(AS3352) #1 on Spamhaus ISP SBL


According to  Spamhaus Top 10 Network offenders on its Spamhaus Block List Advisory, an ISP called AS3352 TELEFONICA-DATA-ESPANA has the most SBLs on Spamhaus list as of January 17th, 2010. Based on Spamhaus‘ research, this ISP is considered the current “World’s Worst Network.”  At time of this post, there are 95 SBLs belonging to

Spamhaus: The 10 Worst Spam Support ISPs
As at 17 January 2010 the ISPs with the poorest abuse control of spammers are:

Rank / SBL #  ISP domain / ASN / URL
1. 95 AS3352 /
2. 64  AS16276 /
3. 59 AS22185 /
4. 46 AS3257 /
5. 44 AS2828 /
6. 38 AS7385 /
7. 38 AS20115 /
8. 38 AS6739 /
9. 35 AS19262 /
10. 34 AS7303 /

Many SBLs of (Telefonica de Espana, AS3352, netname: RIMA ) are /32 (1 IP address) blacklistings with lots of ROKSO Canadian Pharmacy listings. Many of the SBLs were added from October to December 2009. ROKSO is a list compiled by Spamhaus of the worst spamming organizations. ROKSO stands for Registry of Known Spam Operatives.

While Second ranking OVH’s listings are /32 as well, not so many current SBLs are those of ROKSO spammers. offers both dedicated and shared hosting; unfortunately, spammers are attracted to either one. was noted as the Worst Offending ISP on this blog back in December 2009. The good news about OVH is that it appears the admins are working on riding its network of spammers. is in 3rd place with 59 SBLs has larger blocklistings, such as numerous /24 which are 256 IP addresses. The ROKSO spammer’s listings on is  Fabio Petta – Jnternet.

One note about this top 10 list is the number of Spanish-speaking ISPs. For example: and / are located in Spain, while Argentina is represented by and Telefónica explains on its website that it is one of the largest telecommunications companies by market (Spain, Europe and Latin America).

The 2 other Euoropean-based ISPs are OVH of France and in Italy. The 4 US-based providers on the Spamhaus Block List are:  XO, Charter, Integra Telecom and Verizon. is a large  Tier-2 NSP (network service provider), while Integra Telecom is a regional ISP in the midwest and western US states, and Charter is a regional ISP.  Verizon (made up of Baby Bell companies) as an ISP is offered in most markets in the US. Verizon is also a leading wireless cell phone provider.

Spamhaus’ SBL ranking is based on Spamhaus own research of spam and so the list has its own limitations.  Among the reasons: ISPs have to contact Spamhaus to get their SBLs removed, so the SBL list is a manual process, and not automated like CBL.

If a researcher wants to know more volumes of ISP spam emiters, one can use other online tools available such as Spamcop’s list by hostname/ IP. Though much smaller in scope than Spamcop, German Powerweb’s has a top 20 providers list on its main page by spam volume based on the ASN (Autonomous System Number) which is used to identify a network by the Internet Protocol addresses authorities.

3 Responses to “ (AS3352) #1 on Spamhaus ISP SBL”

  1. 1 nycbuygirl

    I keep getting this ip address as searching a page that is limited to just me, i have tried to see if it is a false IP address, everytime this telefonice de espana comes up it is with a different IP address. Is this someone using a third party to get into my site?
    Can you help me?
    IP Address [Label IP Address]
    Country Spain
    Region Andalucia
    City San Roque
    ISP Telefonica De Espana
    Returning Visits

    • 2 reportscams

      Sorry to not see your post earlier, I only update this blog roughly once a month. I am not sure what you mean. What is the IP doing? Is it in your log files or in a search engine results? Either way it sounds potentially malicious or compromised. When I searched the IP in, only Spamhaus Zen was blacklisting it due to: “End-user Non-MTA IP addresses set by ISP outbound mail policy” Now that a lot of time has passed since your post, did you find the answer?

  2. 3 nycbuygirl

    this person keeps logging into a page of mine on flickr that is private…i have changed my password and they are still getting in to it.
    IP Address [Label IP Address]
    Country Spain
    Region Andalucia
    City San Fernando
    ISP Telefonica De Espana
    Returning Visits 0
    Visit Length Multiple visits spread over more than one day

    the isp is always the same but the ip address is different. how can i tell if this is a valid address or someone is hacking in to my stuff

Leave a Reply

Please log in using one of these methods to post your comment: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: