Uncategorized

Blocking VocusPR Spam With Iptables

20 July 2011
Anthony Mills

VocusPR has a dubious reputation their main line of work is aggregating the contact details of journalists and bloggers and then selling access to that database so companies can contact them. Press releases from Vocus customers come with the required “unsubscribe” link down the bottom but the catch is clicking it will only stops the client from contacting you, but not the other multitude of clients spamming your from their database. Today I have had enough contacting them seems to get nowhere so its time for more effective measures. A WHOIS lookup for the IP address of one of their spam servers reports:

#
# Query terms are ambiguous. ย The query is assumed to be:
# ย  ย  “n 66.77.65.154”
#
# Use “?” to get help.
#
#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=66.77.65.154?showDetails=true&showARIN=true
#
Vocus, Inc. QWEST-IAD-VOCUS1 (NET-66-77-65-128-1) 66.77.65.128 – 66.77.65.191
Qwest Communications Company, LLC QWEST-INET-12 (NET-66-77-0-0-1) 66.77.0.0 – 66.77.255.255
American Registry for Internet Numbers NET66 (NET-66-0-0-0-0) 66.0.0.0 – 66.255.255.255

 

Now for the blocking part, simply logged in to mail server add added the following to my firewall rules to block their IP range:

/sbin/iptables -I INPUT -s 66.77.65.128/26 -j DROP

 

Goodbye VocusPR have a nice life spamtards!

Update: VocusPR also own the IP ranges 209.3.118.0/24 and 63.232.227.0/26