leaseweb is allowing people to send spam, but their reporting addresses are disabled

[salamandir 0]

http://www.spamcop.net/sc?id=z5585442124zb...89a54defe96e59z

this is the 5th spam email i have received today, and when i get to the bottom of the report, it says "Reports disabled for abuse[at]leaseweb.de

Sorry, no reporting addresses found for 46.165.236.179.

Nothing to do."

it's a slightly different IP address every time, but no reports get sent, and i'm getting frustrated...

what do i do now?

[turetzsr 0]

...Just keep reporting whenever you care to do so -- although reports may not be going to an Abuse admin, they are still contributing to keeping (or putting) the spam source IP address on the SpamCop blacklist!

[salamandir 0]

i was wondering because abuse[at]leaseweb.de is the only address found, and it has been disabled, but leaseweb.de is hosted by leaseweb.nl and they have an abuse address, as does leaseweb.com, which is also hosted there, but none of their other abuse addresses even come up... all i get is

Reports disabled for abuse[at]leaseweb.de

Sorry, no reporting addresses found for 46.165.236.179.

Nothing to do.

it seems as though i can do something, but spamcop apparently can not...

[turetzsr 0]

...Yes, there are any number of reasons that SpamCop may decide to not send complaints. You can do a search to find out more about that.

[ollioe 0]

Leaseweb is a known Black Hat.

In the past very much people tried to abuse hosted "sites and services".

Leaseweb Germany denied to be responsible and claimed to report to Leaseweb Netherland.

Netherland denied to be responsible and claimed that Germany is responsible. And so on and on.

At the end Leaseweb is hosting and supporting ROKSO content and all we could do is reporting without success.

[mrmaxx 0]

Leaseweb is a known Black Hat.

In the past very much people tried to abuse hosted "sites and services".

Leaseweb Germany denied to be responsible and claimed to report to Leaseweb Netherland.

Netherland denied to be responsible and claimed that Germany is responsible. And so on and on.

At the end Leaseweb is hosting and supporting ROKSO content and all we could do is reporting without success.

Anyone know any upstream/peers for Leaseweb we could put pressure on?

[turetzsr 0]

Anyone know any upstream/peers for Leaseweb we could put pressure on?

Tracing route to mail1.sendmkt.info [46.165.236.179]

over a maximum of 30 hops:

<snip>

9 133 ms 132 ms 131 ms 4.69.158.154

10 133 ms 136 ms 132 ms ae-6-6.ebr2.washington12.level3.net [4.69.148.145]

11 131 ms 131 ms 131 ms ae-5-5.ebr2.washington1.level3.net [4.69.143.221]

12 131 ms 130 ms 130 ms ae-44-44.ebr2.Paris1.Level3.net [4.69.137.61]

13 130 ms 129 ms 134 ms ae-48-48.ebr1.frankfurt1.level3.net [4.69.143.145]

14 130 ms 130 ms 129 ms ae-81-81.csw3.Frankfurt1.Level3.net [4.69.140.10]

15 130 ms 129 ms 130 ms ae-3-80.edge4.Frankfurt1.Level3.net [4.69.154.136]

16 146 ms 146 ms 146 ms 212.162.5.234

17 146 ms 146 ms 147 ms te3-1.sr3.dtb.leaseweb.net [46.165.255.129]

18 146 ms 147 ms 154 ms hosted.by.leaseweb.com [46.165.226.253]

19 146 ms 146 ms 146 ms mail1.sendmkt.info [46.165.236.179]

Trace complete.

[mrmaxx 0]

So, why are we not contacting Level3 about LeasWeb?

[turetzsr 0]

...Good question, there's nothing stopping "us" that I know; manual LARTs should always be possible!

[mrmaxx 0]

http://www.spamcop.net/sc?id=z5585442124zb...89a54defe96e59z

this is the 5th spam email i have received today, and when i get to the bottom of the report, it says "Reports disabled for abuse[at]leaseweb.de

Sorry, no reporting addresses found for 46.165.236.179.

Nothing to do."

it's a slightly different IP address every time, but no reports get sent, and i'm getting frustrated...

what do i do now?

Easy -- add a manual complaint to Level3. The contact for them to complain about Leaseweb/NetDirekt is "abuse[at]eu.level3.net" or "spamtool[at]eu.level3.net". If enough of us complain, there's a chance they'll tell Leaseweb to "knock it off" and stop supporting spammers.

[salamandir 0]

Easy -- add a manual complaint to Level3.

that would be a great idea, if it weren't for the fact that, when it says "Nothing to do." it doesn't send any reports... i've taken to sending manual LARTs to technical[at\leaseweb.com because that's the only place listed when i type "whois leaseweb.de"...

i'll add "abuse[at]eu.level3.net" or "spamtool[at]eu.level3.net" to my LARTs from now on.

[petzl 0]

that would be a great idea, if it weren't for the fact that, when it says "Nothing to do." it doesn't send any reports... i've taken to sending manual LARTs to technical[at\leaseweb.com because that's the only place listed when i type "whois leaseweb.de"...

i'll add "abuse[at]eu.level3.net" or "spamtool[at]eu.level3.net" to my LARTs from now on.

leaseweb.com hand it to spammer and do nothing

Thanks for your mail to abuse[at]leaseweb.com. We have processed your mail and contacted our customer with a request to review your complaint and take appropriate action.

We have closed this ticket.

Kind Regards,
LeaseWeb Security, Abuse and Incident response Team.

Edited October 30, 2013 by petzl

[salamandir 0]

leaseweb.com hand it to spammer and do nothing

that doesn't mean that i'm going to stop reporting them.

[turetzsr 0]

that doesn't mean that i'm going to stop reporting them.

...Good choice -- hopefully those of you getting these can help keep them on the SCBl!

[petzl 0]

that doesn't mean that i'm going to stop reporting them.

I agree

[salamandir 0]

The contact for them to complain about Leaseweb/NetDirekt is "abuse[at]eu.level3.net" or "spamtool[at]eu.level3.net".

i just got a bounce message for spamtool[at]eu.level3.net

it said "550 Invalid recipient spamtool[at]eu.level3.net (#5.1.1)"

[mrmaxx 0]

i just got a bounce message for spamtool[at]eu.level3.net

it said "550 Invalid recipient spamtool[at]eu.level3.net (#5.1.1)"

Interesting. They may have removed that email address.

[ollioe 0]

abuse[at]Level3.net is working for me and I get very fast replies

[salamandir 0]

abuse[at]Level3.net is working for me and I get very fast replies

that's odd. i got my first and only reply from abuse[at]Level3.net yesterday, and i've been LARTing them pretty regularly for a week...

[salamandir 0]

also, in a completely separate spam report that i submitted today, i got the following information:

abuse[at]level3.com bounces (99 sent : 99 bounces)

Using abuse#level3.com[at]devnull.spamcop.net for statistical tracking.

i'm assuming that this is the same address... but why is it recommended for a manual LART if it bounces when i send automated ones?

[mrmaxx 0]

also, in a completely separate spam report that i submitted today, i got the following information:

i'm assuming that this is the same address... but why is it recommended for a manual LART if it bounces when i send automated ones?

Maybe they are accepting manual spam reports, but not SpamCop reports?

[mrmaxx 0]

also, in a completely separate spam report that i submitted today, i got the following information:

i'm assuming that this is the same address... but why is it recommended for a manual LART if it bounces when i send automated ones?

abuse[at]leve3.net is a different mailbox than abuse[at]EU.level3.net

[salamandir 0]

so i've been reporting to "abuse[at]eu.level3.net" or "spamtool[at]eu.level3.net" concerning leaseweb spam since early november, and for the past couple of weeks i've been getting "/dev/null'ing report for spamtool#eu.level3.net[at]devnull.spamcop.net"...

am i to assume that spamtool[at]eu.level3.net is no longer an appropriate address to send spam reports, or is it just another spammer who is tired of receiving complaints that they're not going to address anyway?

[salamandir 0]

now i'm getting the following message when LARTing "spamtool [at] eu.level3.net"

>>> 550 Invalid recipient

my guess is that they don't want to receive spam reports at this address any longer... :angry:

[mrmaxx 0]

now i'm getting the following message when LARTing "spamtool [at] eu.level3.net"

>>> 550 Invalid recipient

my guess is that they don't want to receive spam reports at this address any longer... :angry:

That would be my guess as well.