ROKSO Home  |  ROKSO FAQs & Policies  |  About Spamhaus  |  FAQs
The Register of Known Spam Operations

Evidence Menu:

EmailBlastUSA Index

Country: United States of America
State: AZ
Spam organization that sends spam hawking its own spam address lists and spamming services. Spams from VPS servers at inexpensive providers, and according to recent reports also uses malware to infect control panel software and spam through hijacked IP addresses. Formerly an extremely high volume spammer that switched to distributed snowshoe spamming after many major carriers stopped selling unlimited bandwidth plans. Formerly made extensive use of free anonymous domains, later switched to using bulk throwaway domains.

EmailBlastUSA SBL Listings History
Current SBL Listings
Archived SBL Listings

July 2016: WARNING To Cloud-based ISPs and Hosting Providers

[Last Updated July 2016]

In the past few weeks, EmailBlastUSA has moved its operations from Verizon Wireless dynamic IPs to cheap VPS servers, mostly at large reputable ISPs that allow automated signups. Spamhaus believes that it has made this change because the Verizon Wireless IPs that it previously spammed from are all listed in the Spamhaus PBL, and so its delivery rates would have been extremely low. (Most of its spam would never reach customers.)

It has so far abused the services of the following providers:

* 1 and 1 Internet
* CenturyLink
* Digital Ocean
* Internap
* Rackspace

In the past two weeks, it has abused 1and1 and Rackspace, but we do not believe that it is likely to restrict itself to those providers. EmailBlastUSA also does not appear to choose Cloud providers based on the perception that the provider is spam-friendly. 1 and 1 Internet and Rackspace, which it has abused most recently, both have excellent anti-spam teams and strong policies against spam and abuse. Despite this, EmailBlastUSA has spammed from a number of VPS servers at 1and1 and Rackspace.

Spamhaus believes that, in order to maximize its "longevity" on an ISP or host, EmailBlastUSA obtains several accounts and multiple non-contiguous IP addresses on a provider's ranges before it starts to spam. It then spams heavily from one or two of those ranges until the provider shuts it down. If the provider simply shuts down the spewing IP and does not carefully look for and shut down the additional accounts, EmailBlastUSA will simply switch to one of those accounts and continue to spam.

In other words, it spams from cloud provider IPs just as it does from Verizon Wireless dynamic IPs. We suspect that is has its own spam software and is using it with the cloud providers just as it did with Verizon Wireless.

Spamhaus recommends that cloud providers review the Main Information of this ROKSO, and configure any automated account creation system that they use to flag any new account opened using a name, postal address, email address, or phone number mentioned there.

The Register of Known Spam Operations (ROKSO) collates information and evidence on entities with a history of spamming or providing spam services, and entities affiliated or otherwise connected with them, for the purpose of assisting ISP Abuse Desks and Law Enforcement Agencies.
The address of this ROKSO record is:

The above consists of information in the public domain. The Spamhaus Project makes every effort to avoid errors in information in the ROKSO database, and will correct any errors as soon as it is able to verify the correction, but accepts no responsibility or liability for any errors or omissions, or liability for any loss or damage, consequential or otherwise, incurred in reliance on the material in these pages. The Spamhaus Project makes no warranties or representations as to the accuracy of the Information in ROKSO records. The information in the ROKSO database is for information purposes only and is not intended as legal advice of any kind.

For information on contacting the ROKSO Team regarding any factual errors in this record, see the ROKSO FAQs.
© 1998-2021 The Spamhaus Project SLU. All rights reserved.
Legal  |  Privacy