spamgourmet on SPEWS

[josh]

SPEWS decided to black out large blocks of IP addresses managed by Hurricane Electric (sg's hosting provider), and the sg mail server is in one of these blocks.

If you're having trouble receiving mail through spamgourmet, find out if your hosting provider uses SPEWS, and if so, get them to unblock the IP address 216.218.230.146. We have complete control over this IP address, and we don't send spam.

Spamgourmet's confirmation and password reset emails come from a different server 216.218.159.210 - we do not have complete control over this one.

Please note that no one is saying that spam is coming from spamgourmet servers -- it is merely a victim (as, it would appear, are several other non-spamming services) of collateral damage caused by a fairly broad-brushed action on the part of SPEWS.

Personally, I'm not going to burn too many calories on this one.


Here's their "evidence":





Hurricane Electric
|--------------------
1, 216.218.128.0 - 216.218.132.255, Hurricane Electric
2, 216.218.128.0 - 216.218.191.255, Hurricane Electric
2, 216.218.186.0 - 216.218.187.255, Hurricane Electric
2, 216.218.192.0 - 216.218.255.255, Hurricane Electric
2, 64.62.128.0 - 64.62.191.255, Hurricane Electric
2, 64.71.128.0 - 64.71.191.255, Hurricane Electric
2, 65.19.128.0 - 65.19.143.255, Hurricane Electric
2, 66.220.0.0 - 66.220.31.255, Hurricane Electric
2, 209.51.160.0 - 209.51.191.25, Hurricane Electric
2, 216.66.0.0 - 216.66.95.255, Hurricane Electric
---------------------|

Spammer tolerant hosting.

Ignore or don't comprehend reports of abuse. The "Internetco Communications / iMedia Networks"
spam house being a prime example.

Also: <http://www.blackholes.us/zones/isp/he.txt>
<http://groups.google.com/groups?selm=selectrum-9C7B19.01183901012004%40news.videotron.net>

===================================================
Did this place get bought by spammer Quang Dangtran ?!
Hosted sites and full feed to his "Whoa USA Inc" /20 ?!

1, 64.62.236.182, Quang Dangtran / calajean.biz
1, 64.62.236.187, Quang Dangtran / "AJimports5"
1, 64.62.236.160/27, Quang Dangtran / calajean.biz / "AJimports5" / 1800medstoday.biz (he.net)
1, 64.62.236.0/24, he.net (Quang Dangtran / calajean.biz / "AJimports5" / 1800medstoday.biz)
1, 64.62.233.0 - 64.62.239.255, he.net (Quang Dangtran / calajean.biz / "AJimports5" / 1800medstoday.biz)
1, 64.71.148.0/27, Quang Dangtran / calajean.biz / "AJimports5" / 1800medstoday.biz (he.net)
1, 64.71.148.0/24, he.net (Quang Dangtran / calajean.biz / "AJimports5" / 1800medstoday.biz)
1, 211.162.110.184, Quang Dangtran / a.1800medstoday.biz
1, 211.162.110.0 - 211.162.110.255, gwbn.net.cn (Quang Dangtran / 1800medstoday.biz)
1, 69.67.67.3, Quang Dangtran / fahawn.com / poiuytrewq03.com
1, 69.67.67.3, Quang Dangtran / fahawn.com / poiuytrewq03.com
1, 69.67.64.0/20, Quang Dangtran / OASISVN.COM / Whoa USA Inc

=========================================
Hosting clickMAN/servergod spam house:
<http://www.cidr-report.org/cgi-bin/as-report?as=as26824>
<http://spews.org/html/S822.html>

AS6939 (he.net) => AS26824 (CLICKMAN.COM)
===================================================
Hurricane Electric HURRICANE-1 (NET-216-218-128-0-1) 216.218.128.0 - 216.218.255.255
Hurricane Electric HURRICANE-DC0012-2769 (NET-216-218-130-128-1) 216.218.130.128 - 216.218.130.135
Hurricane Electric HURRICANE-DC0012-031 (NET-216-218-192-240-1) 216.218.192.240 - 216.218.192.255
Hurricane Electric HURRICANE-DC0043-131 (NET-216-218-229-80-1) 216.218.229.80 - 216.218.229.95
Hurricane Electric HURRICANE-DC0043-151 (NET-216-218-158-16-1) 216.218.158.16 - 216.218.158.31
Hurricane Electric HURRICANE-DC0013-2 (NET-216-218-130-136-1) 216.218.130.136 - 216.218.130.143
Hurricane Electric HURRICANE-4 (NET-64-62-128-0-1) 64.62.128.0 - 64.62.191.255
Hurricane Electric HURRICANE-2 (NET-64-71-128-0-1) 64.71.128.0 - 64.71.191.255
Hurricane Electric HURRICANE-DC0012-151 (NET-64-71-191-56-1) 64.71.191.56 - 64.71.191.63
Hurricane Electric HURRICANE-4 (NET-65-19-128-0-1) 65.19.128.0 - 65.19.143.255
Hurricane Electric HURRICANE-3 (NET-66-220-0-0-1) 66.220.0.0 - 66.220.31.255
Hurricane Electric HURRICANE-DC0012-262 (NET-66-220-4-240-1) 66.220.4.240 - 66.220.4.255
Hurricane Electric HURRICANE-5 (NET-209-51-160-0-1) 209.51.160.0 - 209.51.191.255
Hurricane Electric HURRICANE-6 (NET-216-66-0-0-1) 216.66.0.0 - 216.66.95.255
Hurricane Electric HURRICANE-IPV6-NET (HURRICANE-IPV6) 2001:0470:0000:0000:0000:0000:0000:0000 - 2001:0470:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF
===================================================
Sadly, from a posting:
----------------------

Goodguys...

64.71.163.204/32 freedb.org
64.71.181.105/24 imageevent.com
64.71.184.48/28 insecure.org
216.218.240.104/32 midiwall.com
================
64.71.143.224 - 64.71.143.255 electricrain.com
================
$ host ns3.dyndns.org
ns3.dyndns.org. has address 64.71.191.26
$ host ns3.mydyndns.org
ns3.mydyndns.org. has address 64.71.191.27
$ whois 64.71.191.27
Hurricane Electric HURRICANE-2 (NET-64-71-128-0-1)
64.71.128.0 - 64.71.191.255
Netwyred LLC HURRICANE-CE0313-0B1 (NET-64-71-191-24-1)
64.71.191.24 - 64.71.191.31
================
$ host txgreens.org
txgreens.org. has address 216.218.174.139
$ host -t mx txgreens.org
txgreens.org. mail is handled by 1 eagle.he.net.
$ host eagle.he.net.
eagle.he.net. has address 216.218.174.2
$ whois 216.218.174.139
OrgName: Hurricane Electric
NetRange: 216.218.128.0 - 216.218.255.255
CIDR: 216.218.128.0/17
================
KeenSpace inhabits 64.71.165.128 to .192, but not for too long. We'll
(KeenSpot Entertainment, who owns KeenSpace) are moving out (we already
moved out all of KeenSpot itself). Give us a month or so.
================
Graham Freeman <graham@calteg.org>
My IPs:
64.71.176.39
64.71.176.40
64.71.176.41
================
Unfortunately pobox.com operates out of:

Hurricane Electric HURRICANE-2 (NET-64-71-128-0-1)
64.71.128.0 - 64.71.191.255
I C Group HURRICANE-CE0482-181 (NET-64-71-166-112-1)
64.71.166.112 - 64.71.166.127
================

[Fred Mora]

Josh,

Abandonning all pride, I took the liberty of begging for delistingon behalf of SG. The newsgroup recommended by SPEWS for grovelling is news.admin.net-abuse.blocklisting. So I wrote:


Subject: SPEWS: S2100 - antispam site SpamGourmet caught in a listed range! Please delist
NNTP-Posting-Host: 129.44.121.20
Message-ID: <630e8d44.0401201005.dcb7750@posting.google.com>

Hello,

I noticed that the antispam site SpamGourmet was caught in S2100. The
listing says:

--- snip ---
Hurricane Electric
|--------------------
1, 216.218.128.0 - 216.218.132.255, Hurricane Electric
2, 216.218.128.0 - 216.218.191.255, Hurricane Electric
2, 216.218.186.0 - 216.218.187.255, Hurricane Electric
2, 216.218.192.0 - 216.218.255.255, Hurricane Electric
2, 64.62.128.0 - 64.62.191.255, Hurricane Electric
2, 64.71.128.0 - 64.71.191.255, Hurricane Electric
2, 65.19.128.0 - 65.19.143.255, Hurricane Electric
2, 66.220.0.0 - 66.220.31.255, Hurricane Electric
2, 209.51.160.0 - 209.51.191.25, Hurricane Electric
2, 216.66.0.0 - 216.66.95.255, Hurricane Electric
---------------------|

Spammer tolerant hosting.

Ignore or don't comprehend reports of abuse. The "Internetco
Communications / iMedia Networks"
spam house being a prime example.
--- snip ---

The range 216.218.192.0 - 216.218.255.255 includes IP 216.218.230.146 (gourmet.spamgourmet.com), which is the mail server of SpamGourmet.com, a free, antispam tool (disposable addresses - go take a look). SpamGourmet is the only user of this machine and while we receive (and delete) a lot of spam, we don't send any.

Also, this address isn't shared with any other host (not a virtual
hosting IP), so it really shouldn't be blocked:


nslookup 216.218.230.146
Non-authoritative answer:
146.230.218.216.in-addr.arpa name = gourmet.spamgourmet.com.

Authoritative answers can be found from:
230.218.216.in-addr.arpa nameserver = ns3.he.net.
230.218.216.in-addr.arpa nameserver = ns1.he.net.
230.218.216.in-addr.arpa nameserver = ns2.he.net.


Please delist spamgourmet. Heck, we're on the same side!

Thanks,

--Fred Mora

[vellire]

Fred,

SPEWS strikes me as fascist and self-congratulatory. I applaud your effort, but I wouldn't be surprised if you're flamed pretty hard core.

-V

[SysKoll]

When it comes to spam, fascist is good. What I dislike is irresponsiveness. What we need is an eloquent fascist.

[vellire]

A non-authoritarian spam regime. :)