(Sorry for the double post if you saw this message on SDLU as well.)
I just had a Spamassassin FP that hit
URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist
[URIs: www.alfordmedia.com]
Doing a whois on alfordmedia.com shows that name services are hosted on
Amazon's Route 53 DNS service:
Name Server: NS-696.AWSDNS-23.NET
Name Server: NS-1925.AWSDNS-48.CO.UK
Name Server: NS-1298.AWSDNS-34.ORG
Name Server: NS-62.AWSDNS-07.COM
Heavens know that Amazon Cloud is a scary place to receive email from, but
I wouldn't expect them to be classified as a spam support service for SBL
purposes. And of course, Route53 uses anycast so there's no good way to
identify which IP is being hit.
Is anybody else seeing these sorts of hits? Does anybody have a contact at
SBL that can look into it? The automated lookup tool doesn't show any of
those IPs as listed, at least using IPv4, but I have no idea what
anycasting does to those addresses.
(The www.alfordmedia.com A record is also on the SBL; the hosting provider
has requested delisting and either the block will be delisted or the site
will move to a different provider -- but that's a separate issue.)
--
Dave Pooser
Cat-Herder-in-Chief, Pooserville.com
