@ MysteryFCM I'm aware of HE and Jart A. I believe I've even spoken with him for a few exchanges a few years ago on a separate matter. I know parts of your work too, for years, and have passed two comments your direction. I've read parts of rbnexploit.blogspot.com; not http://rbnexploit.blogspot.co....

URLQuery has nearly 121 other listings in the past 30 days: http://www.google.com/search?q=site:urlquery.net+%22Russian%2BBusiness%2BNetwork%22&num=100&hl=en&lr=lang_en&safe=active&site=webhp&tbs=lr:lang_1en,qdr:w&prmd=ivns&ei=W4izUNzVEaL40gHopoCQBA&start=0&sa=N 20-26 November 2012: https://urlquery...

I've been questioning in my own mind before I started this thread why most of the IPs listed by Emerging Threat aren't listed by Spamhaus, nor most other blacklists. WOT has most of them however.

I haven't seen the full list of RBN IPs and network ranges associated with networks and registrars. Would someone run this list to associate it with the associated networks, preferably to the associated network URL contact, for WOT listing. http://doc.emergingthreats.net/pub/Main/RussianBusinessNetw...

These emails indicate more problems than just 126.com, many originate from hosting networks with a red or orange reputation and have other spam operations support: chinanet.cn.net (supported by cndata.com / 189.cn ) Checkout the WOT scorecards to see the reputations and you'll see larger problems th...

Malicious hosts maintain malicious IPS running the same old malicious domains too.

Personally, I'd consider dropping the IP and get a Good new one (it may also give you an indication of the Recent past of the hosting provider).