Martin J. Hannigan put this into my mailbox:
Can someone verify that this is the interface facing cyberpromo from AGIS?
I called AGIS' NOC and they refused to tell me, so I want to make sure I'm cutting just them...
a0.1.philadelphia1.agis.net (206.185.158.237)
Well, AGIS appears to be hijacking its own netblocks for CyberPromo, as it were. I blocked out the CP netblocks, and still got spam from other netblocks through AGIS. I finally went ahead and blocked this: # cyberpromo ALL: 205.199.212. 205.199.4. 206.27.86.210 207.124.161.50 # Cyberpromo through IDCI ALL: 207.124.161.0/255.255.255.0 # AGIS ALL: 205.254.160.0/255.255.224.0, 205.137.48.0/255.255.240.0, \ 204.157.0.0/255.255.0.0, 206.84.0.0/255.254.0.0, \ 206.42.0.0/255.254.0.0, 205.198.0.0/255.254.0.0, \ 206.62.0.0/255.255.0.0, 206.148.0.0/255.254.0.0, \ 206.185.0.0/255.255.0.0, 206.249.0.0/255.254.0.0, \ 204.137.128.0/255.255.192.0, 204.137.192.0/255.255.224.0, \ 205.164.64.0/255.255.192.0, 205.164.128.0/255.255.192.0, \ 205.164.192.0/255.255.192.0, 204.130.243., 209.14.0.0/255.255.0.0 \ 207.142.0.0/255.255.0.0 Two months with these filters, and no complaints yet. -dalvenjah -- Dalvenjah FoxFire (aka Sven Nielsen) "Isn't it wrong that there's only Founder, the DALnet IRC Network one company that makes the game Monopoly?" -Steven Wright e-mail: dalvenjah@dal.net WWW: http://www.dal.net/~dalvenjah/ whois: SN90 Try DALnet! http://www.dal.net/