Registrars listed as a bad registrar in the latest report by <a href="http://knujon.com">Knujon.com</a> or <a href="http://blog.legitscript.com">LegitScript.com</a>: List of the registrar websites: <massrate> <red> bizcn.com cnobin.com china-channel.com chinaspringboard.com corenic.org directnic.com...

Registrars which in the last year have been <a href="http://rss.uribl.com/nic">URIBL.com</a>-listed for a majority of it's spamvertised domains registered as continuing to be used in spam messages. List of the registrar websites: <massrate> <red> 114.com.cn 4DReg.com 55hl.com aboutdomainsolutions.co...

@ MysteryFCM I'm aware of HE and Jart A. I believe I've even spoken with him for a few exchanges a few years ago on a separate matter. I know parts of your work too, for years, and have passed two comments your direction. I've read parts of rbnexploit.blogspot.com; not http://rbnexploit.blogspot.co....

URLQuery has nearly 121 other listings in the past 30 days: http://www.google.com/search?q=site:urlquery.net+%22Russian%2BBusiness%2BNetwork%22&num=100&hl=en&lr=lang_en&safe=active&site=webhp&tbs=lr:lang_1en,qdr:w&prmd=ivns&ei=W4izUNzVEaL40gHopoCQBA&start=0&sa=N 20-26 November 2012: https://urlquery...

I've been questioning in my own mind before I started this thread why most of the IPs listed by Emerging Threat aren't listed by Spamhaus, nor most other blacklists. WOT has most of them however.

I haven't seen the full list of RBN IPs and network ranges associated with networks and registrars. Would someone run this list to associate it with the associated networks, preferably to the associated network URL contact, for WOT listing. http://doc.emergingthreats.net/pub/Main/RussianBusinessNetw...

These emails indicate more problems than just 126.com, many originate from hosting networks with a red or orange reputation and have other spam operations support: chinanet.cn.net (supported by cndata.com / 189.cn ) Checkout the WOT scorecards to see the reputations and you'll see larger problems th...

Malicious hosts maintain malicious IPS running the same old malicious domains too.

Personally, I'd consider dropping the IP and get a Good new one (it may also give you an indication of the Recent past of the hosting provider).