Two new Spam sewers continuumdatacenters.com and OVH.NET

Showing 1-17 of 17 messages
Two new Spam sewers continuumdatacenters.com and OVH.NET Rick Scott 3/14/13 8:41 AM
for the last month Ive been recieving daily spams from
continuumdatacenters.com and ovh.net.  No response from either abuse
desk and spam continues. I didn't find them in Spamhaus but highly
recommend they be added.

Just posting in the News.admin.net-abuse.email group so other admins
know a block to add and to let the two ISPs know that I'm escalating
since they are ignoring reports.
Re: Two new Spam sewers continuumdatacenters.com and OVH.NET Thor Kottelin 3/14/13 8:51 AM
"Rick Scott" <w7...@yahoo.com> wrote in message
news:ad1d64fc-c8f0-4cac-b1b8-51b73f2292f9@l13g2000yqe.googlegroups.com...
> for the last month Ive been recieving daily spams from
> continuumdatacenters.com and ovh.net.  No response from either abuse
> desk and spam continues. I didn't find them in Spamhaus but highly
> recommend they be added.

Ovh.net is a French cheapo very dark hat web hosting provider with a
whopping 89 listings on Spamhaus:
http://www.spamhaus.org/sbl/listings/ovh.net.

The following allocations are from RIPE NCC - block and be rid of.

    20010129        213.186.32.0/19        ALLOCATED PA
    20040518        213.251.128.0/18        ALLOCATED PA
    20050815        87.98.128.0/17        ALLOCATED PA
    20060920        91.121.0.0/16        ALLOCATED PA
    20080715        94.23.0.0/16        ALLOCATED PA
    20090605        188.165.0.0/16        ALLOCATED PA
    20100119        178.32.0.0/15        ALLOCATED PA
    20101129        46.105.0.0/16        ALLOCATED PA
    20110520        176.31.0.0/16        ALLOCATED PA
    20110916        109.190.0.0/16        ALLOCATED PA
    20120116        37.59.0.0/16        ALLOCATED PA
    20120515        5.39.0.0/17        ALLOCATED PA
    20120706        5.135.0.0/16        ALLOCATED PA
    20130110        185.15.68.0/22        ALLOCATED PA
    20041115        2001:41d0::/32

--
Thor Kottelin
http://www.anta.net/

Re: Two new Spam sewers continuumdatacenters.com and OVH.NET Rick Scott 3/14/13 9:58 AM
Thanks Thor. I had used Network-tools and they said not listed.
Ooops.

Just received a note from continuum data ... unfortunately its as I
feared.  They forward the complaint to the sender instead
of doing the right thing. I provided copies of my last months spam cop
reports. See if they do the right thing.

> From: sup...@continuumdatacenters.com <sup...@continuumdatacenters.com>
> Subject: Re: [#26969] Two new Spam sewers continuumdatacenters.com and OVH.NET
> To: "Rick Scott" <w7...@yahoo.com>
> Date: Thursday, March 14, 2013, 9:46 AM
> Rick,
>
> Thank you for the response. Please note we do receive
> multiple SpamCop reports and all SpamCop reports are
> immediately forwarded on to the offending customer. If you
> could please provide us with more details I would be happy
> to look in to this further for you.
>
> Regards,
> Mike
>
> --
> Mike Thoene | Manager, Network Operations Center
Re: Two new Spam sewers continuumdatacenters.com and OVH.NET Rick Scott 3/14/13 10:29 AM
> > From: supp...@continuumdatacenters.com <supp...@continuumdatacenters.com>
> > Subject: Re: [#26969] Two new Spam sewers continuumdatacenters.com and OVH.NET
> > To: "Rick Scott" <w7...@yahoo.com>
> > Date: Thursday, March 14, 2013, 9:46 AM
> > Rick,
>
> > Thank you for the response. Please note we do receive
> > multiple SpamCop reports and all SpamCop reports are
> > immediately forwarded on to the offending customer. If you
> > could please provide us with more details I would be happy
> > to look in to this further for you.
>
> > Regards,
> > Mike
>
> > --
> > Mike Thoene | Manager, Network Operations Center

Apparently Ive hit a nerve posting here.  After a month the end result
was what should have happened long ago.  but we shall see if its true
or he
tying to shine me

>Hello Rick,

>I have just received word from my customer that he immediately has terminated his abusive customer. If you do receive additional SPAM messages, please do not hesitate to ask.
>
>Thanks, and have an excellent day!
>Mike
Re: Two new Spam sewers continuumdatacenters.com and OVH.NET Catherine Jefferson 3/14/13 10:39 AM
You forgot to mention the blocks.  Or (for that matter)  to provide any
spam evidence.  There's not much that *any* of us can do with this post
without more information.  (Continuumdatacenters.com is a large web
host, and ovh.net is France's largest ISP -- no blocklist for any larger
group than your family can afford to block those domains en masse.)


--
Catherine Jefferson <tw8...@ergosphere.net>
Blog/Personal: http://www.ergosphere.net
Re: Two new Spam sewers continuumdatacenters.com and OVH.NET Thor Kottelin 3/14/13 11:08 AM
"Catherine Jefferson" <spam...@spambouncer.org> wrote in message
news:kht21b$h83$1@news.sosdg.org...
> On 3/14/2013 8:41 AM, Rick Scott wrote:
>> for the last month Ive been recieving daily spams from
>> continuumdatacenters.com and ovh.net.

> You forgot to mention the blocks.  Or (for that matter)  to provide any
> spam evidence.  There's not much that *any* of us can do with this post
> without more information.  (Continuumdatacenters.com is a large web
> host, and ovh.net is France's largest ISP -- no blocklist for any larger
> group than your family can afford to block those domains en masse.)

OTOH, pinhole blocking is not useful either, as ovh.net moves its spammers
around so frequently. From my viewpoint, 5.39.0.0/17 and 188.165.0.0/16
are probably the worst allocations, and the following smaller chunks have
proved particularly spammer-infested:

5.39.118.0/23
5.39.124.0/23
188.165.127.0/24
188.165.214.0/23
188.165.228.0/23

But Spamhaus has a more comprehensive list.
Re: Two new Spam sewers continuumdatacenters.com and OVH.NET Rick Scott 3/14/13 11:08 AM
On Mar 14, 10:39 am, Catherine Jefferson <spamt...@spambouncer.org>
wrote:
> On 3/14/2013 8:41 AM, Rick Scott wrote:
>
> > for the last month Ive been recieving daily spams from
> > continuumdatacenters.com and ovh.net.  No response from either abuse
> > desk and spam continues. I didn't find them in Spamhaus but highly
> > recommend they be added.
>
> > Just posting in the News.admin.net-abuse.email group so other admins
> > know a block to add and to let the two ISPs know that I'm escalating
> > since they are ignoring reports.
>
> You forgot to mention the blocks.  Or (for that matter)  to provide any
> spam evidence.  There's not much that *any* of us can do with this post
> without more information.  (Continuumdatacenters.com is a large web
> host, and ovh.net is France's largest ISP -- no blocklist for any larger
> group than your family can afford to block those domains en masse.)
>
> --
> Catherine Jefferson <tw86...@ergosphere.net>
> Blog/Personal:http://www.ergosphere.net

The last time I posted the actual spam I got burned for that.

Make up your minds.
Re: Two new Spam sewers continuumdatacenters.com and OVH.NET Rick Scott 3/14/13 11:14 AM
Just to be fair though I will post the blocks

OVH.net the last month has come from 192.95.0.XXX (mostly 161 - 189)
Continuum Data Centers, he says they were disconnected but they
came from 199.96.82.XXX (1 - 16 mostly)
Re: Two new Spam sewers continuumdatacenters.com and OVH.NET David Ritz 3/14/13 12:33 PM
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thursday, 14 March 2013 17:51 +0200,
 in article <khsrm4$1fh$1...@news.albasani.net>,
Don't forget, OVH provides hosting within ARIN allocations, based in
Quebec.

    $ whois -a n\ OVH-ARIN-\* | iprange2cidr.pl
    142.4.192.0/19
    192.95.0.0/18
    198.27.64.0/18
    198.50.128.0/17
    198.100.144.0/20
    198.245.48.0/20

    $ whois -r OVH | iprange2cidr.pl # (consolidated)
    5.39.0.0/17
    37.59.0.0/16
    46.105.0.0/16
    87.98.128.0/17
    91.121.0.0/16
    94.23.0.0/16
    109.190.0.0/16
    176.31.0.0/16
    178.32.0.0/15
    188.165.0.0/16
    213.186.32.0/19
    213.251.128.0/18

As for continuumdatacenters.com, I've never encountered them.  They
only have three SBL listings
<http://www.spamhaus.org/sbl/listings/continuumdatacenters.com>.

    $ whois -a n\ CDC-LMB-ARIN\* | iprange2cidr.pl
    64.79.96.0/20
    74.117.236.0/22
    74.119.216.0/22
    74.121.180.0/22
    74.122.192.0/21
    173.243.112.0/20
    199.96.80.0/21
    199.192.200.0/21

- --
David Ritz <dr...@mindspring.com>
 Be kind to animals; kiss a shark.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (Darwin)
Comment: Public Keys: <http://dritz.home.mindspring.com/keys.txt>

iEYEARECAAYFAlFCJhIACgkQUrwpmRoS3utl1ACeKAvw86AT1BZyKFf5kf4/Pmqw
MhUAoNK6QaZXhmJBCwfIb7qF2ksxwNTX
=+cv9
-----END PGP SIGNATURE-----
Re: Two new Spam sewers continuumdatacenters.com and OVH.NET Jessica 3/14/13 1:54 PM
On Thu, 14 Mar 2013 10:29:59 -0700, Rick Scott wrote:

> Apparently Ive hit a nerve posting here.  After a month the end result
> was what should have happened long ago.  but we shall see if its true or
> he
> tying to shine me
>
>>Hello Rick,
>
>>I have just received word from my customer that he immediately has
>>terminated his abusive customer. If you do receive additional SPAM
>>messages, please do not hesitate to ask.
>>
>>Thanks, and have an excellent day!
>>Mike


Translation:
You've been listwashed from this particular spammer's list until he buys
his next millyuns CD.
unk...@googlegroups.com 3/14/13 4:52 PM <This message has been deleted.>
Re: Two new Spam sewers continuumdatacenters.com and OVH.NET Sam 3/14/13 5:16 PM
Rick Scott writes:

> for the last month Ive been recieving daily spams from
> continuumdatacenters.com and ovh.net.  No response from either abuse
> desk and spam continues. I didn't find them in Spamhaus but highly
> recommend they be added.
>
> Just posting in the News.admin.net-abuse.email group so other admins
> know a block to add and to let the two ISPs know that I'm escalating
> since they are ignoring reports.

I've been getting spammed from ovh.net for ~5/6 months now, on and off. I've  
had some success in stopping some of the spew, in case of ovh.net, by  
sending an announcement to every ovh.net and ovh.co.uk address I have on  
file, that I'm now automatically forwarding them all the spam from their  
latest pet spammer.

That usually puts the lid on things. Until some other spambag starts spewing  
from ovh.net, I send a few polite notes to ab...@ovh.net, they get ignored,  
I then start forwarding all of their spam to all of their email addresses  
again; then it stops. At some point, I'm going to go back through my  
archives, get a copy of all ovh.net spam sources that spammed me in the last  
year, and inform my ovh.net bitch distribution list that since abuse@ is  
ineffective, I'm appointing them to the OVH abuse desk, and they will be  
automatically getting all their spam, going forward, until they get their  
shit together.

I started getting spammed from some mainsleazer snowshoeing from  
continuumdatacenters.com's IP address range back in February. After  
receiving no response to two complaints to ab...@continuumdatacenters.com,  
the next two complaints were also sent to ab...@he.net, asking them to  
disconnect this spam-friendly hosting provider from their network.

No further spam was received. I can't say with certainly, but it looks like  
the professional spam generator that was snowshoeing out of  
continuumdatacenters.com probably got the boot, I lost my "before" notes, of  
what I saw on those IP addresses, if any, to compare against the "after" or  
"now", and to see if something has changed.

Re: Two new Spam sewers continuumdatacenters.com and OVH.NET David Ritz 3/14/13 5:59 PM
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thursday, 14 March 2013 19:52 -0400,
 in article <87sj3xt...@usenet.ankman.de>,
 Andreas Kohlbach <march13....@spamgourmet.com> wrote:

> David Ritz wrote on 14. March 2013:

>> Don't forget, OVH provides hosting within ARIN allocations, based
>> in Quebec.

> <http://www.thewhir.com/web-hosting-news/french-dedicated-and-cloud-host-ovh-opens-massive-green-data-center-in-montreal>

> But spam comes in green. ;-)

I've seen more in the way of network attacks, from OVH space.  In any
case, OVH is clue impervious, with respect to network abuse and
security issues.  I wouldn't have started blocking OVH, at the
firewall, had they actually addressed reported issues.  Repeat
attacks, from previously reported IP addresses, days or weeks later,
indicated to me that the lights are on, at <ab...@ovh.net>, but
nobody's home.

- --
David Ritz <dr...@mindspring.com>
 Be kind to animals; kiss a shark.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (Darwin)
Comment: Public Keys: <http://dritz.home.mindspring.com/keys.txt>

iEYEARECAAYFAlFCcngACgkQUrwpmRoS3uua4QCfWRaTzLvVGq0IiWUUf/IEHOlJ
AZIAmwdAR09Fi6ULoKeS0GMxARUG8/x8
=4bTM
-----END PGP SIGNATURE-----
Re: Two new Spam sewers continuumdatacenters.com and OVH.NET Jessica 3/14/13 6:44 PM
On Thu, 14 Mar 2013 19:16:48 -0500, Sam wrote:

> inform my ovh.net bitch distribution list that since abuse@ is
> ineffective, I'm appointing them to the OVH abuse desk, and they will be
> automatically getting all their spam, going forward, until they get
> their shit together.

The most likely result of that would be for OVH to block you from mailing
them :(
Re: Two new Spam sewers continuumdatacenters.com and OVH.NET That Person II 3/14/13 7:41 PM
On Fri, 15 Mar 2013 01:44:33 +0000 (UTC), Jessica <m...@privacy.net>
wrote:
Yep, Just like ab...@as5577.net and ab...@blacklotus.net

That's where most of my spam is coming from.







http://www.churchofcommongood.org IS A
SCAM for Andrew Jacob Stephens Stevens

Lumber Heavy Industries Cartel Card# 18502

--
Just that other person

Re: Two new Spam sewers continuumdatacenters.com and OVH.NET Rick Scott 3/15/13 9:38 AM
On Mar 14, 7:41 pm, That Person II <m...@example.com> wrote:

> Yep, Just like ab...@as5577.net
>
> That's where most of my spam is coming from.

yes and curse their upstream .iptransit.com  and Level3.  Also Hostkey
that keeps allowing them to spam out.  Most of the messages
come from host key and they have a ton of Hashbuster crap in the
message. Plus they found that spamcop will barf on too many
links so they dump 15 or 20 links in the messsage.
Re: Two new Spam sewers continuumdatacenters.com and OVH.NET Hal Murray 4/3/13 2:10 AM
In article <kht21b$h83$1...@news.sosdg.org>,
 Catherine Jefferson <spam...@spambouncer.org> writes:

>You forgot to mention the blocks.  Or (for that matter)  to provide any
>spam evidence.  There's not much that *any* of us can do with this post
>without more information.  (Continuumdatacenters.com is a large web
>host, and ovh.net is France's largest ISP -- no blocklist for any larger
>group than your family can afford to block those domains en masse.)

Where do you rate ovh.net relative to Yahoo?  :(

As far as I can tell, they are ignoring abuse reports.

OVH is hosting a phisher's redirector at:
    http://www.eventsagency.it/css/ccs/
I first reported it on Mar-09.  I just sent in a 5th report.

--
These are my opinions.  I hate spam.