir.com
data-saver.org
denizab.com
dhfodminmont.com
eleophy.com
fathone.com
fr0udsafetycheck0n.com
goodse.org
gredigns.com
gulderpoin.com
ineloitond.com
kicksho.com
krasivoe-telo.com
lineacount.info
lineweather.com
livesecpayment.com
livesecsuite.com
live-sec-suite.com
live-security-suite.com
liveslicense.com
livespayment.com
livessupport.com
lkckclckli1i.com
lsspayment.com
lsssupport.com
luffer.info
majusef.com
maketh.info
minteddi.com
mizaterp.com
monitor-info.com
mypersonalhttp.com
nonepersonal.com
nuensmidts.com
onlinedietolog.net
osago-msk.com
perleme.com
pinokolder.com
sileeber.com
spy-soft.org
tangoing.info
telemarker.ru
thestopbadware.com
thyrogl.com
tinnily.info
uatwdminmont.com
umogultvon.com
unmarine.info
virtepgulm.com
vkontacte.org
vkontakle.net
warwork.info
w-opay.com
w-optim.com
wovens.info
yafraudcheckonline.com
yledmanager.com
zblvdminmont.com
zumugolter.com
1 comment:
I'm also seeing spam from AS5577's 94.242.192.0/18.
Post a Comment