Re: Announcing a reserved ASN?

[Dave Pooser <dave.nanog () alfordmedia com>]

On 2/3/13 9:04 AM, "Rich Kulawiec" <rsk () gsp org> wrote:

> On Sun, Feb 03, 2013 at 06:12:32PM +0530, Suresh Ramasubramanian wrote:
> > AS23456 is currently announcing a good few netblocks (which don't have a
> > very good smtp reputation, by the way).
>
> To say the least.  A quick rDNS scan reveals that those netblocks include:
>
>       8448  addresses
>       6932  return nxdomain
>       512   return servfail
>       1004  with rDNS entries
>
> Those 1004 hosts with rDNS account for 36 domains:

<snip long list of spammy domains>

Just as another data point, the domain names you listed hit on enough URL
blacklists that Spamassassin quarantined the message for me (and would
have rejected it during the SMTP transaction had the NANOG server not been
listed on DNSWL-High). Spam hosts plus fake ASN = paging the Spamhaus DROP
maintainers to the white courtesy phone....
-- 
Dave Pooser
Manager of Information Services
Alford Media  http://www.alfordmedia.com