amuck-landowner

LunaNode being booted from SingleHop

MannDude

Just a dude
vpsBoard Founder
Moderator
[Luna Node] Important notice regarding all services


SpamHaus Project Ltd., a company registered in London which maintains a


spammer blacklist, has threatened our service provider, SingleHop LLC,


that SpamHaus will blacklist all IP ranges assigned to SingleHop LLC


unless our (Luna Node) services with SingleHop LLC are terminated. As


such, SingleHop LLC has informed us that, unless this issue is resolved,


they will be closing our account on December 31st, 2013. We have


contacted SpamHaus Project Ltd., however they are now ignoring our


communications and refusing to work with us. We are still in the process


of discussing the issue with SpamHaus, but if this is unsuccessful, we


will be migrating all services to BurstNET's Scranton, PA datacenter.


On December 4th, 2013, a spammer began registering multiple accounts on


our billing system. We received reports of spam activity through SBL


listings and other sources, and terminated each account found to be


conducting spamming activities within a few hours after each report. By


December 15th, 2013, we had found the linkage between the accounts and


blocked the common IP subnet from which the orders originated. A few


days later, we also adjusted our policies and began conducting manual


screenings on all new clients to curb spamming activity on our network.


However, at the same time, due to the multiple blacklistings, SpamHaus


apparently incorrectly came to the conclusion that we were providing the


same spammer with a IP address each time we received a blacklist. As


stated above, they began illegally blackmailing our service provider and


pressuring SingleHop LLC to terminate our services. We immediately


responded with clarification of the policy changes that we were


implementing, including the manual screening of new customers (by


validating residential IP address, physical address, phone number, and


other provided data) and the considering of blocking outgoing


connections to port 25 by default on newly provisioned virtual machines.


Yet, after December 18, 2013 we have received no response from SpamHaus


and they appear to be ignoring our emails; again, we are still


attempting to communicate with them at this time. They have additionally


started listing arbitrary ranges assigned to Luna Node, including our


web server (which does not send any mail).


Due to the possibility that SpamHaus will continue to ignore our


communications, we are sending this notification and also preparing a


backup plan involving migration to new servers with Luna Node in


Scranton. You have the following options:


* Continue with the migration to our servers in Scranton, PA. This will


involve a change of IP address assignment.


* Pro rata refund for active services


The first option will be taken as default. If you would like a refund,


please open a ticket from the client area.


We have researched this antispam group and have found that they have


similarly affected other businesses, and that their actions are in fact


illegal by both EU and US laws. For more information, see the links below:


* http://www.quackpotwatch.org/opinionpieces/spamhausspewsaffidavit.htm


*


http://www.techweekeurope.co.uk/news/dutch-isp-hits-spamhaus-with-police-complaints-42302


* http://www.a2b-internet.com/spamhaus/


We have thus notified the appropriate agencies, including the United


States Federal Trade Commission and the Federal Bureau of Investigation,


by filing a complaint through the Internet Crime Complaint Center (ic3.gov).


If you have any questions, please open a support ticket. We apologize


for the impact to your services; we have spent considerable effort so


far to no avail to deal with SpamHaus' illegal actions, both by


attempting to cooperate with them and informing law enforcement agencies.


Best,


Jason Lee


Luna Node
That's too bad. I like SingleHop and it's nice having a solid Chicago alternative to the rest.
 

MannDude

Just a dude
vpsBoard Founder
Moderator
Then again I think they were doing like 14 IP VPSes for $7/mo~... so I guess it's not a big surprise they may have attracted some not-so-good clients. Too bad.
 

lunanode

New Member
Verified Provider
We are migrating our clients who choose to remain with us to BurstNET PA scranton facility where we will own our own hardware, and be able to service our own equipment as opposed to leasing from Singlehop.

We have been a client of singlehop for three years and never had a problem with spam until we started offering low end VPS products, and although we complied with the abuse reports and immediately suspended the clients who allegedly have been sending bulk unsolicited emails, we are still being forced to have our account terminated.

Having done the research on spamhaus, although in theory I agree with what they are trying to do, but their practice of illegally blackmailing ISP to terminate client's accounts, when the client is also a service provider is simply unacceptable. Also especially when we have done our part to the best of our abilities by manually screening new accounts and considering blocking of all outgoing traffic on port 25 by default. Too bad at this point in time there is not any legal measure that can be taken to prevent this from happening.

With all that said, we see this as an opportunity and experiences like these will continue to add to our experience and help us to assist our clients better in the future.
 

drmike

100% Tier-1 Gogent
What 14 IPs in a package?  Why would anyone....

Lunanode is a member here... Hoping they say something.  Cause the letter calling SpamHaus illegal and all that jazz, wow, yeah, wrong bubba.  That might fly with newbie users.  Rest of us know SpamHaus has issues but illegal, ahh no. 

Burst is certainly a downgrade.
 

perennate

New Member
Verified Provider
Then again I think they were doing like 14 IP VPSes for $7/mo~... so I guess it's not a big surprise they may have attracted some not-so-good clients. Too bad.
The additional IP addresses are in a /29 or /28 block, which I think isn't useful for spammers anyway. Almost all of the abuse came from clients with /30 (one useable IP) and /29 blocks. We already dealt with the issues and have instituted manual screening of new customers; yet SpamHaus is refusing to acknowledge any of our communications, despite us reiterating that we are willing to work with them.
 

perennate

New Member
Verified Provider
Lunanode is a member here... Hoping they say something.  Cause the letter calling SpamHaus illegal and all that jazz, wow, yeah, wrong bubba.  That might fly with newbie users.  Rest of us know SpamHaus has issues but illegal, ahh no.
See http://www.quackpotwatch.org/opinionpieces/spamhausspewsaffidavit.htm for an explanation of which laws SpamHaus has repeatedly violated. Also note that E360 won a lawsuit against SpamHaus in 2011, although the legal fees ended up being more than the penalty SpamHaus was forced to pay. SpamHaus mostly targets small companies like us, and we don't have the money to pay for a lawsuit.

Edit: corrected A2B Internet -> E360. See http://en.wikipedia.org/wiki/The_Spamhaus_Project#e360_Lawsuit

The penalty was dropped from $11 million, to $27,000, and then to $3 on appeal.

Edit2: also I'd think it'd be the newbie users who don't understand the shady things SpamHaus does.

Edit3: and the reason the penalty was dropped was not because they didn't think SpamHaus did illegal things, but because E360 couldn't demonstrate that they had actually suffered as much of a loss to their revenue as what they claimed.
 
Last edited by a moderator:

drmike

100% Tier-1 Gogent
"blackmailing ISP to terminate client's accounts, when the client is also a service provider is simply unacceptable"

How do they do that?  Threaten to list larger IP blocks / all of the provider's ranges?  Sounds effective to me :)  Don't want companies playing whack-a-mole with the migrating spammers.

When stuff like this happens I think of other plagued networks with spam. CC anyone?   They all seem to survive and inevitably accounts are shuttered and some folks shown the door... or their new IP ranges.

Sad that providers don't have better intergration with their upstream.  Applies to SPAM issues as well as the often used DDoS issue.
 

perennate

New Member
Verified Provider
Sad that providers don't have better intergration with their upstream.  Applies to SPAM issues as well as the often used DDoS issue.
We communicated with SingleHop and with SpamHaus, but SpamHaus refused to delist the IP ranges despite our resolution of all issues and institution of manual screening of new customer data.

How many clients caused this issue?
Primarily a single client who registered eight accounts from different IP addresses. We terminated all of the accounts and blocked the common subnet, as stated in the email.

Were you able to identify the clients?  Were their accounts and payments valid?
The client was identified and we have not had further issues after blocking his subnet and disabling automatic provisioning for new clients. The names, addresses, and other information were most likely faked, although appeared legitimate. There is no indication that the payments were not "valid".

How do they do that?  Threaten to list larger IP blocks / all of the provider's ranges?  Sounds effective to me :)  Don't want companies playing whack-a-mole with the migrating spammers.
We already curbed abuse with manual screening. We contacted SpamHaus and informed them we would also be willing to make further adjustments if they found the other policy changes insufficient. They are ignoring all of our communications.
 
Last edited by a moderator:

jarland

The ocean is digital
The spammer must have really been successful for it to come to this. Heavy handed as SpamHaus may be, they would be working toward their own irrelevance if a little spam caused them to start blacklisting such large subnets every day. After a while they would just be a list of subnets that, if subscribed to, would cripple the internet entirely. So I hope LunaNode has learned a lesson about policing outbound e-mail, as a provider you just have to monitor for high traffic of certain types and you have to open a dialogue, followed by port blocks if they don't respond soon, and eventual termination if they don't respond at all. Privacy and all that jazz is nice, but no one wants the kind of privacy that comes as "Your e-mails will be so private that they won't even reach anyone's inbox."

Best of luck to the guys.
 

perennate

New Member
Verified Provider
The spammer must have really been successful for it to come to this. Heavy handed as SpamHaus may be, they would be working toward their own irrelevance if a little spam caused them to start blacklisting such large subnets every day. After a while they would just be a list of subnets that, if subscribed to, would cripple the internet entirely. So I hope LunaNode has learned a lesson about policing outbound e-mail, as a provider you just have to monitor for high traffic of certain types and you have to open a dialogue, followed by port blocks if they don't respond soon, and eventual termination if they don't respond at all. Privacy and all that jazz is nice, but no one wants the kind of privacy that comes as "Your e-mails will be so private that they won't even reach anyone's inbox."

Best of luck to the guys.
We have suspended all virtual machines where reports were received about spam within a few hours after receiving the report.
 
Last edited by a moderator:

drmike

100% Tier-1 Gogent
Oy vey!

You lads are getting spanked by one user's actions.  This is very unfortunate.

I agree with @jarland, sounds like a good heavy load of spam was involved here.

I ask about the subscribers because when/if stuff like this happens, there should be provider database for these users and to shame / block their future attempts.

Would be nice to see the garbage they were sending out.
 

perennate

New Member
Verified Provider
Spam can go on for weeks before reports. Monitor port 25 and open a ticket at x number of simultaneous connections. It's worth it.
We'll try to work on that as an alternative to blocking outgoing traffic to port 25 by default. However SpamHaus doesn't seem to care either way, it's easier for them to just shut down small companies.

Either way, the same situation won't happen again with the disabled automatic provisioning for new clients.
 
Last edited by a moderator:

DomainBop

Dormant VPSB Pathogen
Are you positive that moving to BurstNet will solve your problems with Spamhaus?  If you don't convince them that you're innocent they'll probably blacklist any IP you move to since they've labeled you a "spam hosters / operation".

SBL207665 184.154.99.0/27 singlehop.com 15-Dec-2013 07:21 GMT lunanode.com spam hosters / operation  

SBL207663 173.236.82.176/28 singlehop.com 15-Dec-2013 07:09 GMT LunaNode sapm block  

SBL207344 108.163.229.224/28 singlehop.com 12-Dec-2013 05:07 GMT LunaNode spa block  

SBL206962 69.175.68.128/28 singlehop.com 08-Dec-2013 22:43 GMT LunaNode spam block  

SBL206907 173.236.14.32/28 singlehop.com 08-Dec-2013 19:25 GMT LunaNode spam block  

SBL206845 173.236.15.240/28 singlehop.com 08-Dec-2013 06:50 GMT LunaNode spam block  
 
Last edited by a moderator:

perennate

New Member
Verified Provider
Are you positive that moving to BurstNet will solve your problems with Spamhaus?  If you don't convince them that you're innocent they'll probably blacklist any IP you move to since they've labeled you a "spam hosters / operation".

SBL207665 184.154.99.0/27 singlehop.com 15-Dec-2013 07:21 GMT lunanode.com spam hosters / operation  

SBL207663 173.236.82.176/28 singlehop.com 15-Dec-2013 07:09 GMT LunaNode sapm block  

SBL207344 108.163.229.224/28 singlehop.com 12-Dec-2013 05:07 GMT LunaNode spa block  

SBL206962 69.175.68.128/28 singlehop.com 08-Dec-2013 22:43 GMT LunaNode spam block  

SBL206907 173.236.14.32/28 singlehop.com 08-Dec-2013 19:25 GMT LunaNode spam block  

SBL206845 173.236.15.240/28 singlehop.com 08-Dec-2013 06:50 GMT LunaNode spam block  
The five records are related to the customer who registered multiple accounts. The first record is our web server, which doesn't send any email (we have a dedicated mail server outside of SingleHop LLC's network). We're not positive of anything since SpamHaus Project Ltd. is ignoring our communications, but presumably they won't blacklist our IP address blocks with BurstNET if no spam is sent.
 
Last edited by a moderator:

lunanode

New Member
Verified Provider
Not certain, but that is a possibility that what you mentioned could happen. I discussed this with perennate, and if it does come to that, despite the preventative measures that we will take, as well as continuing to try to establish communication with spamhaus, we might just need to go with a new name : /
 
Top
amuck-landowner