5280 Enterprises AKA Proxy51 – A nest of scrapers, spammers and general scum

Spammers are scumbags. Those who facilitate the spammers for commercial gain are even bigger scumbags. 5280 Enterprises AKA Proxy 51 are just one of these even bigger scumbags. They permit spammers to hide behind their proxies and do absolutely nothing to prevent it happening, and do absolutely nothing to stop them when it’s reported. This is what’s fallen into the honeypot in just the last 24 hours:

23.29.55.0/24 – DM Systems 2013-07-12
23.29.56.0/23 – DM Systems 2013-07-12
23.29.58.0/24 – DM Systems 2013-07-12
38.87.64.0/20 – Cogent 2013-07-12
50.117.46.0/24 – EGI Hosting 2013-07-12
50.117.64.0/17 – EGI Hosting 2013-07-12
50.117.73.0/24 – EGI Hosting 2013-07-12
69.46.81.0/24 – EGI Hosting 2013-07-12
142.54.170.0/24 – Datashack 2013-07-12
142.54.20.0/24 – Datashack 2013-07-12
142.54.171.0/24 – Datashack 2013-07-12
172.232.86.0/24 – Eonix 2013-07-12
173.208.145.0/24 – Wholesale Internet 2013-07-13
173.232.46.0/24 – Eonix 2013-07-12
173.232.124.0/24 – Eonix 2013-07-12
199.116.84.0/22 – DM Systems 2013-07-12
205.164.9.0/24 – EGI Hosting 2013-07-12
205.164.13.0/24 – EGI Hosting 2013-07-12
205.164.15.0/24 – EGI Hosting 2013-07-12
205.164.57.0/24 – EGI Hosting 2013-07-12
216.172.139.0/25 – EGI Hosting 2013-07-12
216.172.141.0/25 – EGI Hosting 2013-07-12
216.172.145.0/24 – EGI Hosting 2013-07-12

What’s also interesting to note is that the hosting/collocation providers are also made up of the usual suspects. Feel free to go ahead and firewall the ranges identified.

Fighting Spam

I’ve been fighting a long running battle with spammers.

First it was email spammers. Initially, Mailwasher put paid to that. Now that I run my own server, strict Exim rules ensure that very little gets through.

The I decided to put up my own Coppermine gallery. The next thing I knew, comment spam was coming in thick and fast. Realising that spambots are dumb, and unable to understand Javascript cloaking, I did a little PHP hacking, and the bots fall into a little honeytrap, and their misdeeds get the originating IP address reported to the relevant hosting company, the spamvertised website being reported to all and sundry, and their details ending up in Stop Forum Spam for general public ridicule.

Checking the server logs, I see all sorts of attempts at nefarious activity, handily blocked by CSF/LFD. I’ve gone a step further now, and the IP address of any attempted abuse source also gets sent to Blocklist.de.

I’ve also got a forum on one of my websites. Spambots are prevented from accessing it by ZBBlock.

And, of course, this blog. ZBBlockStop Forum Spam and Akismet keep this clean.

I have a message for spammers and so-called “SEO experts”:

You are scum, the filth of the web. The sooner you choke on your own vomit, the better!