Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


BudgetNode got nullrouted* because of a Spamhaus listing (*fixed by now)
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

BudgetNode got nullrouted* because of a Spamhaus listing (*fixed by now)

Just thought I'd let you all share in the fun that is trigger-happy spam blacklists:

Dear Customer,

Earlier today we discovered that our IP range 185.147.34.0/24 was nullrouted by the upstream. If you had an IP from that range it would have been inaccessible.

The cause for this downtime was due to a Spamhaus SBL listing which prompted the upstream to block the range until it was resolved. We are disappointed we were not given time to resolve this issue.

Your services should be back online and we sincerely apologize for the inconvenience caused.

Please note that we are working directly with Spamhaus and our upstream to ensure something like this doesn't happen again.

Thank you for your understanding,

BudgetNode Operations

The listing seems to be based on an incident from a single IP, and exists since yesterday 1:40 GMT: https://www.spamhaus.org/sbl/query/SBL387023
The /24 was nullrouted at 8:02 GMT and came back 11 hours later at 19:09 GMT.

I was going to say "what took them so long", but I assume with their prices, BN probably don't exactly have a premium support contact with their upstream…
So while I'm not a huge fan of BudgetNode, this one apparently wasn't their fault.

But can someone explain to me how a single-IP spam report immediately got the entire /24 listed on Spamhaus? Seems excessive even by their standards…

Comments

  • gestiondbigestiondbi Member, Patron Provider
    edited January 2018

    Spamhaus power trip. Lots of company take them for gods even they act like as***les.

  • FranciscoFrancisco Top Host, Host Rep, Veteran

    That's really lame.

    That's just really dumb given how lit up hostslim is on there already for spam ops.

    Francisco

  • @Francisco said:
    That's just really dumb given how lit up hostslim is on there already for spam ops.

    They do have a bunch of listings…
    Do you think they (Hostslim) really are sloppy/lenient about spam, or is that just Spamhaus being trigger-happy?

  • FranciscoFrancisco Top Host, Host Rep, Veteran

    ucxo said: Do you think they (Hostslim) really are sloppy/lenient about spam, or is that just Spamhaus being trigger-happy?

    Probably both.

    Once you've been sloppy a few too many times spamhaus moves from punching you in the arm to sacking you in the nuts to get the message across.

    If you read the prior listings though they're because the whole block is dirty, not a single IP flagging things.

    Francisco

  • This is actually the first time I've witnessed an IP range being nullrouted because of a spam complaint.

    I wonder if Hostslim really pulled the plug themselves or if it was their upstream (they're single-homed via Serverius)…

  • IshaqIshaq Member
    edited January 2018

    HostSlim claimed that Serverius only provide 4 hours to resolve it, which on a weekend is not reasonable at all, if true. We weren't given notice by Spamhaus or any of the upstreams.

    Either way, HostSlim is only the infra provider and it's not even their IP space.

    It's probably due to their other listings (numerous /24s and /22s) that caused the immediate SBL on our range.

    Thanked by 1ucxo
  • ClouviderClouvider Member, Patron Provider

    That looks extremely professional on the upstream part. Just wow.

  • @Jack said:
    Cogent are the only tier1 that I have found to really cares about SBLs, they have some automation blacklist that stops routing your prefix should more than a /32 get listed, when prefix announced was a /20 and only a /29 was listed.

    I found that quite unprofessional.

    Cogent is not a tier1 provider ;)

    Thanked by 2VirtualByte Rhys
  • @Jack said:
    so I’ll let you have that.

    Thanks Lord

    Thanked by 1Clouvider
Sign In or Register to comment.