I got a live one! - Spam source

Mailman List Mirror (Read Only)
1

Looks like of our customers has decided to turn their /24 into a nice little
space spewing machine. Doesn't seem like just one compromised host.

Reverse DNS for most of the /24 are suspicious domains. Each domain used in
the message-id forwards to a single .net which lists their mailing address
as a PO box an single link to an unsubscribe field.

I've contacted at least three known contacts for the customer about the
abuse without a single response.

It would seem there are many layers to this entity:

The domains are registered to one business
Our billing information for the customer has one name, they colo with
another person (whom the cross connect reaches)
Our customer has an IT solutions person working for them (Strange since our
customer and their colo provider are "IT solutions" people themselves.
Abuse handle phone #s are supposedly incorrect (I called it)

Besides the obvious of me at the minimum filtering port tcp/25 is their an
organization that tracks businesses like these who seem like they are
building a web of insulation in which to move?

I think this case might interest them.

2

Can you name the /24?

I can't say that this sound unfamiliar -- we are seeing an increase in
"facilitated" criminal activity across the board...

- - ferg

3

Looks like of our customers has decided to turn their /24 into a nice little
space spewing machine. Doesn't seem like just one compromised host.

Reverse DNS for most of the /24 are suspicious domains. Each domain used in
the message-id forwards to a single .net which lists their mailing address
as a PO box an single link to an unsubscribe field.

I've contacted at least three known contacts for the customer about the
abuse without a single response.

I've found that in cases like this, the best way to get in contact with the customer is to interrupt their service. Suddenly, they'll go from being too busy to take/return your call to calling you.

It would seem there are many layers to this entity:

The domains are registered to one business
Our billing information for the customer has one name, they colo with
another person (whom the cross connect reaches)
Our customer has an IT solutions person working for them (Strange since our
customer and their colo provider are "IT solutions" people themselves.
Abuse handle phone #s are supposedly incorrect (I called it)

I'm confused. Who are you billing and for what services?

Besides the obvious of me at the minimum filtering port tcp/25 is their an
organization that tracks businesses like these who seem like they are
building a web of insulation in which to move?

I think this case might interest them.

Spamhaus is the first one that comes to mind. From what I understand of your description, this doesn't sound all that different from typical spammer behavior. Multiple layers of indirection seems to be the latest thing for spammers.

4

Russell Myba wrote:

Looks like of our customers has decided to turn their /24 into a nice little
space spewing machine. Doesn't seem like just one compromised host.

Reverse DNS for most of the /24 are suspicious domains. Each domain used in
the message-id forwards to a single .net which lists their mailing address
as a PO box an single link to an unsubscribe field.

I've contacted at least three known contacts for the customer about the
abuse without a single response.

It would seem there are many layers to this entity:

The domains are registered to one business
Our billing information for the customer has one name, they colo with
another person (whom the cross connect reaches)
Our customer has an IT solutions person working for them (Strange since our
customer and their colo provider are "IT solutions" people themselves.
Abuse handle phone #s are supposedly incorrect (I called it)

Besides the obvious of me at the minimum filtering port tcp/25 is their an
organization that tracks businesses like these who seem like they are
building a web of insulation in which to move?

I think this case might interest them.

From principle, I want to jump up and down and say "zap `em!". However, I also make several assumption which need to be clearned, pragmatically.

I assume you have authority over the decision of what to do with them, and I also assume that your contract with them does not bind you in some fashion, can get you in trouble with the business side of the business, or can introduce *liability* issues. And naturally, that if you are not the decision maker, that you are synched with whomever it is.

These assumptions aside, kicking them might not be the best solution. "Starving them" out by blocking port 25, as an example you gave, or following some of the other suggestions in this thread, may be workable.

Which brings me three very important questions:
1. How much intelligence can you collect if you let them stay?
2. Have you considered legal action against them?
3. Did you consult with legal about possible law enforcement involvement?

As to the intricate web of who they are and where their resources lie, these are usually cases where the more you dig, the more you find -- ad infinitum.

Me? I'd just kick them after verifying they are not victims themselves.

I hope this helps,

  Gadi.

5

I'm confused. Who are you billing and for what services?

Let's say our direct customer is CustomerA. They seem to buy rackspace from
BusinessB. CustomerA seem to retain BusinessC for "IT Solutions" even
though all three entities purport to be IT solutions providers.
BusinessC came into the picture after the spamming started saying a wholly
different /24 (Different from the spam source) "doesn't work". It routes
fine on our end. I have a feeling they've been added to some RBLs but I
haven't found them listed yet.

Just a simple ethernet handoff in a colo. We delegated rDNS to the servers
of their choice and haven't heard a peep out of them until now.

6

Sounds like what spamhaus.org calls snowshoe. What /24 would this be?

7

Depends on the activity, but this re-iterates the importance of maintaining
correct SWIP, so that only the offenders get listed, and not bordering
customers.

But if you give the info on the listed company and range, we might be able to
give you a lot more information..

I was just reading the latest spam auditors report, and it is always amazing
how the same guys keep finding new colo's to work out of ..

8

Right. There are *so many* loopholes in this entire process, Bad Guys are
waltzing through it.

- - ferg

9

Russell Myba wrote:

Let's say our direct customer is CustomerA. They seem to buy rackspace from
BusinessB. CustomerA seem to retain BusinessC for "IT Solutions" even
though all three entities purport to be IT solutions providers.
BusinessC came into the picture after the spamming started saying a wholly
different /24 (Different from the spam source) "doesn't work". It routes
fine on our end. I have a feeling they've been added to some RBLs but I
haven't found them listed yet.

Just a simple ethernet handoff in a colo. We delegated rDNS to the servers
of their choice and haven't heard a peep out of them until now.

I think it's an absolute crying shame that a freak bolt of lighting somehow fried their rackspace in the colo and didn't affect any of the surrounding neighbors. I hate it when that happens. It's karma I think...

Justin

10

Interesting scenario ... but would be far more interesting to us if you share the /24?

Truman

11

1. This is possibly/probably better on spam-l.
2. This is a very common operational model. Any number of spamgangs
have been busy doing this with multiple /24's scattered over numerous
providers in order to distribute the workload and minimize the impact
of any takedown.
3. There is no point in reporting this to any law enforcment agency
anywhere in the world *unless* child pornography is involved. Any
action they take will be slow, inept, and ineffective. The best that
you can probably do is (a) shut down them instantly and permanently
and (b) publish all relevant details -- name names -- on spam-l so
that workers and researchers can use the information.

---Rsk

12

Russell,

My personal inclination would be to look for what legit entities are provisioning them with critical resources and what margins they appear to be paying.

For DNS resources, the domains, to identify registry preference, probably a simple volume correlation, and the registrars, which may corollate better to other primary characteristics than simple volume, to RRset data, which may have interesting corollates to other, provisioned, critical resources. I'm not the "registrar police", I'm simply interested in ICANN having a policy towards registrars that looks beyond failure to respond to email, failure to pay $0.25/domain/year, and failure to escrow registrant data, which seem to be the only basis for breach of contract proceedings against, or non-renewals of its registrars.

Whack-a-mole has been discussed lots of times, and as Gadi confirms at the end of his note, he's still mostly in the Whack-a-camp, though he does mention gathering information.

When they stop providing you (and "you" could include parties who are paying you to look over your shoulder at this petri dish and its cultured agar) with data of value then their existence is of no value.

Eric

Gadi Evron wrote:

13

One of them actually patented it. Further proof that you can patent just about anything in the US.

http://www.faqs.org/patents/app/20090271475

14

Could you elaborate on what constitutes correct swip information?

15

Classic snowshoe spam setup, probably a professional snowshoe spam outfit known to Spamhaus as 'Tactara' and 'Webzero'.

Snowshoe spam operations operate by contacting ISP pretending to be 'IP space brokers', they buy lots of IP space and have it all SWIPed in small chunks, mostly /24s, to an endless array of anonymous Wyoming and Delaware shell companies at UPS mailboxes. They then fill the /24s with freshly-registered 'nonsense' domains, tunnel into the server to hide their real location, and start the spamming. Usually almost every IP in the /24 has a spam cannon on it and a web page with just an 'unsubscribe' field.

They're the reason we created the CSS announced here:
http://www.spamhaus.org/news.lasso?article=646

(please don't follow up to this post here on NANOG, as NANOG is not an appropriate forum for spam discussions)

   Steve Linford
   The Spamhaus Project
   http://www.spamhaus.org