amuck-landowner

LunaNode being booted from SingleHop

lbft

New Member
Spamhaus does have a bit of a reputation for being very difficult to work with if they don't know you, but then again we are only hearing one side of the story here. 

Either way I can't see any amicable resolution coming when they've already decided someone's a spam operation and when someone's threatened them with reporting to law enforcement/regulatory bodies.
 
Last edited by a moderator:

Wintereise

New Member
I dunno, I took a new network online last August.

They were initially trying to be very stern, but I explained our situation -- and verified that the client indeed got booted (This was ROKSO stuff, even), and they worked with me to remove us off the list. No bullshit, no nothing.

But yeah, moral of the story: own your IPs if IPs are prime commodity to your business.
 

perennate

New Member
Verified Provider
Either way I can't see any amicable resolution coming when they've already decided someone's a spam operation and when someone's threatened them with reporting to law enforcement/regulatory bodies.
We did not threaten them to do that. We simply did it.
 

nunim

VPS Junkie
Also I really don't know what else we can do to convince them. We've already informed them of the changes, especially the manual screening.  We've told them that we'd be happy to take additional actions if they deem what we've done so far to be insufficient. But they responded once and now seem to be ignoring our emails.
So you've submitted a delisting request for http://www.spamhaus.org/sbl/query/SBL207665  and you've received no response?  I've always found them quite reasonable to work with and not prone to false positives like some of the other listing services.
 

SkylarM

Well-Known Member
Verified Provider
Spamhaus has always been good to us :) They'd forward a complaint we'd suspend and reply/use their typical forms.
 

Aldryic C'boas

The Pony
Trying to get listing removed en masse is one of the reasons you're having problems.  You should be using the provided links for each SBL to email about the individual cases.
 

perennate

New Member
Verified Provider
Trying to get listing removed en masse is one of the reasons you're having problems.  You should be using the provided links for each SBL to email about the individual cases.
We sent emails about some of them like the listing of our web server. We have not received a response to any of those.

Since we do not own these IP addresses, generally SingleHop contacts them individually. We are listed on SWIP though.

At this point do you think we should still email about each case? Because we'd be sending the same thing for each one.
 
Last edited by a moderator:

Aldryic C'boas

The Pony
Hmm, odd indeed.  In a decade of working with them, it is exceedingly rare that I had to wait more than an hour for a reply.

I saw it mentioned a few times that this wasn't your IP space, but it was being leased to you?  Makes one wonder if the IP space was already dirty, or had past issues, and you're inheriting that mess as well.  Keep in mind that there several notorious companies using 'front' names to sell to spammers and avoid getting themselves dirty (ColoCrossing->Velocity is a very good example of this;  DirectSpace is another example).  I bring them up just to point out that Spamhaus has to deal with "we didn't know it was a spammer - really" excuse pretty regularly, and it's very possible that they're trying to dig deeper to see what's really going on.

Selling IP blocks isn't helping you either - looking at those SBLs, all the IPs are sequential.  All it's going to take is a single spammer to make it look like you knowingly resell blocks to shady folks.  Also worth keeping in mind that the listing is for SingleHop directly - Spamhaus may be expecting them to get involved, since the IP space is in their name.  It's worth getting with SingleHop directly, explaining to them all the steps you've taken, and asking them to step forward as well.  If they do, it'll likely help out a great deal.  And if they refuse?  You have no reason to stay with them anyway.

Folks are right though - you need your own IP space.  Then even if you have to deal with persistent SBLs, you won't be getting eviction notices over it.
 

Francisco

Company Lube
Verified Provider
Hmm, odd indeed.  In a decade of working with them, it is exceedingly rare that I had to wait more than an hour for a reply.

I saw it mentioned a few times that this wasn't your IP space, but it was being leased to you?  Makes one wonder if the IP space was already dirty, or had past issues, and you're inheriting that mess as well.  Keep in mind that there several notorious companies using 'front' names to sell to spammers and avoid getting themselves dirty (ColoCrossing->Velocity is a very good example of this;  DirectSpace is another example).  I bring them up just to point out that Spamhaus has to deal with "we didn't know it was a spammer - really" excuse pretty regularly, and it's very possible that they're trying to dig deeper to see what's really going on.

Selling IP blocks isn't helping you either - looking at those SBLs, all the IPs are sequential.  All it's going to take is a single spammer to make it look like you knowingly resell blocks to shady folks.  Also worth keeping in mind that the listing is for SingleHop directly - Spamhaus may be expecting them to get involved, since the IP space is in their name.  It's worth getting with SingleHop directly, explaining to them all the steps you've taken, and asking them to step forward as well.  If they do, it'll likely help out a great deal.  And if they refuse?  You have no reason to stay with them anyway.

Folks are right though - you need your own IP space.  Then even if you have to deal with persistent SBLs, you won't be getting eviction notices over it.
Just as you say that.....

http://www.spamhaus.org/sbl/query/SBL208547

http://www.spamhaus.org/sbl/query/SBL208537

Fran
 

DomainBop

Dormant VPSB Pathogen
/18 muchos IPs muchas gracias Spamhaus

198.46.192.0/18 is listed on the Spamhaus Block List - SBL 2013-12-22 18:44:24 GMT | velocity-servers.net snowshoe spam range

shad02.gif


This entire range has been leased to professional spammers... again. Unlikely to be removed from SBL any time soon.


Based on research, analysis of network records, our own intelligence sources and our experience, Spamhaus believes that this IP address range is being used or is about to be used for the purpose of high volume spam emission.


As a precaution we are listing this range in an SBL Advisory until we are able to determine with certainty exactly who is operating these domains/hosts/servers and also verify the opt-in permission status and origin of whatever lists are used for those mailings.


NetRange: 198.46.128.0 - 198.46.255.255


CIDR: 198.46.128.0/17


OriginAS: AS36352


NetName: CC-13


NetHandle: NET-198-46-128-0-1


Parent: NET-198-0-0-0-0


NetType: Direct Allocation


RegDate: 2013-03-12


Updated: 2013-03-12


Ref: http://whois.arin.net/rest/net/NET-198-46-128-0-1


OrgName: ColoCrossing


OrgId: VGS-9


Address: 8469 Sheridan Drive


Address: ATTN: ARIN


City: Williamsville


StateProv: NY


PostalCode: 14221


Country: US


RegDate: 2005-06-20


Updated: 2012-01-10


Ref: http://whois.arin.net/rest/org/VGS-9


OrgTechHandle: NETWO882-ARIN


OrgTechName: Network Operations


OrgTechPhone: +1-800-518-9716


OrgTechEmail: [email protected]


OrgTechRef: http://whois.arin.net/rest/poc/NETWO882-ARIN


OrgNOCHandle: VIALA-ARIN


OrgNOCName: Vial, Alex


OrgNOCPhone: +1-716-335-9628


OrgNOCEmail: [email protected]


OrgNOCRef: http://whois.arin.net/rest/poc/VIALA-ARIN


OrgAbuseHandle: ABUSE3246-ARIN


OrgAbuseName: Abuse


OrgAbusePhone: +1-800-518-9716


OrgAbuseEmail: [email protected]


OrgAbuseRef: http://whois.arin.net/rest/poc/ABUSE3246-ARIN


sample domain:


Domain name: promorevenue.com


Registrant Contact:


Shoppers Savings Spree


Domain Admin ()


Fax:


4225 Miller Rd. B-9 #258


Flint, MI 48507


US


Administrative Contact:


Shoppers Savings Spree


Domain Admin ([email protected])


1.866-693-0536


Fax: 1.866-693-0536


4225 Miller Rd. B-9 #258


Flint, MI 48507


US
 
Last edited by a moderator:

perennate

New Member
Verified Provider
Trying to get listing removed en masse is one of the reasons you're having problems.  You should be using the provided links for each SBL to email about the individual cases.
This may have worked. I'm not sure yet, as our webserver is still listed despite in not sending spam. I'm not sure why they only replied to the ones I sent today, and not the ones a few days ago, maybe someone else started handling it.
 
Top
amuck-landowner