Jump to content
Sign in to follow this  
salamandir

leaseweb is allowing people to send spam, but their reporting addresses are disabled

Recommended Posts

http://www.spamcop.net/sc?id=z5585442124zb...89a54defe96e59z

this is the 5th spam email i have received today, and when i get to the bottom of the report, it says "Reports disabled for abuse[at]leaseweb.de

Sorry, no reporting addresses found for 46.165.236.179.

Nothing to do."

it's a slightly different IP address every time, but no reports get sent, and i'm getting frustrated...

what do i do now? :huh:

Share this post


Link to post
Share on other sites

...Just keep reporting whenever you care to do so -- although reports may not be going to an Abuse admin, they are still contributing to keeping (or putting) the spam source IP address on the SpamCop blacklist!

Share this post


Link to post
Share on other sites

i was wondering because abuse[at]leaseweb.de is the only address found, and it has been disabled, but leaseweb.de is hosted by leaseweb.nl and they have an abuse address, as does leaseweb.com, which is also hosted there, but none of their other abuse addresses even come up... all i get is

Reports disabled for abuse[at]leaseweb.de

Sorry, no reporting addresses found for 46.165.236.179.

Nothing to do.

it seems as though i can do something, but spamcop apparently can not... <_<

Share this post


Link to post
Share on other sites

...Yes, there are any number of reasons that SpamCop may decide to not send complaints. You can do a search to find out more about that.

Share this post


Link to post
Share on other sites

Leaseweb is a known Black Hat.

In the past very much people tried to abuse hosted "sites and services".

Leaseweb Germany denied to be responsible and claimed to report to Leaseweb Netherland.

Netherland denied to be responsible and claimed that Germany is responsible. And so on and on.

At the end Leaseweb is hosting and supporting ROKSO content and all we could do is reporting without success.

Share this post


Link to post
Share on other sites

Leaseweb is a known Black Hat.

In the past very much people tried to abuse hosted "sites and services".

Leaseweb Germany denied to be responsible and claimed to report to Leaseweb Netherland.

Netherland denied to be responsible and claimed that Germany is responsible. And so on and on.

At the end Leaseweb is hosting and supporting ROKSO content and all we could do is reporting without success.

Anyone know any upstream/peers for Leaseweb we could put pressure on?

Share this post


Link to post
Share on other sites
Anyone know any upstream/peers for Leaseweb we could put pressure on?
Tracing route to mail1.sendmkt.info [46.165.236.179]

over a maximum of 30 hops:

<snip>

9 133 ms 132 ms 131 ms 4.69.158.154

10 133 ms 136 ms 132 ms ae-6-6.ebr2.washington12.level3.net [4.69.148.145]

11 131 ms 131 ms 131 ms ae-5-5.ebr2.washington1.level3.net [4.69.143.221]

12 131 ms 130 ms 130 ms ae-44-44.ebr2.Paris1.Level3.net [4.69.137.61]

13 130 ms 129 ms 134 ms ae-48-48.ebr1.frankfurt1.level3.net [4.69.143.145]

14 130 ms 130 ms 129 ms ae-81-81.csw3.Frankfurt1.Level3.net [4.69.140.10]

15 130 ms 129 ms 130 ms ae-3-80.edge4.Frankfurt1.Level3.net [4.69.154.136]

16 146 ms 146 ms 146 ms 212.162.5.234

17 146 ms 146 ms 147 ms te3-1.sr3.dtb.leaseweb.net [46.165.255.129]

18 146 ms 147 ms 154 ms hosted.by.leaseweb.com [46.165.226.253]

19 146 ms 146 ms 146 ms mail1.sendmkt.info [46.165.236.179]

Trace complete.

Share this post


Link to post
Share on other sites

So, why are we not contacting Level3 about LeasWeb?

Share this post


Link to post
Share on other sites

http://www.spamcop.net/sc?id=z5585442124zb...89a54defe96e59z

this is the 5th spam email i have received today, and when i get to the bottom of the report, it says "Reports disabled for abuse[at]leaseweb.de

Sorry, no reporting addresses found for 46.165.236.179.

Nothing to do."

it's a slightly different IP address every time, but no reports get sent, and i'm getting frustrated...

what do i do now? :huh:

Easy -- add a manual complaint to Level3. The contact for them to complain about Leaseweb/NetDirekt is "abuse[at]eu.level3.net" or "spamtool[at]eu.level3.net". If enough of us complain, there's a chance they'll tell Leaseweb to "knock it off" and stop supporting spammers.

Share this post


Link to post
Share on other sites
Easy -- add a manual complaint to Level3.

that would be a great idea, if it weren't for the fact that, when it says "Nothing to do." it doesn't send any reports... i've taken to sending manual LARTs to technical[at\leaseweb.com because that's the only place listed when i type "whois leaseweb.de"...

i'll add "abuse[at]eu.level3.net" or "spamtool[at]eu.level3.net" to my LARTs from now on.

Share this post


Link to post
Share on other sites

that would be a great idea, if it weren't for the fact that, when it says "Nothing to do." it doesn't send any reports... i've taken to sending manual LARTs to technical[at\leaseweb.com because that's the only place listed when i type "whois leaseweb.de"...

i'll add "abuse[at]eu.level3.net" or "spamtool[at]eu.level3.net" to my LARTs from now on.

leaseweb.com hand it to spammer and do nothing

Thanks for your mail to abuse[at]leaseweb.com. We have processed your mail and contacted our customer with a request to review your complaint and take appropriate action.

We have closed this ticket.

Kind Regards,
LeaseWeb Security, Abuse and Incident response Team.

Edited by petzl

Share this post


Link to post
Share on other sites
that doesn't mean that i'm going to stop reporting them.
...Good choice -- hopefully those of you getting these can help keep them on the SCBl!

Share this post


Link to post
Share on other sites

that doesn't mean that i'm going to stop reporting them.

I agree

Share this post


Link to post
Share on other sites
The contact for them to complain about Leaseweb/NetDirekt is "abuse[at]eu.level3.net" or "spamtool[at]eu.level3.net".

i just got a bounce message for spamtool[at]eu.level3.net

it said "550 Invalid recipient spamtool[at]eu.level3.net (#5.1.1)"

Share this post


Link to post
Share on other sites

i just got a bounce message for spamtool[at]eu.level3.net

it said "550 Invalid recipient spamtool[at]eu.level3.net (#5.1.1)"

Interesting. They may have removed that email address.

Share this post


Link to post
Share on other sites
abuse[at]Level3.net is working for me and I get very fast replies

that's odd. i got my first and only reply from abuse[at]Level3.net yesterday, and i've been LARTing them pretty regularly for a week...

Share this post


Link to post
Share on other sites

also, in a completely separate spam report that i submitted today, i got the following information:

abuse[at]level3.com bounces (99 sent : 99 bounces)

Using abuse#level3.com[at]devnull.spamcop.net for statistical tracking.

i'm assuming that this is the same address... but why is it recommended for a manual LART if it bounces when i send automated ones?

Share this post


Link to post
Share on other sites

also, in a completely separate spam report that i submitted today, i got the following information:

i'm assuming that this is the same address... but why is it recommended for a manual LART if it bounces when i send automated ones?

Maybe they are accepting manual spam reports, but not SpamCop reports?

Share this post


Link to post
Share on other sites

also, in a completely separate spam report that i submitted today, i got the following information:

i'm assuming that this is the same address... but why is it recommended for a manual LART if it bounces when i send automated ones?

abuse[at]leve3.net is a different mailbox than abuse[at]EU.level3.net

Share this post


Link to post
Share on other sites

so i've been reporting to "abuse[at]eu.level3.net" or "spamtool[at]eu.level3.net" concerning leaseweb spam since early november, and for the past couple of weeks i've been getting "/dev/null'ing report for spamtool#eu.level3.net[at]devnull.spamcop.net"...

am i to assume that spamtool[at]eu.level3.net is no longer an appropriate address to send spam reports, or is it just another spammer who is tired of receiving complaints that they're not going to address anyway?

Share this post


Link to post
Share on other sites

now i'm getting the following message when LARTing "spamtool [at] eu.level3.net"

>>> 550 Invalid recipient

my guess is that they don't want to receive spam reports at this address any longer... :angry:

Share this post


Link to post
Share on other sites

now i'm getting the following message when LARTing "spamtool [at] eu.level3.net"

>>> 550 Invalid recipient

my guess is that they don't want to receive spam reports at this address any longer... :angry:

That would be my guess as well.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×