EMAS (European Menopause and Andropause Society) and NATA (Network for the Advancement of Patient Blood Management, Haemostasis and Thrombosis) are somehow in cahoots. Or at least they both are spamming through the same facilities that are used by nobody else to our knowledge.
On January 3, “Stéphane” (suppose this is Stephane Talboom) claiming to represent salesbridges.com (a domain registered in a Lithuanian city, with the country set to Luxembourg, and a phone number in Germany…) attempted to leave a website comment on our HOW TO GET REMOVED page, which clearly states that one should write emails to the addresses mentioned (not leave public comments on the website). We did not publish the comment; we observe the DNSBL Best Practices, and in accordance with Section 2.2.2, “A Direct Non-Public Way to Request Removal SHOULD Be Available” and is. That is, write email to us. We don’t expect anybody to plead their case in public. But we note we haven’t blogged about their listing yet, so it is appropriate to do so now.
The comment mentioned the IP address 184.108.40.206, which we have been listing since 4 September 2014. We see that we have failed to add all of their domain names to the RHSBL ever since we launched that part of the list in late September, although quite a few more spams have been received ever since. The reason is that they have been careful not to mention their own domain names any more; they’ve been using disposable redirectors instead. That’s fixed now.
The comment asked to “[p]lease remove our ip from the blacklist since we do not send spam.” We replied with a request to describe the methods they have used to build the mailing list. Stephane has not seen it necessary to reply.
At the moment, we list the following IP addresses for having sent EMAS/NATA spam:
as well as the following domain names directly belonging to them:
as well as the following domain names they have abused:
Most of the IPs we indicate above appear to be domestic cable TV internet connections in Lithuania which shouldn’t be sending any mail at all directly but using the ISP’s dedicated mail servers instead. They’re not listed by the Spamhaus PBL or the SORBS DUHL, but we wonder if they shouldn’t be.
- 220.127.116.11.in-addr.arpa domain name pointer 78-56-153-34.static.zebra.lt.
- 18.104.22.168.in-addr.arpa domain name pointer ctv-79-132-171-34.vinita.lt.
- 252.169.132.79.in-addr.arpa domain name pointer ctv-79-132-169-252.vinita.lt.
- 22.214.171.124.in-addr.arpa domain name pointer ctv-95-173-32-4.vinita.lt.
- 126.96.36.199.in-addr.arpa domain name pointer ctv-95-173-33-65.vinita.lt.
- 188.8.131.52.in-addr.arpa domain name pointer ctv-95-173-34-15.vinita.lt.
- 184.108.40.206.in-addr.arpa domain name pointer ctv-95-173-35-53.vinita.lt.
- 220.127.116.11.in-addr.arpa domain name pointer ctv-95-173-45-224.vinita.lt.
- 18.104.22.168.in-addr.arpa domain name pointer mktgm.com.
- 22.214.171.124.in-addr.arpa domain name pointer ctv-213-164-121-101.vinita.lt.