Spamhaus listing us for being listed and will not remove listings now?

[lbft]

Certain people keep claiming that. Yet there are frequent (very plausible) stories from people having issues getting Spamhaus to respond reasonably - or even respond at all. So how does that work?

Very plausible? Almost all of those stories come from people I wouldn't trust to run a clean network.

 

[joepie91]

Certain people keep claiming that. Yet there are frequent (very plausible) stories from people having issues getting Spamhaus to respond reasonably - or even respond at all. So how does that work?

Very plausible? Almost all of those stories come from people I wouldn't trust to run a clean network.

I've seen e-mail threads.

 

[Munzy]

I still don't understand why providers don't install fail2ban, and unattended-upgrades by default.

 

[rds100]

Fail2ban by default is likely to result in customer complaints / support desk nightmare from customers who fail to type correctly their passwords. But unattended-upgrades by default sounds reasonable.

 

[Munzy]

Fail2ban by default is likely to result in customer complaints / support desk nightmare from customers who fail to type correctly their passwords. But unattended-upgrades by default sounds reasonable.

The thing is, so what if fail2ban blocks them initially. In the long run it makes by far more sense to have. That way you aren't having to spend time cleaning up a compromised vm, reporting to authorities, dealing with spamhaus, etc. It just makes sense. The other great thing about fail2ban is it isn't idiotic. A simple reboot will generally clear the listing, and it would protect at least a little from initial weak password combos.

 

[AuroraZero]

This may be a stupid question but did these ips happen to belong to someone else before they were swiped to you? If that is the case they may have been listed more times then you know of, and this may be the problem.

 

[mitgib]

Fail2ban by default is likely to result in customer complaints / support desk nightmare from customers who fail to type correctly their passwords. But unattended-upgrades by default sounds reasonable.

The thing is, so what if fail2ban blocks them initially. In the long run it makes by far more sense to have. That way you aren't having to spend time cleaning up a compromised vm, reporting to authorities, dealing with spamhaus, etc. It just makes sense. The other great thing about fail2ban is it isn't idiotic. A simple reboot will generally clear the listing, and it would protect at least a little from initial weak password combos.

https://www.serverping.net/clients/cart.php?a=confproduct&i=1 intergrates with WHMCS and WHM with csf installed so clients can unban themselves

 

[coreyman]

This may be a stupid question but did these ips happen to belong to someone else before they were swiped to you? If that is the case they may have been listed more times then you know of, and this may be the problem.

ARIN assigned these ips to us at the beginning of this year.

Fail2ban by default is likely to result in customer complaints / support desk nightmare from customers who fail to type correctly their passwords. But unattended-upgrades by default sounds reasonable.

The thing is, so what if fail2ban blocks them initially. In the long run it makes by far more sense to have. That way you aren't having to spend time cleaning up a compromised vm, reporting to authorities, dealing with spamhaus, etc. It just makes sense. The other great thing about fail2ban is it isn't idiotic. A simple reboot will generally clear the listing, and it would protect at least a little from initial weak password combos.

What does fail2ban have to do with spamhaus being non supportive?

 

[DomainBop]

They listed our range because we had reports back in May, but have only had 4 reports in the last two months.

12 reports, including 2 escalations on that one /24 in the past 4 months is quite a bit, and even if Spamhaus removes that SBL a large percentage of your customer's emails are still going to be blocked in many places because the reputation of most of the IPs on that /24 is absolute shit at SenderBase:  http://www.senderbase.org/lookup/?search_string=104.255.96.0 .  Looking at another of your blocks 104.255.98.x , I'd be shocked if the 50+ IPs used for *.whiterteeth.com subdomains aren't being used for either email spam or comment spamming.

 

[coreyman]

They listed our range because we had reports back in May, but have only had 4 reports in the last two months.

12 reports, including 2 escalations on that one /24 in the past 4 months is quite a bit, and even if Spamhaus removes that SBL a large percentage of your customer's emails are still going to be blocked in many places because the reputation of most of the IPs on that /24 is absolute shit at SenderBase:  http://www.senderbase.org/lookup/?search_string=104.255.96.0 .  Looking at another of your blocks 104.255.98.x , I'd be shocked if the 50+ IPs used for *.whiterteeth.com subdomains aren't being used for either email spam or comment spamming.

In the past two months there have been 4 reports total on that 96.x range. Of course the reputation is going to be absolute sht, we are listed in the SBL!!

IF you haven't noticed, most of those reports are for TINBA BOTNET controllers. These do not emit email spam.

 

[DomainBop]

They listed our range because we had reports back in May, but have only had 4 reports in the last two months.

12 reports, including 2 escalations on that one /24 in the past 4 months is quite a bit, and even if Spamhaus removes that SBL a large percentage of your customer's emails are still going to be blocked in many places because the reputation of most of the IPs on that /24 is absolute shit at SenderBase:  http://www.senderbase.org/lookup/?search_string=104.255.96.0 .  Looking at another of your blocks 104.255.98.x , I'd be shocked if the 50+ IPs used for *.whiterteeth.com subdomains aren't being used for either email spam or comment spamming.

In the past two months there have been 4 reports total on that 96.x range.

Spamhaus tends to take a longer term view of IP SBL reports for an IP block or network operator than just the past 2 months ,so when they decide to escalate they'll usually look back at the cumulative SBL history over the past 6-12 months.

 

[coreyman]

They listed our range because we had reports back in May, but have only had 4 reports in the last two months.

12 reports, including 2 escalations on that one /24 in the past 4 months is quite a bit, and even if Spamhaus removes that SBL a large percentage of your customer's emails are still going to be blocked in many places because the reputation of most of the IPs on that /24 is absolute shit at SenderBase:  http://www.senderbase.org/lookup/?search_string=104.255.96.0 .  Looking at another of your blocks 104.255.98.x , I'd be shocked if the 50+ IPs used for *.whiterteeth.com subdomains aren't being used for either email spam or comment spamming.

In the past two months there have been 4 reports total on that 96.x range.

Spamhaus tends to take a longer term view of IP SBL reports for an IP block or network operator than just the past 2 months ,so when they decide to escalate they'll usually look back at the cumulative SBL history over the past 6-12 months.

So after spamhaus finally decides to send over all the tinba botnet controller reports all on the same day, then they escalate you for botnet hosting right after, and then you get listed ~ 3-4 months later it's an automatic range blacklist time with no redemption? Seems legit.

 

[RLT]

yep that whiterteeth.com home page looks real legit. Placeholder type of page with 50 sub-domains..

To be on a SBL that 54% increase in email volume is interesting. Add in the 5 + average for the past month. My they're busy little typers aren't they.

I wonder what viber-marketing.info is?

 

[Munzy]

This may be a stupid question but did these ips happen to belong to someone else before they were swiped to you? If that is the case they may have been listed more times then you know of, and this may be the problem.

ARIN assigned these ips to us at the beginning of this year.

Fail2ban by default is likely to result in customer complaints / support desk nightmare from customers who fail to type correctly their passwords. But unattended-upgrades by default sounds reasonable.

The thing is, so what if fail2ban blocks them initially. In the long run it makes by far more sense to have. That way you aren't having to spend time cleaning up a compromised vm, reporting to authorities, dealing with spamhaus, etc. It just makes sense. The other great thing about fail2ban is it isn't idiotic. A simple reboot will generally clear the listing, and it would protect at least a little from initial weak password combos.

What does fail2ban have to do with spamhaus being non supportive?

Nothing really, it is in regards to the fact that many of the listing on spamhaus are because of exploits and compromised servers. It was a way to help prevent it.

 

[coreyman]

This may be a stupid question but did these ips happen to belong to someone else before they were swiped to you? If that is the case they may have been listed more times then you know of, and this may be the problem.

ARIN assigned these ips to us at the beginning of this year.

Fail2ban by default is likely to result in customer complaints / support desk nightmare from customers who fail to type correctly their passwords. But unattended-upgrades by default sounds reasonable.

The thing is, so what if fail2ban blocks them initially. In the long run it makes by far more sense to have. That way you aren't having to spend time cleaning up a compromised vm, reporting to authorities, dealing with spamhaus, etc. It just makes sense. The other great thing about fail2ban is it isn't idiotic. A simple reboot will generally clear the listing, and it would protect at least a little from initial weak password combos.

What does fail2ban have to do with spamhaus being non supportive?

Nothing really, it is in regards to the fact that many of the listing on spamhaus are because of exploits and compromised servers. It was a way to help prevent it.

I already have some things in place that prevent tons of connections to a single ip address, and nodewatch tests passwords, so idk.

 

[Munzy]

I already have some things in place that prevent tons of connections to a single ip address, and nodewatch tests passwords, so idk.

I'm not saying you don't. One of the big flaws I always saw with openvz were there crappy templates, that didn't have as good of decisions being made. I guess I would run things differently if I was running them.

 

[coreyman]

Just an update. I sent this.

When will you be able to help us? Look, we have lots of customers
waiting on this listing to be removed. What do we need to do on our end
to fix this?

Thomas replied with.

Hello Corey

Since this is already the second (!) escalation listing due to massive
botnet hosting, I doubt that we will be able to remove this listing in
the near future.

Thanks for your understanding.

--
Best regards
Thomas Morrison

SBL Removal Team
The Spamhaus Project
Geneva, Switzerland
http://www.spamhaus.org

So I guess two botnet reports in the past two months is considered 'massive botnet hosting'.

 

[Gary]

So I guess two botnet reports in the past two months is considered 'massive botnet hosting'.

It doesn't say two is massive, it says there were two which were massive. Whether they were or not is another matter, of course.

 

[DomainBop]

Just an update. I sent this.

When will you be able to help us? Look, we have lots of customers
waiting on this listing to be removed. What do we need to do on our end
to fix this?

Thomas replied with.

Hello Corey

Since this is already the second (!) escalation listing due to massive
botnet hosting, I doubt that we will be able to remove this listing in
the near future.

Thanks for your understanding.

--
Best regards
Thomas Morrison

SBL Removal Team
The Spamhaus Project
Geneva, Switzerland
http://www.spamhaus.org

So I guess two botnet reports in the past two months is considered 'massive botnet hosting'.

To get yourself back in their good graces the next time you contact them you should tell them what you've done to prevent it from happening again, i.e. "We implemented xyz monitoring to detect/prevent botnets...", "We implemented xyz during registration to reduce the number of abusive clients signing up...", etc.  Spamhaus is also like google and expects you to kiss their ass in all communications (even when it is entirely their fault) so don't lose your temper when communicating with them...

----------------------

Semi off-topic, Spamhaus (finally) went after a lot of the crap on AWS today (AWS has been a huge source of crap over the years: email and comment SPAM, bots..especially SEO bots) , lots of Amazon SBL's issued today and Amazon now has 185 SBL's and is sitting in the #2 spot on the Spamhaus worst ISP list.  +1 for whacking Bezos & Co.

 

[IndoVirtue]

Look at the key points on the SBL pages: "Can't trust this IP space at the moment."

At the moment. I would suggest leaving that /24 IP idling for 1 ~ 3 months. Explain to the VPS customer your circumstance and the need for an IP change (I'm aware and admit that this is actually sounds easier than doing it). After that, you can contact them again to remove the listing. State that the IP has been cleaned from the abusers and not being used for some months already (in a non-aggressive way). Then ask them politely if there's any additional steps or information needed in order to remove that listing. They might go on defensive mode again if your tone is deemed a bit aggressive by them.

The goal here is to get the IP delisted. Questioning and making a problem of their decision, even if you're in the right, might not yield a good results.

If you do it right, it should work. Source? I'm not authorized at the moment to disclose the source info