Abuse

[Zhadnost]

Originally Posted by hoysey

I currently have 3 servers with OVH and just went to purchase a 4th to find they want £49.99 setup fee, needless to say I'm not paying that at all so I'm now going to look elsewhere. As I like to have all my eggs in 1 basket so to speak It looks like I'll be letting the other 3 go as well and move them to a new host who doesn't rip people off. Not a good way to treat loyal customers is it!!!

I'm really not impressed!!!

They appear to have changed it to Free if you pay for 12 months, which sounds fair to me.

[pcoventry]

Originally Posted by LawsHosting

I think as you offer servers so cheap, ppl only rent it 1 month, use it for abuse and let it expire? I just hope you take action on these customers heavily......

i guess so. I admit I have come back and returned several times. Mainly lucky enough to get a dual core server rather than the rubbish single core I have now BUT it does what I use it for which is mainly streaming and websites. so i'm happy this has been introduced,.

I just hope OVH dont see ME as one of those customers you mentioned. It's not the way it's meant to have been

[grgtlr]

The new setup fees don't seem to have done much to deter the spammers yet. New OVH addresses spamming me since 1st December:

01 Dec 2009 Received: from 94-23-67-181.kimsufi.com ([94.23.67.181] helo=mx1.wirelessvalentinesday.com)
01 Dec 2009, 04 Dec 2009 Received: from 94-23-67-115.kimsufi.com ([94.23.67.115] helo=mx1.publicrule.com)
01 Dec 2009 Received: from 94-23-65-217.kimsufi.com ([94.23.65.217] helo=mx1.superautodirect.com)
01 Dec 2009, 03 Dec 2009 Received: from 94-23-155-224.kimsufi.com ([94.23.155.224] helo=mx1.bestpolicycenter.com)
02 Dec 2009 Received: from 94-23-66-237.kimsufi.com ([94.23.66.237] helo=mx1.superautodirect.com)
02 Dec 2009 Received: from 87-98-159-133.kimsufi.com ([87.98.159.133] helo=mx1.soundpublicpolicy.com)
03 Dec 2009 Received: from 94-23-156-90.kimsufi.com ([94.23.156.90] helo=mx1.healthcaredot.com)
03 Dec 2009 Received: from 94-23-67-205.kimsufi.com ([94.23.67.205] helo=mx1.supergooglesearch.com)
03 Dec 2009, 08 Dec 2009 Received: from 94-23-67-46.kimsufi.com ([94.23.67.46] helo=mx1.yourebayonline.com)
03 Dec 2009, 09 Dec 2009 Received: from 94-23-67-221.kimsufi.com ([94.23.67.221] helo=mx1.yourpolicyforum.com)
03 Dec 2009, 14 Dec 2009 Received: from 94-23-68-30.kimsufi.com ([94.23.68.30] helo=mx1.directlinkasia.com)
04 Dec 2009 Received: from 87-98-177-156.kimsufi.com ([87.98.177.156] helo=mx1.healthcaredot.com)
04 Dec 2009 Received: from 87-98-182-11.kimsufi.com ([87.98.182.11] helo=mx1.greatinsureonline.com)
05 Dec 2009 Received: from 94-23-156-123.kimsufi.com ([94.23.156.123] helo=mx1.carsdirectworld.com)
05 Dec 2009 Received: from 94-23-67-43.kimsufi.com ([94.23.67.43] helo=mx1.bestebaymotor.com)
06 Dec 2009 Received: from ks30687.kimsufi.com ([213.186.56.42] helo=mx1.supergooglesearch.com)
06 Dec 2009 Received: from 94-23-155-173.kimsufi.com ([94.23.155.173] helo=mx1.insureamericafinancial.com)
06 Dec 2009 Received: from 94-23-155-174.kimsufi.com ([94.23.155.174] helo=mx1.healthcaredot.com)
06 Dec 2009, 10 Dec 2009 Received: from 94-23-156-94.kimsufi.com ([94.23.156.94] helo=mx1.thedirectusa.com)
06 Dec 2009 Received: from 94-23-159-189.kimsufi.com ([94.23.159.189] helo=mx1.bestpolicycenter.com)
06 Dec 2009 Received: from 94-23-159-44.kimsufi.com ([94.23.159.44] helo=mx1.regulationplan.com)
06 Dec 2009 Received: from 94-23-67-150.kimsufi.com ([94.23.67.150] helo=mx1.yourroundball.com)
06 Dec 2009 Received: from 94-23-67-182.kimsufi.com ([94.23.67.182] helo=mx1.makemorewith.com)
06 Dec 2009, 09 Dec 2009 Received: from 94-23-69-37.kimsufi.com ([94.23.69.37] helo=mx1.directlinkasia.com)
07 Dec 2009, 17 Dec 2009 Received: from 94-23-67-117.kimsufi.com ([94.23.67.117] helo=mx1.bestpolicyhelp.com)
08 Dec 2009, 17 Dec 2009 Received: from 94-23-68-53.kimsufi.com ([94.23.68.53] helo=mx1.bestpolicyhelp.com)
08 Dec 2009 Received: from 94-23-68-54.kimsufi.com ([94.23.68.54] helo=mx1.superpolicygroup.com)
09 Dec 2009 Received: from 94-23-156-96.kimsufi.com ([94.23.156.96] helo=mx1.besthomedirect.com)
09 Dec 2009 Received: from 94-23-67-56.kimsufi.com ([94.23.67.56] helo=mx1.yourebayonline.com)
09 Dec 2009 Received: from 94-23-159-120.kimsufi.com ([94.23.159.120] helo=mx1.besthomedirect.com)
09 Dec 2009 Received: from 94-23-157-88.kimsufi.com ([94.23.157.88] helo=mx1.carsdirectworld.com)
09 Dec 2009, 12 Dec 2009 Received: from 94-23-69-41.kimsufi.com ([94.23.69.41] helo=mx1.greatrule.com)
09 Dec 2009, 13 Dec 2009 Received: from 94-23-69-64.kimsufi.com ([94.23.69.64] helo=mx1.superpolicygroup.com)
10 Dec 2009 Received: from 94-23-154-24.kimsufi.com ([94.23.154.24] helo=mx1.besthomedirect.com)
10 Dec 2009 Received: from 87-98-156-247.kimsufi.com ([87.98.156.247] helo=mx1.soundpublicpolicy.com)
11 Dec 2009 Received: from [94.23.105.1] (helo=mx1.partingthefog.com)
12 Dec 2009 Received: from 94-23-69-69.kimsufi.com ([94.23.69.69] helo=mx1.greatheartattack.com)
12 Dec 2009 Received: from 94-23-67-206.kimsufi.com ([94.23.67.206] helo=mx1.greatheartworm.com)
12 Dec 2009 Received: from 94-23-65-156.kimsufi.com ([94.23.65.156] helo=mx1.theonlybed.com)
12 Dec 2009, 13 Dec 2009 Received: from [94.23.105.6] (helo=mx1.windstarairdales.com)
13 Dec 2009 Received: from 94-23-67-55.kimsufi.com ([94.23.67.55] helo=mx1.bestebaymotor.com)
13 Dec 2009 Received: from 94-23-67-113.kimsufi.com ([94.23.67.113] helo=mx1.yourfreeheart.com)
13 Dec 2009 Received: from 94-23-67-121.kimsufi.com ([94.23.67.121] helo=mx1.greatheartattack.com)
13 Dec 2009 Received: from [94.23.67.75] (helo=mx1.animalcareworld.com)
14 Dec 2009 Received: from 94-23-68-31.kimsufi.com ([94.23.68.31] helo=mx1.greatrule.com)
14 Dec 2009 Received: from 94-23-67-46.kimsufi.com ([94.23.67.46] helo=mx1.yourebayonline.com)
14 Dec 2009 Received: from 94-23-67-204.kimsufi.com ([94.23.67.204] helo=mx1.greatheartworm.com)
15 Dec 2009 Received: from 94-23-69-63.kimsufi.com ([94.23.69.63] helo=mx1.bestpolicyhelp.com)
16 Dec 2009 Received: from [94.23.105.24] (helo=mx1.rightnowrio.com)
16 Dec 2009 Received: from 94-23-66-169.kimsufi.com ([94.23.66.169] helo=mx1.yourheartworm.com)
17 Dec 2009 Received: from [94.23.67.83] (helo=mx1.thecareerin.com)

[LawsHosting]

Lol.... Maybe we need to filter out all OVH servers at firewall level (said in tongue-in-cheek ofc, it'll be unethical to do this due to mail routing)..... So, yeah, not much we can do ourselves, its more OVH that has to step up and think of new ways to combat dodgy people.... Just imagine the traffic waste....

I wonder if this hurts Google rankings due to IP abuse.......

[grgtlr]

Originally Posted by LawsHosting

So, yeah, not much we can do ourselves, its more OVH that has to step up and think of new ways to combat dodgy people....

Ultimately if OVH don't act we have to move elsewhere, I can't continue supporting a network that knowingly facilitates abuse. OVH should pay more attention to checking requests for a large number of IP addresses. It would also be possible for OVH to proactively detect abuse in progress but that would involve being more intrusive in monitoring traffic flows than I would like to see.

However, it is easy for OVH to deal with the spammers once they have been detected, and people such as Spamhaus are experts at finding new spam sources rapidly and accurately. Terminating spammers reported to abuse@ovh.net or that are listed on the SBL is an easy way to deal with the worst abusers. Paying for a CSS feed and using it to rapidly terminate snowshoe spammers would be easy and very effective. There is no excuse for how much abuse OVH has allowed in the time between being notified of problems and eventually closing the account.

The sad thing is that the snowshoe spam problem on OVH is the work of very few people, and yet everyone is having to pay the price.

Originally Posted by LawsHosting

I wonder if this hurts Google rankings due to IP abuse.......

It certainly hurts the reputation of the network with anti-spam services such as Senderbase and UCEprotect. The longer spam is allowed to continue the worse it gets. There are many other networks that I don't accept any mail from without a prior whitelist entry, it's only because I know OVH that I haven't yet gone that far with this network, I'm sure others have.


New spam sources:
20 Dec 2009, 21 Dec 2009 Received: from 94-23-67-116.kimsufi.com ([94.23.67.116] helo=mx1.yourfreeheart.com)
21 Dec 2009 Received: from 87-98-165-1.kimsufi.com ([87.98.165.1] helo=mx1.supercarejobs.com)
21 Dec 2009 Received: from 94-23-67-209.kimsufi.com ([94.23.67.209] helo=mx1.greatheartworm.com)
21 Dec 2009 Received: from 94-23-67-58.kimsufi.com ([94.23.67.58] helo=mx1.greatrule.com)

Continuing spam from:
02 Dec 2009, 20 Dec 2009 Received: from 87-98-159-133.kimsufi.com ([87.98.159.133] helo=mx1.soundpublicpolicy.com)
03 Dec 2009, 20 Dec 2009 Received: from 94-23-67-46.kimsufi.com ([94.23.67.46] helo=mx1.yourebayonline.com)
03 Dec 2009, 20 Dec 2009 Received: from 94-23-68-30.kimsufi.com ([94.23.68.30] helo=mx1.directlinkasia.com)
07 Dec 2009, 19 Dec 2009 Received: from 94-23-67-117.kimsufi.com ([94.23.67.117] helo=mx1.bestpolicyhelp.com)
08 Dec 2009, 20 Dec 2009 Received: from 94-23-68-53.kimsufi.com ([94.23.68.53] helo=mx1.bestpolicyhelp.com)
09 Dec 2009, 21 Dec 2009 Received: from 94-23-67-56.kimsufi.com ([94.23.67.56] helo=mx1.yourebayonline.com)
12 Dec 2009, 20 Dec 2009 Received: from 94-23-67-206.kimsufi.com ([94.23.67.206] helo=mx1.greatheartworm.com)
15 Dec 2009, 18 Dec 2009 Received: from 94-23-69-63.kimsufi.com ([94.23.69.63] helo=mx1.bestpolicyhelp.com)
19 Dec 2009, 20 Dec 2009 Received: from 94-23-67-57.kimsufi.com ([94.23.67.57] helo=mx1.directlinkasia.com)

[Neil]

Hi grgtlr

Please can you send them to abuse@ovh.net, they will then be shutdown.

[grgtlr]

Originally Posted by Neil

Please can you send them to abuse@ovh.net, they will then be shutdown.

Unfortunately that hasn't been my experience in the past. There are too many to forward each spam individually, but if a summary like the above would be useful I will try and send one to abuse starting next week.

However, the CBL has spamtraps that receive several orders of magnitude more spam than my own and the Spamhaus/CBL CSS system would be invaluable to OVH - all the snowshoe spammers I mentioned above were already listed on the CSS. Their rsync feed shouldn't be prohibitively expensive. They don't provide service to ISPs on their top 10 spam hosters list but I suspect would make an exception if using the data would help curb abuse. Spamhaus would also welcome any intelligence you can provide on who is responsible for the various snowshoe sources.

If you want an idea of how effective using CSS could be, download the dnsbl-1 list from uceprotect.net and use grepcidr to find abusive addresses from your ranges. The uceprotect list is nowhere near as accurate, extensive, or as quick to catch spammers as Spamhaus CSS, but it is free:
http://www.uceprotect.net/en/index.php?m=6&s=10

Continuing:
05 Dec 2009, 23 Dec 2009 Received: from 94-23-67-43.kimsufi.com ([94.23.67.43] helo=mx1.bestebaymotor.com)
07 Dec 2009, 22 Dec 2009 Received: from 94-23-67-117.kimsufi.com ([94.23.67.117] helo=mx1.bestpolicyhelp.com)
08 Dec 2009, 23 Dec 2009 Received: from 94-23-68-54.kimsufi.com ([94.23.68.54] helo=mx1.superpolicygroup.com)
14 Dec 2009, 23 Dec 2009 Received: from 94-23-68-31.kimsufi.com ([94.23.68.31] helo=mx1.greatrule.com)
19 Dec 2009, 22 Dec 2009 Received: from 94-23-67-57.kimsufi.com ([94.23.67.57] helo=mx1.directlinkasia.com)
22 Dec 2009 Received: from [94.23.67.75] (helo=mx1.thecareerin.com)

New:
22 Dec 2009 Received: from 94-23-66-106.kimsufi.com ([94.23.66.106] helo=mx1.yourebayonline.com)
22 Dec 2009 Received: from 87-98-166-121.kimsufi.com ([87.98.166.121] helo=mx1.supercarejobs.com)
22 Dec 2009 Received: from 94-23-69-48.kimsufi.com ([94.23.69.48] helo=mx1.bestheartrate.com)
22 Dec 2009, 23 Dec 2009 Received: from 94-23-65-203.kimsufi.com ([94.23.65.203] helo=mx1.bestebaymotor.com)
23 Dec 2009 Received: from 87-98-156-225.kimsufi.com ([87.98.156.225] helo=mx1.soundpublicpolicy.com)

[Neil]

Hi

We are working with spamhaus and have recently suspended a large amount of servers and we hope shut down more servers listed on spamhaus.

But if you receive any spam emails from our servers then please do send them to abuse@ovh.net

[LawsHosting]

Originally Posted by Neil

We are working with spamhaus and have recently suspended a large amount of servers and we hope shut down more servers listed on spamhaus.

And have you made note of the offending customers if they attempt to re-order, or does that invade your policies?

Also, say, I had a client spamming from my server(s) (god forbid), do you give us warnings so we can allow time to rectify the problem (with a CBL etc) before you shut the servers? As, obviously, there will be a few odd dodgy clients using old scripts with swiss-cheese-type-holes in, that pop up.

Merry XMas

[pcoventry]

Talking of abuse it's nice to see they finally fixed the usage counter. I'm not going to go in to how much I have but let's just say the 3TB limit was never reached on the control panel in a month despite 24/7 caning of the server.

Now after 1 day it shows 160GB which is right so looks like the fun with Kimsufi is over. It's obviously never affected anyone so i dont expect any nasty comments about it.