Re: Information re: Cyberpromo

[Dalvenjah FoxFire <dalvenjah () dal net>]

Martin J. Hannigan put this into my mailbox:
> Can someone verify that this is the interface facing cyberpromo
> from AGIS?
>
> I called AGIS' NOC and they refused to tell me, so I want to make
> sure I'm cutting just them...
>
>  a0.1.philadelphia1.agis.net (206.185.158.237) 

Well, AGIS appears to be hijacking its own netblocks for CyberPromo, as
it were. I blocked out the CP netblocks, and still got spam from other
netblocks through AGIS. I finally went ahead and blocked this:

# cyberpromo
ALL:    205.199.212. 205.199.4. 206.27.86.210 207.124.161.50
# Cyberpromo through IDCI
ALL:    207.124.161.0/255.255.255.0
# AGIS
ALL:    205.254.160.0/255.255.224.0, 205.137.48.0/255.255.240.0, \
        204.157.0.0/255.255.0.0, 206.84.0.0/255.254.0.0, \
        206.42.0.0/255.254.0.0,  205.198.0.0/255.254.0.0, \
        206.62.0.0/255.255.0.0,  206.148.0.0/255.254.0.0, \
        206.185.0.0/255.255.0.0, 206.249.0.0/255.254.0.0, \
        204.137.128.0/255.255.192.0, 204.137.192.0/255.255.224.0, \
        205.164.64.0/255.255.192.0, 205.164.128.0/255.255.192.0, \
        205.164.192.0/255.255.192.0, 204.130.243., 209.14.0.0/255.255.0.0 \
        207.142.0.0/255.255.0.0

Two months with these filters, and no complaints yet.

-dalvenjah

-- 
 Dalvenjah FoxFire (aka Sven Nielsen)  "Isn't it wrong that there's only
 Founder, the DALnet IRC Network       one company that makes the game
                                       Monopoly?" -Steven Wright
 e-mail: dalvenjah () dal net             WWW: http://www.dal.net/~dalvenjah/
 whois: SN90                           Try DALnet! http://www.dal.net/