<?xml version="1.0" encoding="UTF-8"?><!-- generator="wordpress/2.0.7" -->
<rss version="2.0" 
	xmlns:content="http://purl.org/rss/1.0/modules/content/">
<channel>
	<title>Comments on: Glen McCausland turns to webspam?</title>
	<link>http://spamhuntress.com/2006/07/28/glen-mccausland-turns-to-webspam/</link>
	<description>Just another WordPress weblog</description>
	<pubDate>Fri, 22 Aug 2008 04:33:33 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.0.7</generator>

	<item>
		<title>by: admin</title>
		<link>http://spamhuntress.com/2006/07/28/glen-mccausland-turns-to-webspam/#comment-28309</link>
		<pubDate>Sat, 29 Jul 2006 17:30:39 +0000</pubDate>
		<guid>http://spamhuntress.com/2006/07/28/glen-mccausland-turns-to-webspam/#comment-28309</guid>
					<description>To Russell,
and thank YOU for your public reply!

Webspamming is not illegal in the same way mail spamming is. But if you look long and hard enough at it, you'll soon find why it's so unethical. It's misuse of other people's bandwidth. Webspamming bots have crashed many webservers. The load gets so high, websites are suspended, just because a webspammer is spamming them. And by now, the more hard core webspammers are using means that are illegal by themselves: Zombie nets, using insecure scripts turned into spambots, turning any kind of script against its owners by inserting spammy contents.

So thank you for deciding on not allowing spambots. I hope you will include spamvertized domains in this decision as well! For any possible future infractions by other spammers, I mean.</description>
		<content:encoded><![CDATA[<p>To Russell,<br />
and thank YOU for your public reply!</p>
<p>Webspamming is not illegal in the same way mail spamming is. But if you look long and hard enough at it, you&#8217;ll soon find why it&#8217;s so unethical. It&#8217;s misuse of other people&#8217;s bandwidth. Webspamming bots have crashed many webservers. The load gets so high, websites are suspended, just because a webspammer is spamming them. And by now, the more hard core webspammers are using means that are illegal by themselves: Zombie nets, using insecure scripts turned into spambots, turning any kind of script against its owners by inserting spammy contents.</p>
<p>So thank you for deciding on not allowing spambots. I hope you will include spamvertized domains in this decision as well! For any possible future infractions by other spammers, I mean.
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: Russell</title>
		<link>http://spamhuntress.com/2006/07/28/glen-mccausland-turns-to-webspam/#comment-28258</link>
		<pubDate>Sat, 29 Jul 2006 14:17:12 +0000</pubDate>
		<guid>http://spamhuntress.com/2006/07/28/glen-mccausland-turns-to-webspam/#comment-28258</guid>
					<description>Hi.

I run hostingdirect.net. 65.98.40.122 is our address but not the one that Joanne mentions 65.98.42.234. Fortressitx is a large dedicated server company and their servers and addresses are used by all sorts of companies for all sorts of reasons. 

As a web hosting company we have signups from all over the world. We have a very tough acceptable use policy (http://hostingdirect.net/aup.htm) and immediately cancel spammers. I would say that about one in ten new signups almost immediately starts email spamming or puts up a phishing page. We have active monitoring that allows us to turn them off almost immediately. We also have the maximum number of emails per hour per account set very low on our servers - far lower than a spammer would need, so at worst only about a thousand spam letters go out before we cancel.

I have actually talked with Glen by telephone in the course of setting up his account. Seems like a nice enough guy. His hosting package did not set off our email spam monitors. As far as I know, what he is doing is legal. But we did have a company meeting last night to review his use of our server and we decided to cancel his hosting. Hosting Direct simply does not need badwill caused by one of our budget hosting companies. We have over 1500 well behaved domains, mostly small churches, hobbyists and family sites. We cater to stable long term clients. I hope you understand that it is difficult to find new clients to serve without attracting some dicey characters, and that we spend a lot of time and effort to keep our good clients safe and sound (and out of the blacklists).

Thank you for your patience and understanding. And thanks for the heads up on this blogspamming operation.</description>
		<content:encoded><![CDATA[<p>Hi.</p>
<p>I run hostingdirect.net. 65.98.40.122 is our address but not the one that Joanne mentions 65.98.42.234. Fortressitx is a large dedicated server company and their servers and addresses are used by all sorts of companies for all sorts of reasons. </p>
<p>As a web hosting company we have signups from all over the world. We have a very tough acceptable use policy (http://hostingdirect.net/aup.htm) and immediately cancel spammers. I would say that about one in ten new signups almost immediately starts email spamming or puts up a phishing page. We have active monitoring that allows us to turn them off almost immediately. We also have the maximum number of emails per hour per account set very low on our servers - far lower than a spammer would need, so at worst only about a thousand spam letters go out before we cancel.</p>
<p>I have actually talked with Glen by telephone in the course of setting up his account. Seems like a nice enough guy. His hosting package did not set off our email spam monitors. As far as I know, what he is doing is legal. But we did have a company meeting last night to review his use of our server and we decided to cancel his hosting. Hosting Direct simply does not need badwill caused by one of our budget hosting companies. We have over 1500 well behaved domains, mostly small churches, hobbyists and family sites. We cater to stable long term clients. I hope you understand that it is difficult to find new clients to serve without attracting some dicey characters, and that we spend a lot of time and effort to keep our good clients safe and sound (and out of the blacklists).</p>
<p>Thank you for your patience and understanding. And thanks for the heads up on this blogspamming operation.
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: admin</title>
		<link>http://spamhuntress.com/2006/07/28/glen-mccausland-turns-to-webspam/#comment-28232</link>
		<pubDate>Sat, 29 Jul 2006 12:27:50 +0000</pubDate>
		<guid>http://spamhuntress.com/2006/07/28/glen-mccausland-turns-to-webspam/#comment-28232</guid>
					<description>To Joanne:
rwhois may be down, but we know the server in question belongs to hostingdirect.net, just by following the breadcrumbs (hdllc.net redirects there).</description>
		<content:encoded><![CDATA[<p>To Joanne:<br />
rwhois may be down, but we know the server in question belongs to hostingdirect.net, just by following the breadcrumbs (hdllc.net redirects there).
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: Vasily Pumpkin</title>
		<link>http://spamhuntress.com/2006/07/28/glen-mccausland-turns-to-webspam/#comment-28205</link>
		<pubDate>Sat, 29 Jul 2006 10:55:26 +0000</pubDate>
		<guid>http://spamhuntress.com/2006/07/28/glen-mccausland-turns-to-webspam/#comment-28205</guid>
					<description>Yes, rwhois.fortressitx.com:4443 isn't really responsive. Actually it even seems to be firewalled as it doesn't send an ICMP error code, the request simply remains unanswered and times out. Makes me wonder though why they set up an rwhois server at all...

Regarding "old school" spammers switching to web spam: There are quite a lot people on the move as it's simply more effective, offers more opportunities to monetise the traffic (made for adsense/overture) and most of all isn't considered a legal offense. If hosting companies are carefully selected, there's almost nothing that could stop you from mass spamming other people's sites.

Almost, of course the upstream provider could take the spam issue more seriously. And although there are still enough people who'll never learn (and who prefer crying over spilt milk rather than being proactive) more and more people do prevent spam from seeing the light of day, which means a spammer has to target larger quantities of sites, thus requiring both more resources and time to build up an effective revenue stream.</description>
		<content:encoded><![CDATA[<p>Yes, rwhois.fortressitx.com:4443 isn&#8217;t really responsive. Actually it even seems to be firewalled as it doesn&#8217;t send an ICMP error code, the request simply remains unanswered and times out. Makes me wonder though why they set up an rwhois server at all&#8230;</p>
<p>Regarding &#8220;old school&#8221; spammers switching to web spam: There are quite a lot people on the move as it&#8217;s simply more effective, offers more opportunities to monetise the traffic (made for adsense/overture) and most of all isn&#8217;t considered a legal offense. If hosting companies are carefully selected, there&#8217;s almost nothing that could stop you from mass spamming other people&#8217;s sites.</p>
<p>Almost, of course the upstream provider could take the spam issue more seriously. And although there are still enough people who&#8217;ll never learn (and who prefer crying over spilt milk rather than being proactive) more and more people do prevent spam from seeing the light of day, which means a spammer has to target larger quantities of sites, thus requiring both more resources and time to build up an effective revenue stream.
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: Joanne</title>
		<link>http://spamhuntress.com/2006/07/28/glen-mccausland-turns-to-webspam/#comment-28092</link>
		<pubDate>Sat, 29 Jul 2006 04:43:45 +0000</pubDate>
		<guid>http://spamhuntress.com/2006/07/28/glen-mccausland-turns-to-webspam/#comment-28092</guid>
					<description>Hm, 65.98.40.122 is in a netblock from which I experienced an SSH attack that was more intelligent than what I'd experienced before. That ultimately lead me to perform a whois on the whole netblock. It seems fortressitx.com owns everything in 65.98.0.0/12 and apparently has no whois server that works via the whois utilities. As a result I have banned their entire subnet from my networks here "for extreme suspicion". This attack took place on the 27th from a different IP in their range, 65.98.42.234 which has interestingly evocative names - server1045.servers101.com and server2.netonemedia.com. They may be a server farm company. In which case there's no legitimate chance my machine should be contacted from their netblock by ssh. And I don't know of any REAL servers that submit to weblogs for anything legitimate.

{^_^}  Joanne</description>
		<content:encoded><![CDATA[<p>Hm, 65.98.40.122 is in a netblock from which I experienced an SSH attack that was more intelligent than what I&#8217;d experienced before. That ultimately lead me to perform a whois on the whole netblock. It seems fortressitx.com owns everything in 65.98.0.0/12 and apparently has no whois server that works via the whois utilities. As a result I have banned their entire subnet from my networks here &#8220;for extreme suspicion&#8221;. This attack took place on the 27th from a different IP in their range, 65.98.42.234 which has interestingly evocative names - server1045.servers101.com and server2.netonemedia.com. They may be a server farm company. In which case there&#8217;s no legitimate chance my machine should be contacted from their netblock by ssh. And I don&#8217;t know of any REAL servers that submit to weblogs for anything legitimate.</p>
<p>{^_^}  Joanne
</p>
]]></content:encoded>
				</item>
</channel>
</rss>
