Subject: [Asrg] Massive bounce rates on spammer lists

From: Justin Mason <[email-masked]>
Date: Thu, 06 Mar 2003 16:59:59 +0000

Folks -- this is relevant to David Skoll's proposal yesterday -- the
bounce-counting network.

It's a quick quote from Steve Linford, who runs (or at least is the public
face of) spamhaus.org, so he has some knowledge of the situation.

It's pretty clear if we could correlate the ratio of bouncing/non-bouncing
recipient addresses by source, it could make a good system...

>  [...] Spammers are so used to everything not working properly that
>  they wouldn't notice or care much about it. The same goes for
>  WPoison, most spammers are bulking 50 million spams per day now of
>  which only a fraction is deliverable. They don't care what percentage
>  is deliverable or how much is stopped by DNSBLs or spam filters,
>  since with 50 million going out they'll always get enough through to
>  make the sales anyway.
>
>  Ralsky says that the more he's hindered by anti-spam devices the
>  higher the volumes he bulks out to compensate for it.
>
>  As an example of how much they care, spammers no longer bother
>  washing their lists of abuse desks or sysop addresses or TLDs such as
>  .gov or .mil (as a consequence the U.S.Navy now uses the SBL, saying
>  the amount of spam flooding their ships was getting ridiculous).
>
>  Spammer Kelly Joe Ellis specializes in address lists which are
>  completely Excel generated. He advertises his lists as "100 Million
>  PC-Generated addresses with 60-85% Connectivity Ratio!". With the
>  amount of undeliverables these guys are used to, they certainly
>  wouldn't notice a tarpit or any other anti-spam 'spoiler'. The only
>  pain they feel is caused by ISPs terminating their leased lines or
>  hosting accounts.

--j.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "David F. Skoll" <[email-masked]>
Date: Thu, 6 Mar 2003 12:45:47 -0500 (EST)

> Folks -- this is relevant to David Skoll's proposal yesterday -- the

Thanks for that.  I have a refinement to the proposal that makes it
unlikely to hurt valid mailing lists: You only report the offending IP
if your DSN itself bounces (alternatively, you punish a bounced DSN
with a very high weight.)  Of course, you need a way to correlate the
DSN to the original IP, but that seems pretty easy---you control the DSN
contents, so you put a special (encrypted, maybe) header in it indicating
the original source of the e-mail.

Therefore, legitimate (but stale) mailing lists will not be penalized
as much as spammers with fake sender addresses.

You also penalize mail from "<>" to an invalid address, because that
is a fairly clear indication of spamming.

--
David.

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 06 Mar 2003 13:07:38 -0500

> is a fairly clear indication of spamming.

As a FYI, this isn't our experience.  Mail from "<>" to an "invalid" 
address is perhaps even more often a postmaster bounce to a spam forged 
in our domain.

Of the 225048 connects to our spamtrap so far today, 1747 (~ 1%) of them 
are bounces of spam forged in our spamtrap's domain (detected by 
checking for both a null return address and "postmaster" or "daemon" 
(from mailer-daemon in the body From)).  It varies a lot day-by day. For 
two days in a row this week it was in excess of 20%.

The idea has some merit, but it'll need more tuning than meets the eye 
first glance.

---

From: [email-masked] (Justin Mason)
Date: Thu, 06 Mar 2003 18:10:15 +0000

> the original source of the e-mail.

Actually, I'm not sure that's a good idea; it'll provide an impetus for
spammers to joe-job, impersonating known-valid From addrs (typically
by picking one at random from the same list of addresses).

--j.

---

From: "David F. Skoll" <[email-masked]>
Date: Thu, 6 Mar 2003 13:10:35 -0500 (EST)

> address is perhaps even more often a postmaster bounce to a spam forged

Hmm.  OK.  Scratch that one. :-( Although you might be able to tell by
the message contents if you delay the rejection.  A DSN (what happens
in the forged-sender case) typically looks quite different from an
actual spam pretending to be from <>  And disguising spam as a DSN
isn't too attractive, because most end-users are highly-confused
by DSN's.

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 6 Mar 2003 15:36:35 -0500

>the message contents if you delay the rejection.  A DSN (what happens

Not necessarily.  I've seen spam (and viruses) forged to look like a bounce.

On the bright side, it's my experience that many non-technical useres 
delete bounces thinking they are spam anyway.  :-(
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg