-----Original Message----- From: anti-abuse-wg-bounces@ripe.net [mailto:anti-abuse-wg- bounces@ripe.net] On Behalf Of Thor Kottelin Sent: Wednesday, August 29, 2012 3:44 PM To: anti-abuse-wg@ripe.net
-----Original Message----- From: anti-abuse-wg-bounces@ripe.net [mailto:anti-abuse-wg- bounces@ripe.net] On Behalf Of Reza Farzan Sent: Wednesday, August 29, 2012 3:26 PM To: anti-abuse-wg@ripe.net Cc: info@vacancesloisirs.fr
Based on my rudimentary research, the spamvertised website "vacancesloisirs.fr" resides on this IP address: 193.238.229.26 which belongs to Hostway in Germany:
inetnum: 193.238.228.0 - 193.238.231.255
netname: HOSTWAY-1
descr: Hostway Deutschland GmbH
Their NOC, however, denies that the IP is theirs, and they are not responsible for this domain.
The sites vacancesloisirs.fr and www.vacancesloisirs.fr are clearly live on 193.238.229.26, i.e. on the Hostway Deutschland GmbH network you mention. Spam support providers often lie.
PS. That IP address has been on Spamhaus' SBL blacklist for more than two weeks now: http://www.spamhaus.org/sbl/query/SBL150849. This makes it particularly difficult to believe that the provider would be unaware of the problem. -- Thor Kottelin http://www.anta.net/