-1

I've come across several IPs that are marked as belonging to RIM/Blackberry but seem to be a source of spam/fake users to our sites, examples :

http://whatismyipaddress.com/ip/93.186.16.213

http://whatismyipaddress.com/ip/93.186.23.80

Normally we this this warning ("recently reported spam source") with tor nodes and such, but how can spam be coming from the RIM network ?

Sherif Buzz
  • 283
  • 1
  • 3
  • 16
  • 1
    Users using BBs usually have a dedicated specific service plan (BIS). BIS user traffic goes through RIM gateway first before it reaches you (think of BIS as a proxy). What you're seeing is probably compromised/malicious end-user devices. Can you match up user agents to the IPs which are registering to your site? That may tell you more. – emtunc Dec 27 '12 at 20:02
  • 1
    The "bad BB" traffic is definitely coming from BBs. So yes the most probable explanation is the one you gave. – Sherif Buzz Dec 27 '12 at 20:07

2 Answers2

1

Looking at the links they are proxy servers, most likely for services RIM/Blackberry offer. I would contact the abuse department at RIM and they might be able to confirm. - abuse@rim.com

Epaphus
  • 1,021
  • 6
  • 8
0

Doing a google for "Research In Motion UK Limited recently reported spam source" returns tons of results of people complaining about dating/romance scammers using similar IPs.

Obviously not an isolated issue with me.

I have sent to RIM about the IPs I have, but this seems to be a rather bigger issue than a few IPs. So much for RIM being the "secure one".

Sherif Buzz
  • 283
  • 1
  • 3
  • 16
  • You will see the same for mobile phone network operators, as more people use get 3G cards for laptops and use their mobile phones as 3G modems – Epaphus Dec 27 '12 at 20:41