Login attacks

[Jeff Kinz]

On Tue, Dec 07, 2004 at 06:04:14PM -0800, Rick Stevens wrote:
> Gene Heskett wrote:
> > Another that bears blocking completely is 64.0.0.0/24 as its 100%
> > spam of the non-edible variety.  Ditto for 66.0.0.0/24.
> > 
> > Anybody else have any more to contribute?
> 
> Whoa, buddy.  The entire 64.0.0.0/8 is NOT a spam source.  We have a
> /19 in that space and we're not spammers.

Rick (As usual) has a valid point.

Hotmail is in that range:  
(OK - they may be Korean spammers.... ;-) 
NetRange:   64.4.0.0 - 64.4.63.255 OrgName:    MS Hotmail OrgID:      MSHOTM

XO Communication also in that range: 	
NetRange:   64.0.0.0 - 64.3.255.255 

Pangea in Canada
NetRange:   64.4.64.0 - 64.4.95.255 

"/24" mask blocking hits large chunks.  You may want to do something 
more finely grained.

-- 
Linux/Open Source:  Your infrastructure belongs to you, free, forever.
Idealism:  "Realism applied over a longer time period"
http://www.scaled.com/projects/tierone/
<a href=http://kinz.org>Kinz</a>
http://www.fedoratracker.org http://www.fedorafaq.org
http://www.fedoranews.org
Jeff Kinz, Emergent Research, Hudson, MA.
~
~
~
~