IPs Blocked for List-Bombing

This page explains the procedure for blocking and documenting IP addresses identified as list-bombers, based on the "Possible IP List Bombing" emails delivered to the deliverability@14west.us inbox.

This is the overall list of IPs blocked; with breakdowns by date in the comments:  DLV-3174 - Getting issue details... STATUS

How to Block IPs reported in the List Bombing email:

1. Open the List Bombing email
2. Look over the data provided for any red flags (see criteria below) and note any potential problem IPs 
3. Click through all of the CleanTalk, StopForumSpam, and Project Honeypot links provided (even if the email says "Not blacklisted," it's possible the IP has been listed in the time between the alert and your response)
4. Make a list of all of the IPs that have been reported as spam or other malicious behavior on any of the three sites - these IPs must all be blocked and documented
5. Verify whether any of the potential problem IPs from Step 2 need to be added to the block list by confirming spam report status or suspicious data
6. Use Postman to block each IP address from adding new addresses to SignupApp2 (SUA2)
   1. You will need access to the SUA2 environment, if you don't have correct permissions submit a ticket to IT
   2. use SUA Endpoints > Exclusions > Add blacklisted IP code
   3. Paste the IP address into the bar where highlighted
   4. Click "Send"
      
      
      
   5. Verify 200 OK response
      1. You should see this: 
         
      2. If you see this, the IP has already been blocked (you probably duplicated it in your list by accident, eg noted the IP at first and copied again where it was blacklisted)
         
   6. Repeat these steps for all IPs
      
      
      
7. Document the IPs you've blocked. *Note, for the time being that process is being handled on this DLV ticket:  DLV-3174 - Getting issue details... STATUS
   1. Paste the list of blocked IPs into a comment, so there's a timestamp for those IPs
   2. Paste the list of blocked IPs into the master blocklist in the body of the ticket

Criteria for blocking an IP address:

• Blacklisted on any of the blacklists in the "Possible IP List Bombing" email; OR
• A combination of the following:
  1. High spam rate on Cleantalk – anything above 2-3% should raise a red flag.
  2. IP is located in problematic regions (ie, SE Asia, China, Russia, Eastern Europe)
  3. High discrepancy btwn unique emails and unique signups/attempts
  4. Apparent but unmarked bulk uploads in SUA2 (eg, dozens of signups within a second, patterns in uploads, etc)

Here's a sample of a domain that was shown as NOT blacklisted in the email, but could be added to our block list. However, it turned out this particular IP was confirmed to be legit by a client, so tread carefully if the IP is not blacklisted:

The following addresses have been positively ID'd as legit sources of signups (to be whitelisted):

• 54.224.244.168 - vendor
• 161.47.117.248 - vendor
• 104.196.168.51 - FTM / Australia
• 35.189.61.7 - PPP / Australia
• 34.206.153.163 - investmentu
• 162.242.156.206 - zapier / agora financial
• 144.202.62.164 - oxf vendor
• 54.241.34.25 - AF vendor Unbounce
• 50.19.99.184 - AF vendor Unbounce

Zapier / OXF IPs:

• 3.220.115.188 - Zapier
• 3.220.22.251 - Zapier
• 52.1.205.184 - Zapier
• 52.6.229.193 - Zapier
• 52.6.82.82 - Zapier
• 54.85.112.125 - Zapier