amuck-landowner

Colocrossing Achieves Top 5 Rank

DomainBop

Dormant VPSB Pathogen
Time for a quick update because Spamhaus escalated another /17 today.  That makes 3 x /15 and 2 x /17 on SBL's.  A total of 459,984 of ColoCrossing's 724,480 IP addresses are now blacklisted by Spamhaus.  That is 63.5%.

Biloh's slimy salesman spiel excuses for the SPAM and blacklistings (the "they just don't understand the commodity VPS cloud market" bullshit)  that he has been using to try to explain the blacklistings might fool some of his puppy dogs like mpkossen but it isn't fooling Spamhaus, and rumor has it the likelihood of more large blocks being blacklisted and if necessary the entire AS 36352 is very real. Spamhaus is also still advising its users to block all SMTP traffic coming from ColoCrossing IP space. 

With 63.5% of IPs now blacklisted Biloh may need to revise downward his $12 million revenue projection for the current fiscal year...and if the entire ASN gets whacked he may need to do a fire sale.

Biloh and his underlings have been feeding hosting providers on their network who are affected by the blacklistings a steaming pile of bullshit and telling them the SBL's will be cleaned up soon.  It won't be soon. The large blocks aren't going to be removed until the CC IP space has been cleaned and CC shows it is fighting SPAM proactively and has implemented measures to reduce the volume of SPAM coming from its network, rather than only making token gestures (i.e. lying to Spamhaus) after an IP gets placed on an SBL. .

Since Biloh and Vial seem rather  dense, I'll repeat what Spamhaus has told them repeatedly:

1. implement rate limiting on outbound SMTP traffic

2. require ID verification of all new users on the CC network until ColoCrossing has proven that they are working to proactively fight SPAM.

Implementing those 2 steps isn't an option any more...it's a requirement if CC wants to get out of the doghouse.
 
Last edited by a moderator:

drmike

100% Tier-1 Gogent
And CC knew what DomainBOP just said before  (rate limit + IDs) that oh so timely new user went to posting on LET -- saying

Spamhaus = BULLY, Spamhaus = organized racketeers.

Way I see it, Velocity Servers operate a RICO - racketeering organization and has for multiple years.

Since Biloh and Vial seem rather  dense

No they play retarded while pursuing more cashola.   They are free of budensome ethics and couldn't care less  about speed bumps to get to the next big pay day.  Not like their network has in recent history a sterling reputation.  More dirt bags, hackers, malicious traffic, comment spammers, email spammers, etc. than anyone realizes.

Big picture CC will whine and cry this is all unfair.  They can't ID customers, cause those are their customers ehh customers.. Privacy yo!  But they neglect to mention they may be passing said downstream customer info to ARIN and who knows who else to justify away those IPs...  never disclosed... just ahh necessary blah blah...

Anyone who buys on CC's network at this point is either a newbie, a child playing or purely buying only for crazy deals...  Providers jumping into their bed of sin, you deserve all the wasted time with pissed customers... You deserve what befalls you.  You are harming your own business by being cheap and non-logical.

Multiple downstream providers have told me of their horrors for months now getting clean IPs issued from CC.  Small ranges too.  Of course those providers are getting slapped by their customers too via ticket complaints about broken/blacklisted IPs....

More bread and CC circuses!
 

DomainBop

Dormant VPSB Pathogen
Not like their network has in recent history a sterling reputation.  More dirt bags, hackers, malicious traffic, comment spammers, email spammers, etc. than anyone realizes.
The web based threats coming from their network can be easily reduced...

CSF firewall rules (/etc/csf/csf.deny) to block about 80% of their IPs

198.23.128.0/17 # do not delete    
192.210.128.0/17 # do not delete


23.94.0.0/15 # do not delete


107.172.0.0/14 # do not delete


192.227.128.0/17 # do not delete


206.217.128.0/20 # do not delete


172.245.56.0/21 # do not delete


162.221.180.0/23 # do not delete


107.161.144.0/20 # do not delete


192.3.0.0/16 # do not delete


23.254.0.0/17 # do not delete


198.12.64.0/18 # do not delete


96.8.112.0/20 # do not delete
.

Of course those providers are getting slapped by their customers too via ticket complaints about broken/blacklisted IPs....
The providers' added support costs and increased customer turnover is probably eating up most of the savings from those "crazy deals" they got on the servers.
 

drmike

100% Tier-1 Gogent
The providers' added support costs and increased customer turnover is probably eating up most of the savings from those "crazy deals" they got on the servers.
Honestly,  big picture and look around the room....

Noticed the nastygrams by customers on various sites in past couple of months for CVPS, 123Systems, BlueVM? About laggy to no support.....

Imagine thousands of customers at each --- and imagine IPs getting blacklisted by big blocks - a few /15's some /17's... and things breaking....  Now imagine those poor Indians in ticketing, drowning in curry laced sweat from that mass ticketing wave. Imagine if same team was across a slew of CC companies... Break-it-down.   Certainly has some relationship to the threads and overall ill feelings that the tiny minority that gets to posting is feeling....
 
Last edited by a moderator:

drmike

100% Tier-1 Gogent
Yeah I am on vacation time...  But, my little friends at ColoCrossing are up to their hair-brained shit again.

This symphony routine where CC ratchets up the spam payloads while trolling their own forum with anti-Spamhaus fake-sentiments is getting rather special-needs aka RETARDED.

Colocrossing a/k/a Velocity Servers is back up on the top of the perch at Spamhaus with a DISGRACEFUL 42 Spamhaus entries.

7


velocity-servers.net

Number of Current Known Spam Issues: 42
See: http://www.spamhaus.org/statistics/networks/

In the past 24 hours, Colocrossing has been flagged for SEVEN ROKSO spam listings.

Just look at the horror (sunglasses recommended because of all that yellow):

http://www.spamhaus.org/sbl/listings/velocity-servers.net
 

drmike

100% Tier-1 Gogent
CC will claim they did no such moving... That the bad behavior is from a customer of a VPS provider...  and they have no control over such end customers...

Funny thing is, this one looks to be ChicagoVPS.  Which isn't just some random CC VPS downstream.  CVPS = CC.  Folks can debate the finer points until the coffin nails arrive once and for all.   But those two are so friendly that they share the very same office space, use the same IPs in the past, etc.

Spamhaus starts getting more info from our direction and tying the loose ends in proper knots and CC is going to get MASS listed.

The whack-a-mole game CC is playing is going to hurt them.
 

HalfEatenPie

The Irrational One
Retired Staff
Unsure what they are targetting with that billboard ad... But it is money tossed out the window on fire.

Last thing BUSINESSES want to deal with is some infant/child or a company with the maturity thereof.

Perhaps mom's daycare ad got mixed with the ColoCrossing ad?
Two birds with one stone! They're going halfsies!
 

drmike

100% Tier-1 Gogent
Two birds with one stone! They're going halfsies!
To me it seems more playing up the child exploitation card.  Same youthful distortion crap played out in local zoning / town hearings where their Real Estate person described ColoCrossing as being started by a 10 year old Jon Biloh, rather than the more truthful 16 year old.

Doesn't it seem "cuter" and less threatening to have a 10 year impressed upon minds? (and for all they know in that town hearing - perhaps Jon is a still 10 years old)....  Instead of an often problematic, trouble making teenager....

Even by corporate year, Velocity Servers (their parent company) is about 11 years old (2003 start date).

So a sub 2 year old, fat headed infant, is totally out of place.

Definitely not marketing to their local market like their corporate lives depended on it.
 

Aldryic C'boas

The Pony
That banner is essentially the Fabozzi approach - take a meme and run with it.  Only instead of attempting to emulate the drug-addled washed up Estévez, they went with another image known in the more... youthful circles.

I've got a great slogan to go with it, too - really matches their mentality:  ColoCrossing - still trying to slide our hands into kids' pockets.
 

drmike

100% Tier-1 Gogent
Damn, just looked at Spamhaus for CC...

Today the 25th = 6 entries so far. Of the 6,  one is a Botnet controller.

4 are ROKSO spammers.

All 4 ROKSO clowns are on ChicagoVPS/BlueVM IPs.

Code:
SBL229449 	
CHICAGOVPS
STILL ONLINE
198.23.227.192/26 	velocity-servers.net
25-Jul-2014 19:49 GMT 	
Davi Junior / Email-Master
Spam source - marketingmonalisa.info 	


SBL229445 	
BLUEVM
OFFLINE
23.95.103.132/31 	velocity-servers.net
25-Jul-2014 18:19 GMT 	
Ryan Gillies
Snowshoe spam source 	


SBL229425
BLUEVM
STILL ONLINE
23.95.103.134/32 	velocity-servers.net
25-Jul-2014 14:48 GMT 	
Ryan Gillies
Snowshoe spam source 	


SBL229424 
CHICAGOVPS	
STILL ONLINE
23.95.112.9/32 	velocity-servers.net
25-Jul-2014 14:47 GMT 	
Ryan Gillies
Snowshoe spam source
 
Last edited by a moderator:

DomainBop

Dormant VPSB Pathogen
Damn, just looked at Spamhaus for CC...

Today the 25th = 6 entries so far. Of the 6,  one is a Botnet controller.

4 are ROKSO spammers.

All 4 ROKSO clowns are on ChicagoVPS/BlueVM IPs.

Not all of today's SBL's are on CVPS/BlueVM IPs.  Jon Nguyen and GreenValueHost received an SBL today from Spamhaus for renting an entire /27 block to snowshoe spammers. 

SBL229388 108.174.62.64/27 velocity-servers.net 25-Jul-2014 09:08 GMT Snowshoe netblock

Network

NetRange 108.174.62.64 - 108.174.62.95 CIDR 108.174.62.64/27 Name GREENVALUEHOST Handle NET-108-174-62-64-1 Parent CC-04 (NET-108-174-48-0-1) Net Type Reallocated Origin AS AS36352 Organization Green Value Hosting, Inc. (GVH-7) Registration Date 2013-12-16 Last Updated 2013-12-16 Comments   RESTful Link http://whois.arin.net/rest/net/NET-108-174-62-64-1 See Also Related organization's POC records. See Also Related delegations. Organization Name Green Value Hosting, Inc. Handle GVH-7 Street 200 W NORTH ST PO BOX 972 City Normal State/Province IL Postal Code 61761 Country US Registration Date 2013-07-15 Last Updated 2013-12-11 Comments   RESTful Link http://whois.arin.net/rest/org/GVH-7 Function Point of Contact NOC JONAT8-ARIN (JONAT8-ARIN) Admin JONAT8-ARIN (JONAT8-ARIN) Tech JONAT8-ARIN (JONAT8-ARIN) Abuse JONAT8-ARIN (JONAT8-ARIN) Point of Contact Name Jonathan , Nguyen Handle JONAT8-ARIN Company Green Value Hosting, Inc. Street 200 W NORTH ST PO BOX 972 City Normal State/Province IL Postal Code 61761 Country US Registration Date 2013-07-13 Last Updated 2014-02-22 Comments   Phone +1-312-436-2204 (Office) Email jonathan@******************

abuse@******************

noc@****************** RESTful Link http://whois.arin.net/rest/poc/JONAT8-ARIN

edited post to provide an updated set of CSF firewall ColoCrossing block rules.  Stick these in  /etc/csf/csf.deny

198.23.128.0/17 # do not delete    


192.210.128.0/17 # do not delete


23.94.0.0/15 # do not delete


107.172.0.0/14 # do not delete


192.227.128.0/17 # do not delete


206.217.128.0/20 # do not delete


172.245.56.0/21 # do not delete


162.221.180.0/23 # do not delete


107.161.144.0/20 # do not delete


192.3.0.0/16 # do not delete


23.254.0.0/17 # do not delete


198.12.64.0/18 # do not delete


96.8.112.0/20 # do not delete


138.128.112.0/20 # do not delete


108.174.48.0/20 # do not delete
 
Last edited by a moderator:

D. Strout

Resident IPv6 Proponent
I just ran ten times for the top ten worst SpamHaus networks. The result:

SpamHaus records 89,732 IP addresses marked as spam under 70 SBLs assigned to softbank.co.jp.

SpamHaus records 117,942 IP addresses marked as spam under 61 SBLs assigned to hostnoc.net.

SpamHaus records 314 IP addresses marked as spam under 59 SBLs assigned to chinanet-fj.

SpamHaus records 66,618 IP addresses marked as spam under 59 SBLs assigned to chinanet-hb.

SpamHaus records 56 IP addresses marked as spam under 56 SBLs assigned to unicom-bj.

SpamHaus records 460,040 IP addresses marked as spam under 43 SBLs assigned to velocity-servers.net.

SpamHaus records 49 IP addresses marked as spam under 41 SBLs assigned to technorail.com.

SpamHaus records 109 IP addresses marked as spam under 39 SBLs assigned to dti.ad.jp.

SpamHaus records 42 IP addresses marked as spam under 39 SBLs assigned to unifiedlayer.com.

SpamHaus records 43,264 IP addresses marked as spam under 39 SBLs assigned to jet.ne.jp.
Or, sorted numerically:

SpamHaus records 460,040 IP addresses marked as spam under 43 SBLs assigned to velocity-servers.net.

SpamHaus records 117,942 IP addresses marked as spam under 61 SBLs assigned to hostnoc.net.

SpamHaus records 89,732 IP addresses marked as spam under 70 SBLs assigned to softbank.co.jp.

SpamHaus records 66,618 IP addresses marked as spam under 59 SBLs assigned to chinanet-hb.

SpamHaus records 43,264 IP addresses marked as spam under 39 SBLs assigned to jet.ne.jp.

SpamHaus records 314 IP addresses marked as spam under 59 SBLs assigned to chinanet-fj.

SpamHaus records 109 IP addresses marked as spam under 39 SBLs assigned to dti.ad.jp.

SpamHaus records 56 IP addresses marked as spam under 56 SBLs assigned to unicom-bj.

SpamHaus records 49 IP addresses marked as spam under 41 SBLs assigned to technorail.com.

SpamHaus records 42 IP addresses marked as spam under 39 SBLs assigned to unifiedlayer.com.
ColoCrossing has almost 4 times as many individual bad IPs as it's "next closest competitor", and over 5 times as many bad IPs as SpamHaus' "worst" network. Crazy.
 
Last edited by a moderator:

concerto49

New Member
Verified Provider
I just ran ten times for the top ten worst SpamHaus networks. The result:

Or, sorted numerically:

ColoCrossing has almost 4 times as many individual bad IPs as it's "next closest competitor", and over 5 times as many bad IPs as SpamHaus' "worst" network. Crazy.
Isn't hostnoc BurstNet etc who's literally dead? A lot of the others are real ISPs, so I wouldn't count them in. It's a totally different scenario.
 
Top
amuck-landowner