Based on research, analysis of network data, our ‘snowshoe’ spam detection systems, intelligence sources and our experience, Spamhaus believes that this IP address range is being used or is about to be used for the purpose of high volume ‘snowshoe’ spam emission.
As a precaution therefore we are listing this IP range in an SBL Advisory for the protection of Spamhaus users until we are able to determine the extent of the problem in this IP range, the exact size of the problematic IP allocation within this IP range, who is operating the domains/hosts/servers in this IP range, and receive a reassurance from the network owner that the IP range does not and will not pose a threat to Spamhaus users.
—
112.51.135.147.in-addr.arpa. 60 IN PTR smtp73.ptzinfomed.org.
113.51.135.147.in-addr.arpa. 60 IN PTR smtp74.ptzinfomed.org.
114.51.135.147.in-addr.arpa. 60 IN PTR smtp75.ptzinfomed.org.
115.51.135.147.in-addr.arpa. 60 IN PTR smtp76.ptzinfomed.org.
116.51.135.147.in-addr.arpa. 60 IN PTR smtp77.ptzinfomed.org.
117.51.135.147.in-addr.arpa. 60 IN PTR smtp78.ptzinfomed.org.
118.51.135.147.in-addr.arpa. 60 IN PTR smtp79.ptzinfomed.org.
119.51.135.147.in-addr.arpa. 60 IN PTR smtp80.ptzinfomed.org.
120.51.135.147.in-addr.arpa. 60 IN PTR smtp81.ptzinfomed.org.
121.51.135.147.in-addr.arpa. 60 IN PTR smtp82.ptzinfomed.org.
122.51.135.147.in-addr.arpa. 60 IN PTR smtp83.ptzinfomed.org.
123.51.135.147.in-addr.arpa. 60 IN PTR smtp84.ptzinfomed.org.
124.51.135.147.in-addr.arpa. 60 IN PTR smtp85.ptzinfomed.org.
125.51.135.147.in-addr.arpa. 60 IN PTR smtp86.ptzinfomed.org.
126.51.135.147.in-addr.arpa. 60 IN PTR smtp87.ptzinfomed.org.
127.51.135.147.in-addr.arpa. 60 IN PTR smtp88.ptzinfomed.org.
Again, no SWIPs, this is a /28 although in the TXT
ptzinfomed.org descriptive text «v=spf1 a mx a:ptzinfomed.org ip4:147.135.37.124 ip4:51.81.251.131 ip4:51.81.253.224/27 ip4:147.135.107.128/27 ip4:147.135.49.56/29 ip4:147.135.51.112/29 ip4:147.135.51.120/29 ip4:147.135.49.144/29 ip4:51.81.218.96/27 ip6:2604:2dc0:0200:017c::/64 include:m» «ailgun.org ~all»
it is mentioned as two adjacent /29’s. Even /29’s should have SWIPs according to ARIN policy.
The owner is likely the same as with the other network
Rajesh, Varma OVH-CUST-328814 (NET-147-135-107-128-1) 147.135.107.128 — 147.135.107.159