Jump to content
Sign in to follow this  
marc1

singlehop.com

Recommended Posts

I started getting bunch of spam on a daily basis that originates from IPs owned by singlehop.com. Reports are being sent to abuse[at]singlehop.com, but the spam keeps coming. The IPs are never the same.

Also seeing similar situation from from softlayer.com and cologuys.com.

What is the best way to deal with this. Seems like the ISP has no interest in stopping spam being sent via their servers.

Share this post


Link to post
Share on other sites

Hi, marc!,

<snip>

What is the best way to deal with this. Seems like the ISP has no interest in stopping spam being sent via their servers.

...Just keep reporting 'em, as your time and interest permit! Hopefully, you'll be contributing to keeping them on the SpamCop blacklist and thus contribute to the ability of e-mail providers who use the SCBL to block or sort out the spam. Thanks for reporting spam!

Share this post


Link to post
Share on other sites

it seems to me there are two ways that spamcop works.

one is the blacklist, the second is notifying the ISP that they are sending spam. What is the point of sending abuse notifications if the ISP doesn't address the issue?

Does it make sense in those cases to alert the upstream provider?

Share this post


Link to post
Share on other sites
it seems to me there are two ways that spamcop works.

one is the blacklist, the second is notifying the ISP that they are sending spam. What is the point of sending abuse notifications if the ISP doesn't address the issue?

Does it make sense in those cases to alert the upstream provider?

The second part is the nice part, for those providers who care enough about their reputations to take a hint. The first part is for those who don't; they'll find themselves (and their customers) unable to send mail because the people at the other end are using the SCBL to guard their mailboxes.

If you can accurately determine the upstream for a recalcitrant provider, you can certainly lodge a report with them (you'd have to do it outside SpamCop, I think). Will it accomplish anything? Hard to say.

-- rick

Share this post


Link to post
Share on other sites

I started getting bunch of spam on a daily basis that originates from IPs owned by singlehop.com. Reports are being sent to abuse[at]singlehop.com, but the spam keeps coming. The IPs are never the same.

Also seeing similar situation from from softlayer.com and cologuys.com.

What is the best way to deal with this. Seems like the ISP has no interest in stopping spam being sent via their servers.

I have also started getting lots of snowshoe spam from singlehop. NOC and ABUSE refuse to act upon my complaints. 30 different ip's in the past 25 days.

Who else can I complain to about the spam support singlehop is providing?

Share this post


Link to post
Share on other sites

Who else can I complain to about the spam support singlehop is providing?

It does seem to be a known issue. See, for example:

https://www.google.com/search?q=singlehop+snowshoe+spam

This suggests that there really isn't someone else/somewhere else to send spam complaints.

YMMV, but in my opinion:

1. Calling them directly is unlikely to make a difference, as they surely know the situation, e.g., their SBL listings at http://www.spamhaus.org/sbl/listings/singlehop.com. Here's their contact page:

http://www.singlehop.com/about/contact_singlehop.php

2. I doubt the places that provide network connectivity to them would care, either:

http://www.robtex.com/as/as32475.html#graph

Continuing to report does feed the SCBL, which is the best as end-users I think we can hope for.

Cheers,

Share this post


Link to post
Share on other sites

Continuing to report does feed the SCBL, which is the best as end-users I think we can hope for.

Cheers,

Thanks.

Thanks, I will be more than happy to keep reporting them and helping the SCBL feed.

Share this post


Link to post
Share on other sites

Continuing to report does feed the SCBL, which is the best as end-users I think we can hope for.

Cheers,

Thanks.

Thanks, I will be more than happy to keep reporting them and helping the SCBL feed.

Also report them to Chicago BBB. Not much but it gets attention.

Share this post


Link to post
Share on other sites

There are some ways for hosts to pay attention. They have representatives in the WHT forum so you can go there and open a thread about it, in the security or hosting sections. They have the capability to discipline their customers at anytime and the last thing they need is bad reputation of compromised boxes or blacklisted IPs which will then circulate among their clients. Hosts have less resources than ISPs and tend to address issues faster in many cases. Of course there are exceptions but worth to try.

Share this post


Link to post
Share on other sites

I have had all posts for one of my sites copied, fed through a word munger, and regurgitated as unintelligible garbage by one of Singlehop's hosted sites for over a year now.

I keep getting pings after every post, and sure enough there is the same post on their site, with most of the words changed to synonyms but with all the links etc correct.

No response to my complaints from the host, but Google did at least shut down their Adsense account.

It's really frustrating when a host does not co-operate.

Off to report them yet again...

I did wonder, is there any value in reporting the site to the registrar? All they would have to do is to terminate the registration, regardless of host.

Share this post


Link to post
Share on other sites
...I did wonder, is there any value in reporting the site to the registrar? All they would have to do is to terminate the registration, regardless of host.

Can't see why you couldn't make a complaint. eNom claim a zero tolerance spam policy and presumably that extends to other forms of abuse and/or illegality as well - proof is always the problem. They're not going to turn off any name servers (not sure that's even possible with a .com domain these days) but they're committed to investigate (they say).

http://www.enom.com/terms/

http://www.enom.com/help/AbusePolicy.aspx

Share this post


Link to post
Share on other sites

singlehop.com is back at it. According to Spamcop, singlehop.com is hosting mynewfall.com. This site is referenced in a lot of the spam I get.

Interestingly these emails originate from IPs with no contact info, such as:

37.246.10.200

37.246.11.149

37.246.9.94

37.246.10.43

37.246.11.244

Complaints to SingleHop are clearly having no impact as this has been going on for years (see previous comments in thread).

Any idea who the upstream provider is for either the originating IPs or for SingleHop? Any other suggestions for getting this resolved? :angry:

Edited by marc1

Share this post


Link to post
Share on other sites

Any idea who the upstream provider is for either the originating IPs or for SingleHop? Any other suggestions for getting this resolved? :angry:

I find adding support[at] helps.

Share this post


Link to post
Share on other sites

If you're getting the type of spam I think you are, then you're dealing with a spammer who registered a nasty lot of websites which are moved about a lot. All those url's do is redirect to the real website.

For example, I get a bunch "credit score check" and the redirects run to free credit report .com via several advertising sites.

free credit report .com don't care.

The advertising sites don't care either.

Spammer gets paid per click.

Share this post


Link to post
Share on other sites

The good news is that SingleHop is no longer hosting the websites, but I continue to get a lot of spam from the same group of IPs. I have been reporting the IPs for months, but SpamCop continues to send the reports to nomaster which I realize is good for the database, but how can I get the notifications sent out to the proper contact as well?

Just in the past 24 hours, the following IPs have been used:

37.246.35.109

37.246.35.135

37.246.35.25

How can I figure out the upstream provider?

Share this post


Link to post
Share on other sites

...You didn't reply to my suggestion to you in topic "When and how to go upstream?" to see if SpamCop Forum article "Question about finding upstream providers" helps you. Did you try that? If not, please do and reply either here or there or both. Thank you.

ah, sorry missed that. So this IP block falls under RIPE NCC. I did a database lookup at RIPE.net and found an email address for the block.

turetzsr, thanks for the reply.

Share this post


Link to post
Share on other sites

The good news is that SingleHop is no longer hosting the websites, but I continue to get a lot of spam from the same group of IPs. I have been reporting the IPs for months, but SpamCop continues to send the reports to nomaster which I realize is good for the database, but how can I get the notifications sent out to the proper contact as well?

Just in the past 24 hours, the following IPs have been used:

37.246.35.109

37.246.35.135

37.246.35.25

How can I figure out the upstream provider?

Same problem with SingleHop here. They say to use 'abuse[at]singlehop.com' but it bounces.

I have opened https://chicago.app.bbb.org/complaint/view/94413935/c/dgddlo

to document the attacks on our mailserver.

Always an excuse not to take their client's spam down. I have blocked their IP's but hope SpamHaus picks up on their blackhat antics.

Howard Hoyt :(

Share this post


Link to post
Share on other sites

Same problem here, I'm receiving a lot of spam from singlehop, but I'm starting to think, the spammers are really now hosting himself to avoid complains, so I think singlehop IS REALLY THE SPAMMERS, reporting to spamcop, doesn't looks like working, 2 weeks devnulling and the ip address reported doesn't being blocked.

:s

Share this post


Link to post
Share on other sites

Just take a look at this link http://www.webhostingtalk.com/archive/inde.../t-1158040.html it looks like they're really the spammers.

I don't know if they're really the spammers but in that thread they talk about singlehop having three Spamhaus listings - two from 2009 and one from March 2012. Commencing August 23 eight more were added so there are 11 SBL listings for singlehop. That's eight listings in 21 days, I'm sure that's not a record but a clear indication where the trend is going.

Share this post


Link to post
Share on other sites

Exactly, they do really don't care about spam, looks like they are the primary business providers for spammers.

I have more IP address that I keep reporting, but at the moment spamcop does not put in BL today.

:(

Share this post


Link to post
Share on other sites

Just take a look at this link http://www.webhostingtalk.com/archive/inde.../t-1158040.html it looks like they're really the spammers.

I went online and got their fax number: Fax: 773-305-1666.

I then printed to the fax (I use a voip, so no real cost to me) and faxed every stinking spam email. Interestingly, they are "closed" on the weekends, so I was getting a ton of spam on Friday evenings, they received maybe a hundred plus faxes. I faxed them their canned replies as well. I think they finally entered my fax number as banned by their receiver because by Tuesday I could not connect anymore.

They also seem to be the largest US host of forum attackers. China is for sure #1, russia and ukraine are pretty prolific, but when it gets to the US....sheesh. Why can't they stick to spamming chinese and russian sites?

Anyway.... I hate them and I hate their canned replies:

BEGIN GARBAGE:

Greetings,

We were in touch with the server administration, and after discussion the reported problem is claimed to be resolved.

Please get back to us in case you believe the reported abusive activity/content still exists in our network/the problem is not resolved within 24 hours, or consider this ticket closed.

--

Regards,

SingleHop Team

END GARBAGE

I asked them why they "discuss" it with them, why don't they just shut them down? NO REPLY - duh

So, I just keep reporting them. I have added spam[at]uce.gov as a CC on every report. I am hoping SingleHop gets blacklisted enough that no one hosted by them can send an email that does not get bounced back.

GRRRRRRRRRRRRRRrrrrrrrrrrrrrrrrr

Share this post


Link to post
Share on other sites

As SpamCop 98 mentioned 82908[/snapback], their SBL listings just keep growing - 29 at the time of writing. Looks like they get their latest IP addresses/ranges de-listed frequently or there is fresh evidence for the eight August/September listings seen back then; but the weight is growing anyhow.

The SCbl and associated reporting are intended to give a timely "heads-up" to networks that want/need to control abuse and to provide the ability to block spam spews in progress. Seems fair to say, given the behaviour discussed, that singlehop is not interested in stopping the abuse and that the abuse is sufficiently smeared across time and space (IP address) to mostly avoid continuing listings in the SCbl and some others.

But not all BLs are evaded - and yes, continued reporting for the SCbl is NOT ineffectual, it feeds the statistics and the statistics are the objective measure of the "spam to ham" ratio otherwise they might appear always as white as the driven snow. Same goes for reports to uce.gov - most unlikely to have specific, immediate effect but feed a growing body of evidence which might be used to good effect, sometime. The alternative - "All that is necessary for the triumph of evil is that good men do nothing," and all of that.

http://multirbl.valli.org/dnsbl-lookup/ is a useful place to check the BL status for multiple listings on public DNSBLs.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×