Re: [afnog] Suspicious request for IP address space

[Tom Hill <tom () ninjabadger net>]

On Tue, 2011-03-08 at 10:36 -0500, Jon Lewis wrote:
> Odds are, they're looking for a willing host for a snowshoe spamming 
> operation.  If I wanted space for something like that, Afrinic region 
> providers would not be my first choice...particularly for the
> hosting. 
> AFAIK, there are numerous LIRs in the RIPE region, particularly
> Romania 
> who are more than happy to lease large blocks of IPv4 to anyone for
> any 
> purpose.

Indeed. However, and I too get similar requests (not quite as big,
but /24's and /23's etc.)

The first thing I do is search for their "name" and domain they're
e-mailling from, with the term 'ROKSO' behind it.

50% of the time you find a reference to the domain or their name in
Spamhaus' ROKSO list.

The other 50% of the time you find someone that isn't in there, but
really should be...

Tom