[anti-abuse-wg] Malware/ransomware current live distribution IPs

On Fri, 1 Jul 2016 06:47:16 +0200
<andre at ox.co.za> wrote:
> On Fri, 01 Jul 2016 10:07:46 +0530
> Suresh Ramasubramanian <ops.lists at gmail.com> wrote:
> > On 01/07/16, 10:02 AM, "anti-abuse-wg-bounces at ripe.net on behalf of
> > andre at ox.co.za" <anti-abuse-wg-bounces at ripe.net on behalf of
> > andre at ox.co.za> wrote:
> > > Client host [hostacc.com] blocked using black.uribl.com; 127.0.0.1
> > > -> this "bounce" does not tell the sender how to delist from 
> > > "black.uribl.com" etc.
> > I am not sure why a URL in the 5xx error is not an acceptable
> > substitute for, say, a blog post or a longform New Yorker style
> > essay on who URIBL are, why they’re blocking what’s probably your
> > webhost etc.
> nice is dnsbl.ascams.com - but although 100% accuracy it is
> only a fresh spam list - this is also what the node messages look like
> if you were to get your own dnsbl or dnsbl from dumpspam.com
> 
> have a look at the bounce message & web link
> dig TXT @dnsbl.ascams.com 247.241.106.184.dnsbl.ascams.com
> 
*urgh* one of the dnsbl above whould of course be dnswl :(

then, I realised that not everyone may have BSD or Linux here is an
example bounce: 
;; ANSWER SECTION:
247.241.106.184.dnsbl.ascams.com. 10800 IN TXT  "184.106.241.247
Sending Spam. Listed in SPAM DNSBL see:
https://dnsbl.ascams.com/?c=3094016503"

Andre