# Domain parts of sender address used for Phishing (Fake Apple, Rakuten, Amazon etc messages from RU, BG, AZ, KZ) As of 2020-02-16 #Domain-part of sender address (First-seen-sender-IP address: ISP: Spamhaus Blacklist) # @0-99.com (unknown[31.163.55.227] Rostelecom RU PBL1528835) @090-9.com (unknown[92.124.211.182] Rostelecom RU PBL494997) @090.co.jp (92.50.129.14.static.ufanet.ru[92.50.129.14] OJSC Ufanet RU XBL) @090.com.ua (unknown[109.252.29.71] Moscow City Telephone Network RU PBL469738) @090.jp (unknown[145.255.3.35] OJSC Ufanet RU) @0904.ru (unknown[85.14.42.203] Evolink AD BG) @09062021515.nl (unknown[46.191.233.14] OJSC Ufanet RU PBL1517359) @0906direct.nl (host182.net151.alania.net[78.110.151.182] OJSC Ufanet RU PBL1517359) @0906lijnen.com (unknown[85.132.117.118] Internet Center of Nakhchivan Autonomous Republic AZ PBL256996) @0906lijnen.net (unknown[46.21.70.153] LLC Fatum-3 RU) @09071.com (h109-187-30-186.dyn.bashtel.ru[109.187.30.186] PJSC Bashinformsvyaz RU PBL331447) @0909.am (host-31-180-233-47.stavropol.ru[31.180.233.47] Rostelecom RU PBL1628042) @0909.jp (unknown[46.191.233.14] OJSC Ufanet RU PBL1517359) @0909s.com (h31-8-146-60.dyn.bashtel.ru[31.8.146.60] PJSC Bashinformsvyaz RU PBL1517776) @090i.com (109-252-26-145.nat.spd-mgts.ru[109.252.26.145] Moscow City Telephone Network RU PBL469738) @090rc.com (unknown[31.163.55.227] Rostelecom RU PBL1528835) @090ver.jp (unknown[91.186.109.27]) MTS PJSC RU PBL1726339) @090web.jp (unknown[31.163.55.227] Rostelecom RU PBL1528835) @091.jp (unknown[31.163.55.227] Rostelecom RU PBL1528835) @0910.nu (h62-133-162-36.dyn.bashtel.ru[62.133.162.36] PJSC Bashinformsvyaz RU) @0910.ru (unknown[94.156.20.51] SA Telecable BG) @0912.co.jp (unknown[136.169.202.36] OJSC Ufanet RU PBL1519627) @0912163.com (unknown[31.163.39.212] Rostelecom RU) @0917.com h62-133-162-36.dyn.bashtel.ru[62.133.162.36] PJSC Bashinformsvyaz RU) @091773.com (95-37-172-87.dynamic.mts-nn.ru[95.37.172.87] Rostelecom RU) @092-933-0371.net (unknown[89.218.175.98] JSC Kazakhtelecom KZ) @092.jp (h31-8-146-60.dyn.bashtel.ru[31.8.146.60] PJSC Bashinformsvyaz RU PBL1517776) @0924.info (unknown[31.163.39.212] Rostelecom RU) @092jibstyle.com (unknown[94.242.184.184] Rostelecom RU) @093-club.com (h62-133-162-36.dyn.bashtel.ru[62.133.162.36] PJSC Bashinformsvyaz RU) @093.jp (h62-133-162-36.dyn.bashtel.ru[62.133.162.36] PJSC Bashinformsvyaz RU) @0930.in (109-252-29-71.nat.spd-mgts.ru[109.252.29.71] Moscow City Telephone Network RU PBL469738) @093093.net (unknown[46.191.233.14] OJSC Ufanet RU PBL1517359) @093093.net (unknown[91.211.219.66] VIP-TELECOM-SERVICE RU) @0931qq.com (109-252-26-145.nat.spd-mgts.ru[109.252.26.145] Moscow City Telephone Network RU PBL469738) @09344.com unknown[89.109.5.103] Rostelecom RU) @09365.co.kr (13-114-139-78.kamensktel.ru[78.139.114.13] Closed Joint Stock Company Radiotelephone RU PBL261647) @0937.com (109-252-26-145.nat.spd-mgts.ru[109.252.26.145] Moscow City Telephone Network RU PBL469738) @0937686468.com (95-37-172-87.dynamic.mts-nn.ru[95.37.172.87] Rostelecom RU) @094.jp (unknown[31.163.55.227] Rostelecom RU PBL1528835) @0942.com (h62-133-162-36.dyn.bashtel.ru[62.133.162.36] PJSC Bashinformsvyaz RU) @09446.jp (unknown[178.184.139.105] Rostelecom RU PBL476465) @0949.co.kr (unknown[31.173.62.109] PJSC MegaFon RU) @095.jp (unknown[5.143.43.231] Rostelecom RU PBL1534087) @095drive.com (unknown[46.21.70.153] LLC Fatum-3 RU) @095mm.it (unknown[213.226.36.235] A1 Bulgaria BG) @0966.ru (unknown[62.182.115.38] Orlandonet BG) @0976.jp (unknown[77.108.216.33] MTS PJSC RU PBL260986) @098.nl (unknown[31.163.39.212] Rostelecom RU) @098.pl (unknown[77.108.216.33] MTS PJSC RU PBL260986) @0984352345.com (unknown[46.191.233.14] OJSC Ufanet RU PBL1517359) @0986583500.com (unknown[82.208.101.143] Rostelecom RU) @099.ru (unknown[94.139.208.16][94.26.52.146]) @0999.co.jp (unknown[91.186.109.27] MTS PJSC RU PBL1726339) @09albam.com (55-116-107-89.kamensktel.ru[89.107.116.55] Closed Joint Stock Company Radiotelephone RU XBL) @0u90.co.jp (unknown[90.188.44.11] Rostelecom RU) A proposed "general" ruleset to prevent the Phishing messages using above-mentioned sender domains. ----- /^noreply@09.*/ (Phishing) /^apple_support@09.*/ (Phishing) /^account-security-noreply@09.*/ (Phishing) /@0-99\.com$/ (Phishing) /@0u90\.co\.jp$/ (Phishing) ------