ISP won't take action against spammer?

[draeklae]

I receive a lot of spam from some IPs in the Hostwinds network (198.143.120.*). I've submitted about a dozen reports through SpamCop and another dozen through their support ticket interface, but they only say they've contacted the client in question and that's about it; I keep getting spam anyway. I tried tracing the DNS info through Whois (instead of going after the IP) but they're hidden behind Domains By Proxy, which also won't answer after several spam reports. Any ideas when the ISPs won't play ball like that?

[turetzsr]

...About all you can do is keep reporting 'em and hope they wind up on the blacklist. And, of course, let your e-mail provider admin know about it so she/ he/ they can consider rejecting e-mail coming from those spam sources and/ or whatever action they normally take against spam sources.

[clivejo]

I receive a lot of spam from some IPs in the Hostwinds network (198.143.120.*). I've submitted about a dozen reports through SpamCop and another dozen through their support ticket interface, but they only say they've contacted the client in question and that's about it; I keep getting spam anyway. I tried tracing the DNS info through Whois (instead of going after the IP) but they're hidden behind Domains By Proxy, which also won't answer after several spam reports. Any ideas when the ISPs won't play ball like that?

I am having the same problem with HostWinds. I have a ticket open now for two weeks in which both the CEO and COO have commented on it saying the client has been suspended, yet every day I'm getting spam from their networks. I keep reporting to Spamcop but nothing. I've blocked the IP address but within a 24hours they have changed it again.

What else can I do?

[turetzsr]

Hi, clivejo,

...You've done your part; now all we all can do is to hope they'll take effective action eventually. Note that it is possible that they may have actually have stopped the specific spammer that you reported but they may have others.

...The only other thing that's in your power is to keep reporting the spams you receive so that they contribute to the statistics that SpamCop uses to decide whether or not to add the spam sources to the SpamCop blacklist and to notify the abuse address(es).

[clivejo]

Hi, clivejo,

...You've done your part; now all we all can do is to hope they'll take effective action eventually. Note that it is possible that they may have actually have stopped the specific spammer that you reported but they may have others.

Is it better to bounce the message or accept the message and destroy it? I was hoping by bouncing the message they would eventually get the message that the email is not getting through and hopefully remove the email address from the spam list.

[Farelf]

Is it better to bounce the message or accept the message and destroy it? I was hoping by bouncing the message they would eventually get the message that the email is not getting through and hopefully remove the email address from the spam list.

It is most common for spammers to ignore non-deliveries - perhaps HostWinds is different (but why would they be?) and anyway only a service provider can convincingly "bounce" a message directed to a standard consumer-level mail account. I think most of us "here" would say, 'Just keep reporting them.' That way there is some chance some of their IP addresses might be listed in the SCbl and, at least, they cannot deny knowledge of their unwanted activity should they come to the attention of regulatory authorities.

[clivejo]

It is most common for spammers to ignore non-deliveries - perhaps HostWinds is different (but why would they be?) and anyway only a service provider can convincingly "bounce" a message directed to a standard consumer-level mail account.

I admin the email server these spam messages are being directed at. In that past any abuse reports have been sorted out very fast (within 24hours), all it took was an email to the abuse department of the relevant ISP/host.

However, Hostwinds are in a league of their own. They appear to be totally incompetent and even seem to be protecting the spammer. So far I have been assured by the CEO and COO that they have suspended the account. Yet I notice they are still spamming me as of an hour ago I noticed connections to my server from their email cluster. I asked them for the IP addresses used by their email cluster and they wont give me this information. Every email coming in from them is being reported directly to SpamCop but still no progress here.

I am in total agreement with the original poster, Hostwinds definitely seem to be pro-spammers by their lack of action towards them.

[Farelf]

OK, Spamhaus attributes snowshoe operations to hostwinds.com networks (http://www.spamhaus.org/sbl/listings/hostwinds.com) - one imagines it is fairly well impossible for a provider to be "inadvertently" hosting such (let alone ignoring Spamhaus warnings) so I guess the worst fears are realised.

Looking at SenderBase as well (and the reputations noted), there seems to be little to recommend a great number of hostwinds' clients except, presumably, they pay their provider - see http://www.senderbase.org/lookup?search_string=Hostwinds+LLC.

The SenderBase listing, although only a "sampling" may give you enough IP ranges and domains to institute bouncing - if you are able to do that, it may be worth trying since these are not botnet spammers, they are (presumably) paying for their bandwidth and might, indeed, give some attention to delivery statistics. But I wouldn't hold out much hope, myself.

[turetzsr]

<snip>

I was hoping by bouncing the message they would eventually get the message that the email is not getting through and hopefully remove the email address from the spam list.

...Ooh, we don't want them to do that! It would simply remove potential reports (from you), thereby reducing the likelihood they will be added to and/ or remain on the SCBl (SpamCop blacklist) and do nothing to reduce the spamming. I understand that would help you, though! <g>

[lisati]

Is it better to bounce the message or accept the message and destroy it? I was hoping by bouncing the message they would eventually get the message that the email is not getting through and hopefully remove the email address from the spam list.

It's usually best if any kind of bounce or reject action you take is done during the SMTP process, before it's accepted by the recipient's provider. That way, it remains the problem of the machine trying to deliver the message, and you don't have the task of figuring out which, if any, of the sender credentials are reliable.