We are getting many fake account and spam attempts from IP addresses originating from ChinaNet.com. How can I discover all of their IP blocks? I viewed a report from 2001 that mentioned they did not protect against abuse.
2 Answers
First, any report from 2001 is worth slightly less than the paper on which it is printed. It's 10 year old data.
Second, You are reaching for the wrong solution: You should implement real heuristic-based spam filtering, not just block IP ranges because you feel like it.
Third, If you really want to do do this then AS numbers are your fiends.
Chinanet is AS23650. This page has all sorts of interesting BGP info, including all of their IPv4 and IPv6 prefixes (as seen by Hurricane Electric's infrastructure).
answered Nov 21, 2011 at 18:07
There are many services out there than can provide this information. The one I would recommend is from MaxMind.
ftp://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-extended-latestFind allipv4ranges where the country isCN. Each one gives you the base addresses plus number of addresses. I use a script to turn this intoiptablesrules. The script has a list of whitelisted countries; all else is blocked from contacting port 25.