Spamhaus has observed spam from this range to addresses that had never asked for it. The behaviour has been consistent and gone on for more than a year. We have SBLCSS removal requests on file for IPs in this range going back to April 2020. Many of the domain names had already been automatically listed on the DBL, as well. This SBL advisory is simply making that fact more visible.
A crucial factor of operations such as HSP is sending spam emails to scientists whose addresses have been scraped from public archives of academic writing such as PubMed. Because of email address and domain name churn, and also because of typographic errors, any such operation necessarily ends up emailing spamtraps in addition to live addresses. Some of the spamtraps involved belong to Spamhaus which is why we know of this first hand.
Reverse DNS listing for the range:
224.253.81.51.in-addr.arpa. 86400 IN PTR server.a.hspcorporation.net.
225.253.81.51.in-addr.arpa. 86400 IN PTR server.c.hspcorporation.net.
226.253.81.51.in-addr.arpa. 86400 IN PTR server.a.scienceget.life.
227.253.81.51.in-addr.arpa. 86400 IN PTR server.b.scienceget.life.
228.253.81.51.in-addr.arpa. 86400 IN PTR server.c.scienceget.life.
229.253.81.51.in-addr.arpa. 86400 IN PTR server.d.scienceget.life.
230.253.81.51.in-addr.arpa. 86400 IN PTR server.e.scienceget.life.
231.253.81.51.in-addr.arpa. 86400 IN PTR server.a.pubmed.life.
232.253.81.51.in-addr.arpa. 86400 IN PTR server.b.pubmed.life.
233.253.81.51.in-addr.arpa. 86400 IN PTR server.c.pubmed.life.
234.253.81.51.in-addr.arpa. 86400 IN PTR server.d.pubmed.life.
235.253.81.51.in-addr.arpa. 86400 IN PTR server.e.pubmed.life.
236.253.81.51.in-addr.arpa. 86400 IN PTR server.a.pubmed.pw.
237.253.81.51.in-addr.arpa. 86400 IN PTR server.b.pubmed.pw.
238.253.81.51.in-addr.arpa. 86400 IN PTR server.c.pubmed.pw.
239.253.81.51.in-addr.arpa. 86400 IN PTR server.d.pubmed.pw.
240.253.81.51.in-addr.arpa. 86400 IN PTR server.e.pubmed.pw.
241.253.81.51.in-addr.arpa. 86400 IN PTR server.a.techsci.life.
242.253.81.51.in-addr.arpa. 86400 IN PTR server.b.techsci.life.
243.253.81.51.in-addr.arpa. 86400 IN PTR server.c.techsci.life.
244.253.81.51.in-addr.arpa. 86400 IN PTR server.d.techsci.life.
245.253.81.51.in-addr.arpa. 86400 IN PTR server.e.techsci.life.
246.253.81.51.in-addr.arpa. 81943 IN PTR server.a.scitech.life.
247.253.81.51.in-addr.arpa. 86400 IN PTR server.b.scitech.life.
248.253.81.51.in-addr.arpa. 43912 IN PTR server.c.scitech.life.
249.253.81.51.in-addr.arpa. 86400 IN PTR server.d.scitech.life.
250.253.81.51.in-addr.arpa. 86400 IN PTR server.e.scitech.life.
251.253.81.51.in-addr.arpa. 86400 IN PTR server.a.booksres.pw.
252.253.81.51.in-addr.arpa. 86400 IN PTR server.b.booksres.pw.
253.253.81.51.in-addr.arpa. 86400 IN PTR server.c.booksres.pw.
254.253.81.51.in-addr.arpa. 86400 IN PTR server.d.booksres.pw.
255.253.81.51.in-addr.arpa. 86400 IN PTR ip255.ip-51-81-253.us.