Another incompetent ISP - Signet, B.V. - transip.net / signet.nl
I recently attempted to report spam that was sent to me from [136.144.219.231]. This address is being routed by AS20857 (ORG-SI6-RIPE / Signet B.V.) and the containing IP block (136.144.128.0/17) is registered to TransIP B.V. (NOTE: no associated ORG record) which appears to be just a different face of the same Dutch company (Signet). My spam report was sent to the abuse reporting address contained in the RIPE WHOIS record for the revevant ASN (AS20857) i.e. <abuse@signet.nl>. Of course, I included in the report a complete copy of the spam message I received so that the people on the other end could have a clear picture of the nature of this incident and those responsible for it. Unfortunately, Signet/transIP appears to be yet another in a succession of ISPs that have failed to grasp the seemingly obvious fact that enabling spam filtering on your own inbound spam reporting email address is counterproductive. Thus, for my trouble I received back: <support@signet.blue> (expanded from <abuse@signet.nl>): host mx.transip.email[86.105.244.9] said: 550 5.7.1 Our system has detected that this message is likely unsolicited mail (SPAM). To reduce the amount of spam, this message has been blocked. (4Kpghy5Bcvz1J9nY) (in reply to end of DATA command) Based on this rejection it is now my intention to locally blacklist all IPv4 blocks assigned to this ISP. A partial list of these is included below. Unfortunately, due to ongoing and longstanding issues with the RIPE data base (which I will be mentioning yet again on the RIPE db-wg mailing list, for all the good it will do) it is not easily possible to derive a full list of all of the IP address blocks assigned to this company, at least not in a simple automated fashion. Blocks assigned to ORG-SI6-RIPE (fully aggregated): 31.3.8.0/21 31.3.96.0/21 31.14.96.0/22 31.223.160.0/20 37.17.208.0/20 37.34.48.0/20 37.97.128.0/17 37.230.96.0/21 46.21.224.0/20 46.226.56.0/21 77.72.144.0/21 78.108.128.0/20 79.170.88.0/21 80.69.64.0/19 80.84.224.0/19 80.246.192.0/20 80.255.240.0/20 81.4.64.0/19 81.4.96.0/22 81.4.112.0/21 81.21.136.0/21 81.30.32.0/20 83.96.128.0/17 84.247.8.0/21 85.10.128.0/18 85.158.248.0/21 85.222.224.0/21 86.105.244.0/22 87.253.128.0/19 89.31.96.0/21 89.41.168.0/22 91.142.240.0/20 91.205.32.0/22 91.216.162.0/24 93.119.0.0/20 93.191.128.0/21 94.142.208.0/21 95.170.64.0/19 141.138.136.0/21 141.138.192.0/20 141.255.176.0/21 149.210.128.0/17 171.33.128.0/21 176.74.224.0/19 178.18.80.0/20 185.3.208.0/22 185.10.48.0/22 185.15.248.0/22 185.21.188.0/22 185.65.52.0/22 185.69.232.0/22 185.76.236.0/22 185.84.72.0/22 185.89.152.0/22 185.95.68.0/22 185.96.4.0/22 185.105.204.0/22 185.105.216.0/22 185.108.112.0/22 185.110.172.0/22 185.110.200.0/22 188.240.52.0/22 188.241.148.0/22 193.93.172.0/22 193.138.204.0/22 193.242.119.0/24 194.60.207.0/24 195.8.195.0/24 195.135.195.0/24 213.187.240.0/21 217.21.240.0/20 217.149.128.0/20
Hi Ronald On Thu, 28 Apr 2022 at 05:54, Ronald F. Guilmette <rfg@tristatelogic.com> wrote:
Based on this rejection it is now my intention to locally blacklist all IPv4 blocks assigned to this ISP. A partial list of these is included below.
Unfortunately, due to ongoing and longstanding issues with the RIPE data base (which I will be mentioning yet again on the RIPE db-wg mailing list, for all the good it will do) it is not easily possible to derive a full list of all of the IP address blocks assigned to this company, at least not in a simple automated fashion.
Why is this not possible? Your list below seems to be a full list of their IPv4. I got the same list from a simple query. A full list of IPv6 is also easy to derive. cheers denis co-chair DB-WG
Blocks assigned to ORG-SI6-RIPE (fully aggregated):
31.3.8.0/21 31.3.96.0/21 31.14.96.0/22 31.223.160.0/20 37.17.208.0/20 37.34.48.0/20 37.97.128.0/17 37.230.96.0/21 46.21.224.0/20 46.226.56.0/21 77.72.144.0/21 78.108.128.0/20 79.170.88.0/21 80.69.64.0/19 80.84.224.0/19 80.246.192.0/20 80.255.240.0/20 81.4.64.0/19 81.4.96.0/22 81.4.112.0/21 81.21.136.0/21 81.30.32.0/20 83.96.128.0/17 84.247.8.0/21 85.10.128.0/18 85.158.248.0/21 85.222.224.0/21 86.105.244.0/22 87.253.128.0/19 89.31.96.0/21 89.41.168.0/22 91.142.240.0/20 91.205.32.0/22 91.216.162.0/24 93.119.0.0/20 93.191.128.0/21 94.142.208.0/21 95.170.64.0/19 141.138.136.0/21 141.138.192.0/20 141.255.176.0/21 149.210.128.0/17 171.33.128.0/21 176.74.224.0/19 178.18.80.0/20 185.3.208.0/22 185.10.48.0/22 185.15.248.0/22 185.21.188.0/22 185.65.52.0/22 185.69.232.0/22 185.76.236.0/22 185.84.72.0/22 185.89.152.0/22 185.95.68.0/22 185.96.4.0/22 185.105.204.0/22 185.105.216.0/22 185.108.112.0/22 185.110.172.0/22 185.110.200.0/22 188.240.52.0/22 188.241.148.0/22 193.93.172.0/22 193.138.204.0/22 193.242.119.0/24 194.60.207.0/24 195.8.195.0/24 195.135.195.0/24 213.187.240.0/21 217.21.240.0/20 217.149.128.0/20
--
To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/anti-abuse-wg
In message <CAAJdhmF1OR2WWd3Ux-Yqk6nKsXyJyh=kz_FwspRoTExkUyjQ9A@mail.gmail.com> denis walker <ripedenis@gmail.com> wrote:
Why is this not possible?
Because of you. Because you basically told me to just go away when I previously requested on the db-wg mailing list to have -all- of the WHOIS records for -all- IP block allocations include a org: field. (I have just posted my more complete & detailed description of this issue / problem to the db-wg mailing list so you can find that there.)
Your list below seems to be a full list of their IPv4.
Well, I know it -seems- that way, but it isn't, for reasons I've explained on the db-wg list. Regards, rfg
participants (2)
-
denis walker
-
Ronald F. Guilmette