10

The domain name "baba support" has been building up considerable spam pressure against the Stack Exchange sites, as seen in this metasmoke report:

https://metasmoke.erwaysoftware.com/domains/16302

Currently, it shows 78 spam samples, the majority of which have arrived in the last two weeks, at an accelerating rate. The oldest are four months old.

The spam messages are vaguely promoting technical support services, often with what appears to be thinly disguised "answers" to questions which are by and large unrelated (for instance, just now, here's one about Raspberry Pi on an Ubuntu site which gets a "reply" promoting Microsoft Edge support services.)

Baba is not alone; in metasmoke, we have 18 domains currently tagged with #fake-tech-support but the other 17 together have spammed less than this one operation. (Tagging is a relatively new feature and not many of our volunteers are actively updating tags, so this is necessarily an incomplete view.)

As a Stack Exchange user and Charcoal volunteer, I think this needs to be escalated to the service providers whose networks are being used to perpetrate this; very often, the spammers are violating the terms of service of their providers by using spam to drive traffic to their site.

The domain is hosted on 107.155.66.50 which appears to belong to Incero.com so that's where I am planning to complain. I have previously sent a complaint to GoDaddy / Domaincontrol as the DNS hosting appears to be theirs.

Are there any other providers I am missing, and could be getting in touch with?

5

As a partial answer, Babasupport is now instead hosted on 185.101.218.208 so it seems they were kicked off Incero. I will be posting a new abuse report to the netblock owner budgetnode.com now.

Their TOS clause 20(c) expressly prohibits this behavior, and items 4 and 9(n) are also pertinent.

  • This is now Budgetnode ticket DHT-713-270 – tripleee Mar 26 '18 at 10:16
  • I am curious. Are they using a free web hosting? – A J Mar 26 '18 at 12:49
  • @AJ I was thinking the same thing but I'm guessing they are on one of the non-free plans. That makes it slightly harder contractually for Budget to cut them off, I imagine. – tripleee Mar 26 '18 at 12:50
  • Yes, exactly. But let's see what happens. – A J Mar 26 '18 at 12:53
  • Budgetnode bluntly report that they will not disconnect the target domain for a spam campaign. They seem unconcerned that this turns them into a spam haven. – tripleee Apr 6 '18 at 5:48
  • Ohh. Then we have only choice left is to continue to nuke them wherever and whenever they appear. They seem to have a new subdomain now as well. – A J Apr 6 '18 at 5:52
  • Independent complaints from other users might still be a way to try to persuade them, but please one per correspondent only, and keep it professional. – tripleee Apr 6 '18 at 5:56
4

As another update, it is now (knock on wood) 12 days since the latest spam promoting their site. They are now hosted on 185.52.3.26 which is probably unrelated to their previous hosting arrangement, though the first digit of the IP address is the same (this is 185.52.0.0/22AS198203 RamNode LLC in Atlanta GA, USA, while the previous hoster was in the UK).

https://passivedns.mnemonic.no/search indicates that this change took place in early April (the last time the old address was seen was April 4th, but the sample size is small and the next occurrence is almost two weeks later).

RamNode / Routelabel appears to have an AUP which clearly bans 'hosting web pages advertised within "spam e-mail" sent from another network (spamvertising)' so I'm being vaguely hopeful at this time.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .