Noticeable trend on my mailserver: Spam that comes via IPv6 is 90% from Google servers and the rest is Amazon or Microsoft servers.

@jwildeboer so glad you posted this. Huge uptrend for me in the last month from google ipv6 2002::

@jwildeboer That's ... Woah. I understand how it works, but where did we go wrong that it does and turned IP ranges into rentals?

Hostgnome uses a simple tactic. They rent/buy IPv4 address pools, send spam via all allocated addresses in that space for a few days and then get rid of the pool, replacing it with a fresh one. So it makes sense to have a cronjob that checks their ASes and immediately block all pools on the firewall.

#SelfHost #MailAdmin @homelab

@jwildeboer so glad you posted this. Huge uptrend for me in the last month from google ipv6 2002::

@heuveltop IP.

@larsmb @jwildeboer wait I don’t get it. How can we track their AS?

@tramtrist @jwildeboer I suspect the AS doesn't change, just the prefixes the AS announces.

Hence, blocking by ASN, not by IP address range.

Hostgnome uses a simple tactic. They rent/buy IPv4 address pools, send spam via all allocated addresses in that space for a few days and then get rid of the pool, replacing it with a fresh one. So it makes sense to have a cronjob that checks their ASes and immediately block all pools on the firewall.

#SelfHost #MailAdmin @homelab

@homelab @jwildeboer I have questions, if you don't mind.

1. How long do you block the IPs for?
2. How do you find the ASs/could you share the cron job?

@jwildeboer Can you share with us the source of the list of IP addressen?

Because a few people asked how I block the IP ranges from hostgnome:

- Mailserver detects IP address trying to to deliver spam: 91.237.124.193
- Via `whois` I find the corresponding AS: 201579 (picture 1)
- Then I find all IP ranges associated with with this AS (picture 2)
- Then I go through the ranges and add them to my firewall.

Rinse, repeat.

#SelfHost #MailAdmin @homelab

Because a few people asked how I block the IP ranges from hostgnome:

- Mailserver detects IP address trying to to deliver spam: 91.237.124.193
- Via `whois` I find the corresponding AS: 201579 (picture 1)
- Then I find all IP ranges associated with with this AS (picture 2)
- Then I go through the ranges and add them to my firewall.

Rinse, repeat.

#SelfHost #MailAdmin @homelab

@jwildeboer if you want, you can automate that part by querying radb.net:
```
./filter.sh AS201579
23.166.72.0/24
62.169.151.0/24
84.32.41.0/24
91.237.124.0/24
185.91.69.0/24
193.138.195.0/24
# ./filter.sh --ipv6 AS201579
2a13:2480::/29
2602:f9e4::/36
```
Source: https://share.aditsystems.de/ztdku91ezQ/filter.sh

@jwildeboer @homelab typo AS201579, not AS20579.

@anton Oooh! Nice! I will extend that to add the ranges to my crowdsec based firewall Far better than my crude script. Thank you for sharing!