# This blacklist of DCC clients is used by the public DCC servers.  The
#   public DCC servers should only be used by small sites that qualify
#   for the free license on the DCC source.
#   See http://www.dcc-servers.net/dcc/ or
#   http://www.rhyolite.com/dcc/ concerning the DCC
#
#   This list contains IP addresses and blocks of addresses of DCC clients
#   that persistently cause problems such as sending more than 100,000
#   requests per day to the public DCC servers.  This list causes the public
#   DCC servers to ignore requests even before checking the automatic
#   rate-limiting mechanisms.
#
#   This blacklist has no direct effect on email.
#
#   This list is http://www.rhyolite.com/dcc/client-blacklist.html and
#   http://www.dcc-servers.net/dcc/client-blacklist.html
#
#   Operators of public DCC servers can use the user names and passwords that
#   they use to see the DCC server status web pages to see the consolidated
#   lists of the busiest clients of the public DCC servers at
#   http://www.rhyolite.com/dcc/private/clients.cgi
#
#   Contact Vernon Schryver at vjs@rhyolite.com or use the web form at
#   http://www.rhyolite.com/cgi-bin/ct.cgi?sb=public+server+blacklist


# 200K useless NOPs using version 4 of the DCC client-server protocol of 2005
# no reverse DNS name, but perhaps owned by nerim.net 2001:7a8::/32AS13193
# The traffic immediatel moved from 2001:7a8:33d8:14:11:11ff:fecc:cf54 
#	to 2001:7a8:33d8:4:d6ae:52ff:fe79:5384, so block the /48
2001:7a8:33d8::0/48



# streams of 23 byte bogus packets apparently somehow related
#	to Fortinet firewalls
121.156.118.0/24 # 121.156.118.11 121.156.118.16 121.156.118.17 121.156.118.21
123.140.106.178
14.48.191.3
192.203.138.19
211.194.150.30
211.198.34.226
221.148.93.5
222.106.210.130
222.122.219.7
59.12.136.15


# 400K requests/day for months from 149.242.224.10  mail.koerber.de
#	and 149.242.224.11 mail2.koerber.de
# ancient version of DCC software
#   no response from abuse@cogentco.com, postmaster@koerber.de, or hauni.com
#   Christian Lohse, Hamburg DE
#	still bad at 500K+ ops/day 2010/01/27, 2010/12/08, 2011/11, 2012/02
149.242.224.10


# about 1 million NOPs/day from 80.83.47.186 and 80.83.47.187
#   No response to email
#   VIDEO 2000 SA,  A. Vuillemez, Neuchâtel, Switzerland
#	still bad 2010/01/07  2010/12/08  2011/05/24  2011/11
80.83.47.186/31


# years of abuse of http://www.rhyolite.com/cgi-bin/reps.cgi by 62.210.128.51
#   no response to complaints
#   Neolane, 18 rue Roger-Simon Barboux, 94110 Arcueil
62.210.128.0/24


# Commtouch should not use the public DCC servers
no-anon 207.135.122.32/27
no-anon 216.163.176.0/20
no-anon 64.167.110.48/29
no-anon 64.191.223.0/24
no-anon 65.74.160.0/29
no-anon 65.74.168.224/27


# old unsolicited bulk email advertiser siteprotect.com // hostway.com
# 275K requests/day from 83.246.86.164, smapp01.csee.de.siteprotect.com
83.246.86.0/24
216.36.192.0/18
64.26.0.0/18
66.113.128.0/17


# viruscheckservice.de
#   300K requests/day
#   yet another seller of the CPU cycles, bandwidth, and system
#	administration labor of the public DCC servers
#   particularly amusing is that mail to postmaster@viruscheckservice.de
#	and flo@degnet.de, the contact address for viruscheckservice.de,
#	is rejected with
#	"450-Your address 192.188.61.3 has mailed to spamtraps here"
80.73.96.0/24


# $Date: 2012/04/17 19:02:35 $

Contact Vernon Schryver at vjs@rhyolite.com or use the form.