Some hosting companies never end up on our radar, as they have systems in place to catch customers who sign-up for IP Space and VPS’s just to start spamming, but there are others who seem to constantly have problems with new break outs from new customers.
An example today is at SoftLayer, a customer who signed up Jun 4th, 2015 and is listed as Linecom Systems Media for the 220.127.116.11/29 IP Space, today triggered alerting system at almost every ISP we monitor. In order to do that, you would expect the SoftLayer should have bells going off in their network monitoring as well.
This company didn’t even bother to use throwaway domains, or update the default rDNS SoftLayer uses, so most people would not see it in their inboxes, but the overhead on the internet and the ISP mail servers is significant.
18.104.22.168 : 22.214.171.124-static.reverse.softlayer.com
126.96.36.199 : 188.8.131.52-static.reverse.softlayer.com
184.108.40.206 : 220.127.116.11-static.reverse.softlayer.com
18.104.22.168 : 22.214.171.124-static.reverse.softlayer.com
126.96.36.199 : 188.8.131.52-static.reverse.softlayer.com
184.108.40.206 : 220.127.116.11-static.reverse.softlayer.com
18.104.22.168 : 22.214.171.124-static.reverse.softlayer.com
126.96.36.199 : 188.8.131.52-static.reverse.softlayer.com
Now, the abuse contact for this one, email@example.com also looks very curious, and the systems identify themselves as ‘Linux 3.1-3.10’, the intent seemed to be intended to use .link throwaway domain, (actsdb.link) similar to the common .work, .science low cost domains, and this was a fake review for a restaurant in Seattle.
Looks like they have a database of email addresses that is very clean, low bounce rate, but this kind of abusive behavior risks the hosting providers reputation as well.
At least SoftLayer does a good job of ‘rwhois’, but the point is that allowing this to occur hurts everyone. Again, we recommend networks monitor their own networks on egress, and trigger some form of automated lock out when SMTP volumes from brand new customers go through the roof, whether it is because it is a ‘bad customer’, or simply a customer that doesn’t know how to secure their servers.
Oh, BTW.. the spam engine used is one seen commonly at hosting companies.
PS, Not targeted at SoftLayer specifically. Today, we also saw new outbreaks from:
Centarra Networks Inc. (the following dont’ do as good of a job on ‘rwhois’)
184.108.40.206 : r5fwk.farainm.science 220.127.116.11 : 33k2kmnef.nustiue.science 18.104.22.168 : fd7gb.citubeir.science 22.214.171.124 : ileci1jx.dajun.science 126.96.36.199 : qfrad4m.cianje.science 188.8.131.52 : dfgja.aletan.science
184.108.40.206 : gurusmart.biz 220.127.116.11 : joombusiness.com 18.104.22.168 : shopsmarts.biz 22.214.171.124 : like-minded.biz 126.96.36.199 : xtremeshop.biz