Mrs Mubarak's IP addresses used by spammers

Spammers finding new ways to obtain non-blacklisted addresses.

While not necessarily related to the current unrest in Egypt - which, among other things, led to the cutting off of most the country from the Internet - over 5,000 IP addresses belonging to the wife of the country's president have been hijacked by spammers.

The range of addresses was assigned to the Suzanne Mubarak Science Exploration Center several years ago and may well have been dormant for some time. However, spammers managed to hijack the range and have been using it to send spam pushing a number of dodgy web businesses.

IP blacklisting has been a major anti-spam tool for some years and thus for a spam campaign to be successful it helps a great deal if the emails are sent from addresses that have not (yet) been blacklisted. Stealing dormant IP ranges is a method that is becoming more popular among spammers; they manage to gain control of the addresses by registering expired domains or sending forged letters to the regional Internet registry.

With IPv4 addresses becoming scarcer, a secondary market of dormant but assigned IPv4 addresses is likely to arise and one can be certain that those with less honest intentions will find ways to benefit from this market too. Registries ought to be aware of this issue and those in the anti-spam business - particularly those running IP blacklists - should ensure they respond swiftly to the abuse of hijacked IP addresses.

More at the blog of security journalist Brian Krebs here, with information on Mrs Mubarak's IP range at The Spamhaus Project here.

Tags: blacklist, egypt, ip address, registry, spam. Posted on 01 February 2011 by Virus Bulletin. 1 comment.

1 comment

 del.icio.us  digg this! digg this

1 comment

Let’s hope we get some more organizations signed up for World IPv6 Day to avoid the pressure on IPv4…

http://en.wikipedia.org/wiki/World_IPv6_Day

by Foxing, 01 February 2011, 17:55

Leave a comment

Login to leave a comment

Please login to leave a comment - or click here to register if you are a new user.

Quick Links

Poll
Should software vendors extend support for their products on Windows XP beyond the end-of-life of the operating system?
Yes - it keeps their users secure
No - it encourages users to continue to use a less secure OS
I don't know
Leave a comment
View 24 comments

Jobs Recruit Sidebar

VB100 certification
VB100 For the first time in living memory, this test saw a clean sweep of certification passes, with all products reaching the required standard for a VB100 badge, and most also doing well in terms of stability.
See full results.

Virus Bulletin currently has 231,335 registered users.