Is IPv4 Space REALLY in short supply? Spammer

Maybe it just is not being used for the right purposes..

Last night we looked at our logs and tracking and noticed a new prolific spammer.

Those of us in the industry to realize that there has been a very large increase of Brazilian spam sources, out to make money by spamming, most of it on legitimate hosting companies, and often located right here in North American data centers.  Not to pick on the Brazilians, even emerging countries are getting into this simple way to make money by spamming.

And while it is up to the hosting companies to monitor their own networks, when you see a large block of IPv4 space all of a sudden being used to spam the Internet you have to wonder, how did they get that space, when more ‘legitimate’ companies have trouble getting some.

Today, we are looking at a full /19 that should be on all spam auditors radar.  That is over 8000 IP(s) that could be used to attack your customers in-boxes.

 inetnum: 179.61.224/19
 status: reallocated
 owner: HOST1PLUS hosting services. Brazil.
 ownerid: BR-HHSB-LACNIC
 responsible: Felipe Ernst
 address: Alameda Araguaia, 3641, Barueri
 address: 06455-000 - Tambor� Barueri - SP
 country: BR
 phone: +56 226 382322 []
 owner-c: VIG28
 tech-c: VIG28
 abuse-c: VIG28
 inetrev: 179.61.224/22
 nsstat: 20160626 AA
 nslastaa: 20160626
 nsstat: 20160626 AA
 nslastaa: 20160626
 created: 20140207
 changed: 20140207
 inetnum-up: 179.61.128/17


It looks like they managed to get it from Chilean provider, and there is some further re-allocation, to ‘’.

Let’s quickly look at some of the naming conventions, that are on that network. domain name pointer domain name pointer domain name pointer domain name pointer domain name pointer domain name pointer domain name pointer domain name pointer domain name pointer domain name pointer domain name pointer domain name pointer

Actually, the whole Class C, as well as the other ones above it, all have these throwaway domains, and naming conventions.. So, does that mean they are bad by itself?             16             13             13             12             15             14             15            13            13            13            15            13            13            14            14            13            14            15            15            13            12            14            14            13            11            15            15

Ah.. yes.. Seems lots of ISP’s reported being under attack by this range last night.  We can assume that if they are using everything from the first IP up, probably the intent is to use the rest of the ranges tomorrow.

Well, actually it isn’t the full /19 but the /22 that is used for this.  Was this a case where the provider was ‘fooled’ into renting/delegating this space to this spammer? Or was this a business decision? Or was it simply to prove ‘usage’? If the person who owns the /19 doesn’t have a  use for it, should it go back to the pool of available IP addresses?

This of course is a controversial subject, even ARIN is currently discussing how to prevent ‘speculators’ picking up IP Space, without a real need.

In the mean time, this operator can make a lot of money, and be quite disruptive to the internet, in just a short period.  And there is a line of spammers who are looking to rent blocks of IP(s) solely for the purpose of spam.

Do we have an answer? No, but of course if that’s what they want to do with the IP Space, us spam auditors can be a lot more aggressive in deciding to simply ‘flag’ that space as dirty.

This entry was posted in Informative, Uncategorized and tagged , , , , , . Bookmark the permalink.

Leave a Reply