marc1 Posted August 26, 2010 Share Posted August 26, 2010 I started getting bunch of spam on a daily basis that originates from IPs owned by singlehop.com. Reports are being sent to abuse[at]singlehop.com, but the spam keeps coming. The IPs are never the same. Also seeing similar situation from from softlayer.com and cologuys.com. What is the best way to deal with this. Seems like the ISP has no interest in stopping spam being sent via their servers. Link to comment Share on other sites More sharing options...
turetzsr Posted August 26, 2010 Share Posted August 26, 2010 Hi, marc!, <snip> What is the best way to deal with this. Seems like the ISP has no interest in stopping spam being sent via their servers. ...Just keep reporting 'em, as your time and interest permit! Hopefully, you'll be contributing to keeping them on the SpamCop blacklist and thus contribute to the ability of e-mail providers who use the SCBL to block or sort out the spam. Thanks for reporting spam! Link to comment Share on other sites More sharing options...
marc1 Posted August 26, 2010 Author Share Posted August 26, 2010 it seems to me there are two ways that spamcop works. one is the blacklist, the second is notifying the ISP that they are sending spam. What is the point of sending abuse notifications if the ISP doesn't address the issue? Does it make sense in those cases to alert the upstream provider? Link to comment Share on other sites More sharing options...
rconner Posted August 26, 2010 Share Posted August 26, 2010 it seems to me there are two ways that spamcop works. one is the blacklist, the second is notifying the ISP that they are sending spam. What is the point of sending abuse notifications if the ISP doesn't address the issue? Does it make sense in those cases to alert the upstream provider? The second part is the nice part, for those providers who care enough about their reputations to take a hint. The first part is for those who don't; they'll find themselves (and their customers) unable to send mail because the people at the other end are using the SCBL to guard their mailboxes. If you can accurately determine the upstream for a recalcitrant provider, you can certainly lodge a report with them (you'd have to do it outside SpamCop, I think). Will it accomplish anything? Hard to say. -- rick Link to comment Share on other sites More sharing options...
mcs85 Posted March 12, 2012 Share Posted March 12, 2012 I started getting bunch of spam on a daily basis that originates from IPs owned by singlehop.com. Reports are being sent to abuse[at]singlehop.com, but the spam keeps coming. The IPs are never the same. Also seeing similar situation from from softlayer.com and cologuys.com. What is the best way to deal with this. Seems like the ISP has no interest in stopping spam being sent via their servers. I have also started getting lots of snowshoe spam from singlehop. NOC and ABUSE refuse to act upon my complaints. 30 different ip's in the past 25 days. Who else can I complain to about the spam support singlehop is providing? Link to comment Share on other sites More sharing options...
JoeColorado Posted March 12, 2012 Share Posted March 12, 2012 Who else can I complain to about the spam support singlehop is providing? It does seem to be a known issue. See, for example: https://www.google.com/search?q=singlehop+snowshoe+spam This suggests that there really isn't someone else/somewhere else to send spam complaints. YMMV, but in my opinion: 1. Calling them directly is unlikely to make a difference, as they surely know the situation, e.g., their SBL listings at http://www.spamhaus.org/sbl/listings/singlehop.com. Here's their contact page: http://www.singlehop.com/about/contact_singlehop.php 2. I doubt the places that provide network connectivity to them would care, either: http://www.robtex.com/as/as32475.html#graph Continuing to report does feed the SCBL, which is the best as end-users I think we can hope for. Cheers, Link to comment Share on other sites More sharing options...
mcs85 Posted March 12, 2012 Share Posted March 12, 2012 Continuing to report does feed the SCBL, which is the best as end-users I think we can hope for. Cheers, Thanks. Thanks, I will be more than happy to keep reporting them and helping the SCBL feed. Link to comment Share on other sites More sharing options...
InsaneO Posted April 18, 2012 Share Posted April 18, 2012 Continuing to report does feed the SCBL, which is the best as end-users I think we can hope for. Cheers, Thanks. Thanks, I will be more than happy to keep reporting them and helping the SCBL feed. Also report them to Chicago BBB. Not much but it gets attention. Link to comment Share on other sites More sharing options...
enigma1 Posted April 18, 2012 Share Posted April 18, 2012 There are some ways for hosts to pay attention. They have representatives in the WHT forum so you can go there and open a thread about it, in the security or hosting sections. They have the capability to discipline their customers at anytime and the last thing they need is bad reputation of compromised boxes or blacklisted IPs which will then circulate among their clients. Hosts have less resources than ISPs and tend to address issues faster in many cases. Of course there are exceptions but worth to try. Link to comment Share on other sites More sharing options...
poddys Posted May 22, 2012 Share Posted May 22, 2012 I have had all posts for one of my sites copied, fed through a word munger, and regurgitated as unintelligible garbage by one of Singlehop's hosted sites for over a year now. I keep getting pings after every post, and sure enough there is the same post on their site, with most of the words changed to synonyms but with all the links etc correct. No response to my complaints from the host, but Google did at least shut down their Adsense account. It's really frustrating when a host does not co-operate. Off to report them yet again... I did wonder, is there any value in reporting the site to the registrar? All they would have to do is to terminate the registration, regardless of host. Link to comment Share on other sites More sharing options...
Farelf Posted May 22, 2012 Share Posted May 22, 2012 ...I did wonder, is there any value in reporting the site to the registrar? All they would have to do is to terminate the registration, regardless of host. Can't see why you couldn't make a complaint. eNom claim a zero tolerance spam policy and presumably that extends to other forms of abuse and/or illegality as well - proof is always the problem. They're not going to turn off any name servers (not sure that's even possible with a .com domain these days) but they're committed to investigate (they say). http://www.enom.com/terms/ http://www.enom.com/help/AbusePolicy.aspx Link to comment Share on other sites More sharing options...
marc1 Posted June 26, 2012 Author Share Posted June 26, 2012 singlehop.com is back at it. According to Spamcop, singlehop.com is hosting mynewfall.com. This site is referenced in a lot of the spam I get. Interestingly these emails originate from IPs with no contact info, such as: 37.246.10.200 37.246.11.149 37.246.9.94 37.246.10.43 37.246.11.244 Complaints to SingleHop are clearly having no impact as this has been going on for years (see previous comments in thread). Any idea who the upstream provider is for either the originating IPs or for SingleHop? Any other suggestions for getting this resolved? :angry: Link to comment Share on other sites More sharing options...
mcs85 Posted June 26, 2012 Share Posted June 26, 2012 Any idea who the upstream provider is for either the originating IPs or for SingleHop? Any other suggestions for getting this resolved? :angry: I find adding support[at] helps. Link to comment Share on other sites More sharing options...
cwg Posted June 27, 2012 Share Posted June 27, 2012 If you're getting the type of spam I think you are, then you're dealing with a spammer who registered a nasty lot of websites which are moved about a lot. All those url's do is redirect to the real website. For example, I get a bunch "credit score check" and the redirects run to free credit report .com via several advertising sites. free credit report .com don't care. The advertising sites don't care either. Spammer gets paid per click. Link to comment Share on other sites More sharing options...
marc1 Posted July 25, 2012 Author Share Posted July 25, 2012 The good news is that SingleHop is no longer hosting the websites, but I continue to get a lot of spam from the same group of IPs. I have been reporting the IPs for months, but SpamCop continues to send the reports to nomaster which I realize is good for the database, but how can I get the notifications sent out to the proper contact as well? Just in the past 24 hours, the following IPs have been used: 37.246.35.109 37.246.35.135 37.246.35.25 How can I figure out the upstream provider? Link to comment Share on other sites More sharing options...
turetzsr Posted July 25, 2012 Share Posted July 25, 2012 ...You didn't reply to my suggestion to you in topic "When and how to go upstream?" to see if SpamCop Forum article "Question about finding upstream providers" helps you. Did you try that? If not, please do and reply either here or there or both. Thank you. Link to comment Share on other sites More sharing options...
marc1 Posted July 25, 2012 Author Share Posted July 25, 2012 ...You didn't reply to my suggestion to you in topic "When and how to go upstream?" to see if SpamCop Forum article "Question about finding upstream providers" helps you. Did you try that? If not, please do and reply either here or there or both. Thank you. ah, sorry missed that. So this IP block falls under RIPE NCC. I did a database lookup at RIPE.net and found an email address for the block. turetzsr, thanks for the reply. Link to comment Share on other sites More sharing options...
n4af Posted August 28, 2012 Share Posted August 28, 2012 The good news is that SingleHop is no longer hosting the websites, but I continue to get a lot of spam from the same group of IPs. I have been reporting the IPs for months, but SpamCop continues to send the reports to nomaster which I realize is good for the database, but how can I get the notifications sent out to the proper contact as well? Just in the past 24 hours, the following IPs have been used: 37.246.35.109 37.246.35.135 37.246.35.25 How can I figure out the upstream provider? Same problem with SingleHop here. They say to use 'abuse[at]singlehop.com' but it bounces. I have opened https://chicago.app.bbb.org/complaint/view/94413935/c/dgddlo to document the attacks on our mailserver. Always an excuse not to take their client's spam down. I have blocked their IP's but hope SpamHaus picks up on their blackhat antics. Howard Hoyt Link to comment Share on other sites More sharing options...
stetro Posted September 13, 2012 Share Posted September 13, 2012 Same problem here, I'm receiving a lot of spam from singlehop, but I'm starting to think, the spammers are really now hosting himself to avoid complains, so I think singlehop IS REALLY THE SPAMMERS, reporting to spamcop, doesn't looks like working, 2 weeks devnulling and the ip address reported doesn't being blocked. :s Link to comment Share on other sites More sharing options...
stetro Posted September 13, 2012 Share Posted September 13, 2012 Just take a look at this link http://www.webhostingtalk.com/archive/inde.../t-1158040.html it looks like they're really the spammers. Link to comment Share on other sites More sharing options...
SpamCop 98 Posted September 13, 2012 Share Posted September 13, 2012 Just take a look at this link http://www.webhostingtalk.com/archive/inde.../t-1158040.html it looks like they're really the spammers. I don't know if they're really the spammers but in that thread they talk about singlehop having three Spamhaus listings - two from 2009 and one from March 2012. Commencing August 23 eight more were added so there are 11 SBL listings for singlehop. That's eight listings in 21 days, I'm sure that's not a record but a clear indication where the trend is going. Link to comment Share on other sites More sharing options...
stetro Posted September 14, 2012 Share Posted September 14, 2012 Exactly, they do really don't care about spam, looks like they are the primary business providers for spammers. I have more IP address that I keep reporting, but at the moment spamcop does not put in BL today. Link to comment Share on other sites More sharing options...
Farelf Posted September 14, 2012 Share Posted September 14, 2012 ...I have more IP address that I keep reporting, but at the moment spamcop does not put in BL today. It takes a few current reports (from different reporters), especially if the servers handle a considerable volume of legitimate mail as well as spam - see http://forum.spamcop.net/scwik/SpamCopBlockingList Link to comment Share on other sites More sharing options...
gare Posted November 10, 2012 Share Posted November 10, 2012 Just take a look at this link http://www.webhostingtalk.com/archive/inde.../t-1158040.html it looks like they're really the spammers. I went online and got their fax number: Fax: 773-305-1666. I then printed to the fax (I use a voip, so no real cost to me) and faxed every stinking spam email. Interestingly, they are "closed" on the weekends, so I was getting a ton of spam on Friday evenings, they received maybe a hundred plus faxes. I faxed them their canned replies as well. I think they finally entered my fax number as banned by their receiver because by Tuesday I could not connect anymore. They also seem to be the largest US host of forum attackers. China is for sure #1, russia and ukraine are pretty prolific, but when it gets to the US....sheesh. Why can't they stick to spamming chinese and russian sites? Anyway.... I hate them and I hate their canned replies: BEGIN GARBAGE: Greetings, We were in touch with the server administration, and after discussion the reported problem is claimed to be resolved. Please get back to us in case you believe the reported abusive activity/content still exists in our network/the problem is not resolved within 24 hours, or consider this ticket closed. -- Regards, SingleHop Team END GARBAGE I asked them why they "discuss" it with them, why don't they just shut them down? NO REPLY - duh So, I just keep reporting them. I have added spam[at]uce.gov as a CC on every report. I am hoping SingleHop gets blacklisted enough that no one hosted by them can send an email that does not get bounced back. GRRRRRRRRRRRRRRrrrrrrrrrrrrrrrrr Link to comment Share on other sites More sharing options...
Farelf Posted November 11, 2012 Share Posted November 11, 2012 As SpamCop 98 mentioned 82908[/snapback], their SBL listings just keep growing - 29 at the time of writing. Looks like they get their latest IP addresses/ranges de-listed frequently or there is fresh evidence for the eight August/September listings seen back then; but the weight is growing anyhow. The SCbl and associated reporting are intended to give a timely "heads-up" to networks that want/need to control abuse and to provide the ability to block spam spews in progress. Seems fair to say, given the behaviour discussed, that singlehop is not interested in stopping the abuse and that the abuse is sufficiently smeared across time and space (IP address) to mostly avoid continuing listings in the SCbl and some others. But not all BLs are evaded - and yes, continued reporting for the SCbl is NOT ineffectual, it feeds the statistics and the statistics are the objective measure of the "spam to ham" ratio otherwise they might appear always as white as the driven snow. Same goes for reports to uce.gov - most unlikely to have specific, immediate effect but feed a growing body of evidence which might be used to good effect, sometime. The alternative - "All that is necessary for the triumph of evil is that good men do nothing," and all of that. http://multirbl.valli.org/dnsbl-lookup/ is a useful place to check the BL status for multiple listings on public DNSBLs. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.