Jack Bates wrote:
Actually, Spamhaus is very good at detecting zombies.
Wrong.
The link provided is not strictly hijacked networks, though.
I know that. Here is one example of how good they are in detecting zombies: http://spamhaus.org/SBL/sbl.lasso?query=SBL7583 <quote> zombies hosting24-7.org / hostingonus.com / iohosting.us / tiethepen.com (zombie?) 193.231.248.0/24 is listed on the Register Of Known Spam Operations (ROKSO) database as being assigned to, under the control of, or providing service to a known spam operation run by zombies. Please see the ROKSO spam records for zombies </quote> And look at the whois it shows its a assignment SWIP'd to a spammer by an ISP. Yeah, I'm sure that thats a zombie. inetnum: 193.231.248.0 - 193.231.248.255 netname: SC-PRO-SYS-SRL descr: SC PRO SYS SRL descr: Pache Protopopescu 108 descr: sector 2 Bucharest country: ro admin-c: SSC100-RIPE tech-c: SSC100-RIPE status: ASSIGNED PA mnt-by: AS3233-MNT mnt-lower: AS3233-MNT mnt-routes: WEBONLINE notify: hostmaster@rnc.ro changed: hostmaster@rnc.ro 20030410 source: RIPE inetnum: 193.231.0.0 - 193.231.255.255 netname: RO-RNC-970804 descr: Local Registry for Europanet customers descr: RO general country: RO admin-c: ES16 tech-c: ES16 status: ALLOCATED PA mnt-by: RIPE-NCC-HM-MNT mnt-lower: AS3233-MNT mnt-routes: AS3233-MNT changed: GeertJan.deGroot@ripe.net 19941230 changed: hostmaster@ripe.net 19960207 changed: hostmaster@ripe.net 19970804 changed: hostmaster@ripe.net 19990504 changed: hostmaster@ripe.net 19990506 changed: hostmaster@ripe.net 20000303 changed: hostmaster@ripe.net 20000313 changed: hostmaster@ripe.net 20001130 changed: lir-help@ripe.net 20020109 source: RIPE