Travis

Nov 9, 2021

Spam, Phishing, Virus and fraud-friendly ISP

A significant percentage of spam, phishing and virus email traffic to the two Email domains I am responsible for is received from rootlayer.net IP ranges. All incidents were reported to their registered "Abuse" email address but nothing was done and no response was received. In fact, the problem got worse, as if my email address was then confirmed as a suitable target. I was therefore forced to block all traffic from their servers, in order to protect my network and its users. For those Email Admins who want to block malicious content from Rootlayer, the following factual information will be useful: Trustnet does not alllow me to publish here the IP address ranges allocated to Rootlayer. However, as a prelude to blocking them, you can search the database at ipinfo.io for the ASN terms below: Allocated by APNIC (two ranges): ASN: AS140960 Allocated by RIPE (8 ranges): ASN: AS51447 All of the IP addresses in these ranges are rated as 'Suspicious' (>65/100), to 'High Risk' (up to 100/100) by independent Fraud Prevention service IPQualityscore. For confirmation of this, you can check addresses in these ranges at the IPQualityscore website, which you can easily find by an internet search. Please note that this is in no way an endorsement or promotion of IPQualityscore or their website, which is free to access. I have no relationship with them of any kind. The information they present is a useful resource in preventing fraud and cybercrime by malicious actors on the internet. It seems that the servers in the Rootlayer IP ranges are used as VPN proxies, allowing the true source of the malicious content to be obscured. However, if all the above ranges are BLOCKED on your servers, your users will be protected. "Rootlayer Web Services Ltd", the company used to obtain these adddress allocations, no longer exists. The company was dissolved in February 2020. You can confirm this by searching the UK Government 'Find and Update Company Information' service for Rootlayer or the Company number, which is 11566445 . Rootlayer servers are located in Amsterdam, Netherlands. Rootlayer is a client or reseller of hosting services provided by the Dutch company Worldstream. They are Rootlayer's "Upstream Provider". If you are subjected to malicious email content emitted by Rootlayer IP ranges, and receive, as I have, no response or action from their registered 'Abuse' contact you can try complaining to Worldstream the 'abuse' address on the Worldstream website. Please note that Rootlayer have objected to the Worldstream abuse contact email from being published here, on the grounds that it is "Promotion". But you can easily find what it is by doing an internet search. Dear Rootlayer, if I continue to get volumes of malicious email from your IP ranges, showing your tolerance of these activities, I'm going to keep complaining to your upstream provider, and I encourage all other exasperated email admins to do the same. Please note that unlike Rootlayer, I have no relationship with Worldstream of a commercial or any other kind of nature. They appear to be a legitimate internet services company and to be acting in good faith. They have a clear 'abuse' policy on their website. The volume of malicious traffic means that making reports via the Rootlayer ticket system, as they have suggested, is impractical. Rootlayer should conform to normal internet practice and accept reports to their registered 'Abuse' contact, which can easily found by making a 'whois' search for Rootlayer. Rootlayer has objected multiple times to me publishing their registered abuse contact email in this review, which is kind of strange for a responsible Internet Services Provider, don't you think?