1

Long story short, I am getting Dutch language spam from a group; it has been going on for years, and they send several of them daily. They got my e-mail when I lived in the Netherlands and imagine that their "business" is very profitable and I'm just lucky to not speak Dutch and therefore it was easy to ignore them this long.

Still, I finally reported some of their domains to web.com, the registrar they use, whose abuse department replied:

Although the domain name is registered through Register.com/Network Solutions/Web.com, the e-mail itself, which is separate from the domain name registration, is hosted elsewhere and we have no control over the website, e-mail or its content. Any issues regarding the content of the website or e-mail will need to be addressed directly to the owner of the site or to the e-mail-hosting provider who should be in a position to assist you with your concerns. To determine the mail-hosting provider you can use a publicly available tool such as http:www.mxtoolbox.com this tool will provide you with the e-mail hosting provider of the domain name, which can then be compared to the ARIN.net (http://www.arin.net) IP allocation database. This will give you the relevant information for the true e-mail hosting provider.

Now the problem is that I could not properly locate the hosting providers for their domains - peabolin.com, suraccess.com, compun.org, etc. - with those tools and need your help with doing that (also for their future domains as I'm sure they will keep trying).

Also, is this truly the best way of going after such a spam-ring? Should I be using dedicated software? I did try reporting them to a local spam agency before without any results.

Update: let me copy here the response from another registrar (namecheap.com) as well which cared much more than web.com about my complaint, as an encouragement for others to take action:

... it seems the domain name is blacklisted by SURBL. Since we consider SURBL to be a trusted organization, we opened a case regarding the domain name.

(and 2 business days later:)

This is to inform you that the potyxc.men domain was suspended. It is now pointed to non-resolving nameservers and will be null routed once the propagation is over. The domain is locked for modification in our system.

| improve this question | |
  • Honestly, this is a waste of your, hopefully, valuable time. If it originates outside a country with strong laws on spam, there is nothing you can do and reporting to some provider that willing hosts spam is not going to end well for you. Black-hole the spam either in your email client or, if you can, at your local mail server. If you really want to do something, maybe report the domain to an anti-spam service so that the source domains/ip get blacklisted. – Julian Knight Feb 9 '18 at 21:03
  • The Netherlands (and the EU generally) have much stronger privacy laws than the US, for your information. As mentioned in the question, reporting to an anti-spam service did not produce any results. Some of the domains they are sending from are already blacklisted but that doesn't actually stop them. – Gabor Feb 9 '18 at 21:34
  • Thanks for informing me :) But as I work in this region in a heavily regulated sector, I am more that well aware of that. But you missed the part about being outside the EU. Assuming they are, unless they are somewhere else with similar laws, you are wasting your time. – Julian Knight Feb 9 '18 at 21:52
  • I see that the hosting providers are from Germany (contabo.de), Slovenia (telemach.si), the US (ee.net), etc. when I follow the method from Steffen Ullrich's answer. Some of the providers does seem fishy (unifiedlayer.com, dfw-datacenter.com, etc), meaning that they don't even have a proper website. Would the legit providers report the spammer credit cards to some legal/financial body if they verified - based on copies of spam I send them - that said cards are used to operate spam bots? What is the usual process? – Gabor Feb 9 '18 at 22:14
  • The cards are probably stolen or hacked as well - purchased by the gross for a few dollars. You'd be playing whack-a-mole. You are, of course, free to do what you want. – Julian Knight Feb 9 '18 at 22:34
2

I could not properly locate the hosting providers for their domains - peabolin.com, ...

First, make sure that this is really spam and that it is impossible or useless to complain directly to the sender of the mail.

Then you might start by getting the IP address of their website:

$ dig www.peabolin.com
... 
peabolin.com.           3501    IN      A       91.185.198.54

You could also check the IP address of their incoming mail server:

$ dig mx peabolin.com
...
peabolin.com.           3419    IN      MX      10 peabolin.com.
...
peabolin.com.           3419    IN      A       91.185.198.54

In this case both point to the same IP address and you might lookup who is responsible for the IP:

$ whois 91.185.198.54
...
% Information related to '91.185.198.0 - 91.185.198.255'
...
% Abuse contact for '91.185.198.0 - 91.185.198.255' is 'abuse@telemach.net'
...
inetnum:        91.185.198.0 - 91.185.198.255
netname:        Telemach-NET
descr:          Broadband Network Services

If you feel that the domain owner misuses this network (for example to send spam) you can contact the abuse contact shown above. But note that you should also check that the main actually has its origin by this party and is not a spoofed mail. You can also check the Received headers in the mail which path the mail has taken and which IP addresses are involved - IP addresses used for sending might be different to the ones used for receiving. See Email header IP address for more information.

| improve this answer | |
  • Thanks, let me report to Telemach and then accept your answer. Just to confirm, I have Received: from hamazo.peabolin.com (hamazo.peabolin.com. [91.185.198.55]) in the headers of this daily spam, as I understand from your link that confirms it "actually has its origin by this party and is not a spoofed mail", right? – Gabor Feb 9 '18 at 21:26
  • @Gabor: Assuming that this Received header is not faked then it indicates that this IP range was used to send the mail. But note that in theory some of the Received headers might be faked too, i.e. some attacker could create a mail which already contains Received headers and then distribute it. The existing headers will not be removed but only the new headers added on top. – Steffen Ullrich Feb 9 '18 at 21:44
  • Yeah, it contains multiple received headers, I picked the top one. From your link, it seems the fake ones are added below the real one (when you say "added on top", I guess you mean added below). – Gabor Feb 9 '18 at 21:59
  • 2
    @Gabor This might be confusing. A legitimate MTA will add his own received: header on top of any existing such headers. Consequently, you can usually only trust the very top received: header, which gets inserted by your own (trusted) mail server. Anything below that may be give insights into the route the mail took, but may also be faked. The fake headers are not "added below" - they are already there when the only fully trusted header gets inserted on top. – Hagen von Eitzen Feb 9 '18 at 22:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.