Slashdot Mirror
Walling off Asian E-mail to Prevent Spam
SomeoneYouDontKnow writes: "Seems there's been lots of spam news lately. This piece from Wired describes how frustrated sysadmins in the West are responding to a torrent of Asian spam by simply refusing all e-mail from that part of the world. As anyone who's ever reported spam to Asian ISPs can attest, getting a response of any kind is almost impossible, so some ISPs are simply giving up on receiving any mail from them. Setting up barriers like this is regrettable, but when the originating ISPs refuse to take responsibility for the actions of their users or close their open mail servers, there would seem to be no other choice. Has anyone ever had any kind of constructive conversation with one of these ISPs to see why they are unable or unwilling to do anything?"
Sure, why not. Heck, I blocked France on principle!
46. The Hobo smiles, his eyes glaze over, and he burps. "Beware the man who has lived longer than the Wasteland."
On the other end, if many of those domains are in the Orbz or other blacklists, maybe just using those would be better.
Berto
it is nice how people keep submitting and slashdot keeps posting day old articles from wired.com
use peek-a-booty!
Is most of the english spam from Asia as well? Do American companies hire Asian spammers? What's going in?
I feel bad for the legitimate Asian users of e-mail trying to communicate with their comrades in the West, but it has been proven that this is the only way that ISPs will finally own up to the task of stopping spammers abusing the networks. Look what just the mere threat of the Usenet Death Penalty did to @Home--they have cleaned up their act significantly.
Strange as it is to say, this 'denial of service' is one that I think may actually have some future positive effect. The way the world seems to work is that no one will bother to do anything unless you threaten them with the loss of their service, and then they take action. Sad, but true.
Karma: Excellent Birds (mostly as a result of listening to Laurie Anderson)
is one thing. Not getting any cooperation when your own e-mail address is used as a false sender in the header of "enlarge your {certain male bodyparts}"-spam mails is a another thing. Ask me, it happened to me two weeks ago. I didn't even get a mail back from the provider.
Line 9: Argument of type SIGNATURE expected.
What about getting laws that say that unsolicitated mail is illegal? Shouldn't that do the trick? Anybody got some good reason for why laws like this shouldn't come true?
--
\ Christian A Strømmen
"It's not under our control." to any message you send to China Telecom. Hmmm, if nothing is under their control and they're a Chinese government controlled organiation........
May you be touched by His Noodly Appendage. RAmen.
...you basically are letting the spammers win when you close off one of the biggest open communications medium known to human kind. Perhaps I'm overly sentimental about it and goodness knows I'd love to prevent about 80% of the spam I see (that seems to be about the ratio in terms of TLDs involving Asian netblocks) - still, I cannot really bring myself to doing it yet.
--rc
Well blocking whole areas is a start, but not an ideal solution. I'm going to start filtering my email so that unless it meets one of the following conditions it gets rejected and sent back to the sender :-
1. The mail claims to be From someone I have pre-approved.
2. It's from a mailing list I've registered with.
3. It's sent To: a special purpose address within a couple of days of creating that address. (So I can post to newsgroups with addresses like jb10202 which will be valid for a couple of days for replies only)
4. The email contains a special approval code to bypass the checking.
The purpose of 4) is that when I get an email that is rejected it will send it back to the sender with an apology and a 4 digit random code which is valid only for a single mail from that address and only for 48 hours. They can simply forward the mail back to me and it will contain the code and get through.
I get *so* much spam, and 99% of my real email is from the same few address that I need to block the junk, and I think this scheme will annoy relativly few people, and not too much but should cut ALL the spam.
I've not implemented this yet, but it shouldn't be too hard to write.
Sig is taking a break!
never mind the chinese open relay problem, which is also a real hassle.
"It is a greater offense to steal men's labor, than their clothes"
I get tons of Asian language spam - it wouldn't break my heart to block them all.
I'm actually looking forward to my @home email address dying at the end of this month because that's where nearly all of them come to. Hopefully they won't be smart enough to simply replace @home.com with @comcast.net.
I run a small mail server, mostly providing mailing lists to the automotive community. While my lists weren't affected (I have reasonable anti-spam rules in place), a server in Taiwan was spamming every address it could find in my domain with dozens of unique spam per day.
The usual ip tracing ensued and I tracked it back to a small ISP. Hoping that I would reach someone who spoke (or wrote) English, I sent a copy of my logs and an explanation to "postmaster@", "abuse@", "webmaster@", and any other address I could think of. Amazingly enough, after about 12 hours, I received a reply (in somewhat broken English) asking for more logs, and a confirmation of the time zone I was using in my logs (UTC, for what it's worth). After I replied, I received an appology that one of their "clients" had bothered me and assured me it would be taken care of.
To this date, I have not received another piece of spam that I have attributed to that ISP. I realize that this is the exception and not the rule, but I thought it was worth noting that there really are reasonable sysadmins "over there".
-- "Other than that, how was the play Mrs. Lincoln?"
The first parallel that came to mind was the "death sentence" proposed against UUNet a few years ago for their fostering spamming activity.
The action represented the response of a group of responsible internet members that had finally tired of both the activity and the lack of response from a greedy company who seemed to have no respect for bandwidth and privacy issues.
It seemed to work then and maybe it's just what's needed now.
It's about time that some of these ISP's discover what happens when the fecal matter hits the oscillator.
We have met the enemy and he is us - Pogo (Walt Kelly)
I have resorted to blocking the offending network or ISP temporarily (until they get tired of getting no response from my networks and move on), but I really can't see blocking an entire segment of the world just to stop spam. It just goes against the grain of an "open" 'Net. I'd rather try something like SpamAssassin (no affiliation - I've just used it and it works great) than block nations for the actions of albeit many bad apples.
Sinepaw.org: Grape Winos
But... how will I get my hot bukkake newsletters??? I need my daily tentacle rape story!
Los Angeles took action to prevent automobile accidents by closing all incoming roads.
Obviously, nothing useful comes from Asia, huh?
Even in its simplest form=Those cheap DVD players will never get sold to Best Buy when the Asian maker can't reply back to the buyer. Geeks everwhere revolt...
---"What did I say that sounded like 'Tell me about your day?'"---
Yes, because they're some kind of email terrorists that are trying to shut down the legitimate communication because it is the work of satan. Think before you type.
How we know is more important than what we know.
Setting up barriers like this is regrettable, but when the originating ISPs refuse to take responsibility for the actions of their users or close their open mail servers, there would seem to be no other choice.
A good thing when you're trying to stop spam, a bad thing when the MPAA is trying to stop piracy. Depends on what you do for a living, I guess.
I've got alot of spam recently which comes from open relays which probably are home/ADSL users, a network below kix.ne.kr .
I've tried to contact Kix, but no response yet. I think I'm gonna blacklist them.
Not seen much other Asian spam yet, tho.
English is not my first language, so cut me some slack -: Om du kan lasa det har sa kan du Svenska
The Chinese gov't WANTS the west to block Asian email, that way they dont have to try so hard to stop the dissadents from getting the truth out from behind the wall.
... try and see.
The response was "without full e-mail headers, we can't do anything."
Hmmm. It's not e-mail.
I am discussing with my employer the option of blocking all 202/8 203/8 210/8 211/8, all of Road Runner but the MX'es, *.cn, *.tw, *.ru, *.pl, and *.mx domains too. I don't know the ip range assigned to the domains, so if you do, post a follow up! (I have Road Runner netblocks, there are just too many to put them here.)
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
I'm not comfortable with the idea of walling off a whole domain. If there is one domain that it would pay to wall off, that would be .com, because most injection points for spam are still in that domain.
I'd like to see a list that has some statistics as to which countries have the most open relays. MAPS was my solution till they started charging. A free, non-contract signing MAPS replacement would be preferable to blacklisting entire countries (for those of us who admin mail servers for business).
I have had my own domain since 1996. I started firewalling asian IP blocks in 1999 from port 25. Sometimes whole /8!
So this is nothing new. I've been doing it for years.
From Seinfeld -
"Stop short? That's my move!"
Take qwest for example. I *once* got an actual reply to one of numerous abuse mails regarding spam that was trivial to backtrace to a few locations (eg TX, FL) Most likely it were the same (few) spammers each and every time. It took me weeks of filtering and automatically have the spam bounce back to such addresses as abuse@ postmaster@ and even their DNS contact address. Needless to say the spam didn't stop though...
Admins *will* block entire IP blocks or even entire top level domains if nothing else helps. It's their good right, but it sucks for legitimate users of said ISPs of course.
And opt-out laws in some US states has certainly helped the spammers as well. I don't expect this to change unless spammers will get charged instead of (ultimately) you, the recipient.
Is this why my mail order bride isn't writing back to me?
in fact for a few months I blocked:
Hotmail
Yahoo
MSN
USA.net
When those folks learn how to close their relays and strip a virus then we can deal with the Asians....
This
Spam, while annoying, is not the end of the world. If it really gets on your nerves, use a program like Vipul's Razor, and help add spammers to its database.
Just because I don't like getting junk mail credit card offers, doesn't mean I refuse all mail from Delaware to teach them a lesson. Here's a tip--throw it away. I get nowhere near enough spam in my inbox to interfere with legitimate mail (although I don't doubt there are exceptions that do....) and I don't even use a filter!
I dunno, but I think a moral hacker would find it quite rewarding to screw up a spam creaters cash cow.
-- Dan
In November 2000 I spent 1 month in Hong Kong sorting out the Spam problems one of the largest ISPs was having, in my job as security consultant.
.net addresses, but were rapidly losing face amongst their peers for continuing to ignore the problems. *sigh*
The situation was dreadfull, with no abuse department and no way of detecting/stopping abusing customers, or even stopping customers being abused.
I killed 99% of the Spam by warning all customers we were testing for open relays, and offering to actually help them if they didn't know.
I then spent 2 weeks trying to configure about 30 different mail servers I had never even heard of, and one which didn't even return 1 result on Google!!
We got there in the end, especially once we firewalled port 25 for those customers who didn't want to listed.
The next step was to write belt-and-braces Terms of Service for the client and ensure the abuse@isp address was checked and actioned on a daily basis by a full-time member of staff. If abuse went unchecked, then we pulled the plug on the customer and banned them from coming back, or we'd prosecute (sometimes tricky in HK)
I *always* check who sends me spam, and I'm pleased to say none has originated from that ISP since I did my work there.
We tried to re-sell the solution to all other ISPs in the region, but they didn't bite due to a) expensive consultant fees, and b) not really caring.
I pointed out they were large ISPs who fully deserved their
Plan, that way every time I send an email to a college professor asking about one of his papers or send an email to someone who posts on Slashdot I'm gunna get carted off because it is unsolicited email. Probably best if people like you dont draft laws.
How we know is more important than what we know.
...I don't buy the argument about the docs being in english is a problem. In my experience the docs are many times confusing or hard to understand simply because they are written by someone whose primary language is not english. I have not yet had a problem finding help on the net when I don't "get" some aspect of the docs. I think that anyone using this argument is either ignorant, or thinks that I am.
But what else can be done to solve this problem with China and other Asian countries?
/benfit analysis might prove otherwise if the volumn is extream!) but has anyone offered to train someone from Asia on this side of the globe?
I agree that the 'no response' from many of these places is frustrating, but has anyone offered to train[1] some of these people in setup and configuration of their servers?
Has anyone who is bilingual offered to translate the user manuals into Japanese, Chinese, or Korean?
Has anyone taken the time to explain to them that by lax secuitry / improper setup on the EMail server usually points to more problems with in their network?
Education is the answer to this problem, and we need to take the lead.
[1] Okay, it might be impractial to fly halfway around the world to train someone in server configurations just to stop spam, (although a cost
III.IIVIVIXIIVIVIIIVVIIIIXVIIIXIIIIIIIIVIIIIVVIII
...and amazingly, we've never received a single complaint about not receiving mail from S. Korea.
Given, this is Northwestern Pennsylvania, so there aren't many Koreans up here.
Pax, Ardax
Cultural issues also contribute to the problem. Many spammers in Asia say they do not understand why spam is a problem.
"It's a sign of respect that someone sends you an electric business card. It means he wants you as a customer," said Zhao Peng, owner of a computer store in Hong Kong.
So what does it mean when they hammer your firewall all day long?
They're just being considerate in checking you for exploits? (Most scans originate from asia in my logs.)
I don't generate unique reply addresses per news post, but change addresses a few times a year. I have a bunch of old addresses that mostly get spam, so my filters dump incoming mail to them into a mailbox file that I look in every now and then. That's much less annoying than seeing the spam as it arrives, but still, it's better to keep the volume down.
I think I'll completely stop putting replyable email addresses on news posts. I'll just have a URL for my web site where people can leave me messages through a CGI. That lets me make another political statement too, since my web site runs SSL so any incoming messages I get from the CGI will be encrypted while in transit. We tell people to use ssh instead of telnet--we should also try to avoid sending email in the clear without a reason.
I do NOC work for one of the major backbone providers and we are forced to try to work with several of these ISP's who promote the spamming. We never hear back from these folks in problem investigations. Blocking them appears to be the only answer.
As I understand it, the Chinese are just victims of the rampant capitalism of everyone's favourite superpower. US spammers take advantage of lax system management in foreign countries to promote their products and services using spam. Thus, surely a more effective way to elimiate spam would be to cut the US off from the Internet. Fight the problem at it's source! This would have a number of other side benefits for the rest of the Global Internet as well.
I have a hard time rationalizing the expulsion of an entire cultures email rights in the states because of some bad seeds... but MAN do I hate SPAM.
Does this mean free email accounts (like Yahoo or Hotmail) will get a bunch of the email refugees from these afflicted regions?
At one time I was spending a couple hours a week configuring filters and deleting spam. Now I have a list of known addresses I accept mail from. Everything else goes into the spam folder. I check that once a week, takes about half an hour to go through it and move real messages to the appropriate places. Then I delete the rest.
Best Slashdot Co
"Setting up barriers like this is regrettable, but when the originating ISPs refuse to take responsibility for the actions of their users or close their open mail servers, there would seem to be no other choice. "
Do we really want ISP's taking responsibilities for the actions of their users? I can think of some downsides to that: if I find out an ISP is censoring e-mail based on what it's customers are sending, I might be more successful when I sue that ISP over content that appears on the sites it hosts which I find objectionable (Not that I would, but do you agree with the point in principle?)
"One empirical experiment is worth a thousand expert opinions." -Bill Nye
The 2 servers I manage and what I reccomend to many is to set up filters to block or auto-delete anything from that country's TLD. .kr is the biggest problem lately. It is too bad that it has to happen, but I at least tell people to set up their filters in such a way to make their maillists first and anything that is really wide like banning a country last. That way real email from somone about PicoGUI that is in the .kr land I will see, but the junk that goes to my inbox dies.
Do not look at laser with remaining good eye.
legitimate use of a DDoS attack. I know it is wrong on so many levels and immoral and all that, but doesn't it just make sense on a primitive level that if they are unwilling to shut down their open relays, someone else should shut them down for them? 24 hours notice, then hit them until they promise to shut it off. Make there be direct consequences for them not playing nice on the net.
Like I said, I know this is inherently flawed, but it is nice to dream. Mmmmmm, vigelante justice on the net...
Right, give us your name and we will.
I say SHUT DOWN any and all Human Rights violating Asian countries. Lock those bastards out of the real world! Fuck those geek assholes.
Systematically lock them bastards out forever! Fuck the SPAMMERS too!
the place where i colo is just now doing this after tracing the bulk of the spam coming into their own network from chinese ISPs and most especially china.com
rather than refusing email from the offending ISPs, they are going to the rather extreme measure of refusing connections entirely (at the router, i guess, though i'm not certain how the network is set up...) from the entire IP ranges of a number of the offenders.
so, now all my domains (and all those colo'd at my ISP) will basically be inaccessible to anyone in china. big deal. all the traffic i get from china is either spam or nimda requests. woo friggin hoo.
it has yet to go into effect, but i expect it will make a big difference in my monthly bills, as i pay for bandwidth, even if it's spam sent to people on my mail server.
as some folks are bound to say, it's more than a bit presumptuous to basically say "play by my rules or get off the field" where "my rules" are typically those of the mostly american, english speaking internet population, but in this case it's more a case of "play nice or go home"
- Entertaining Bits from the Ancient Kernel Tree
The article says:
Some Chinese and Korean systems administrators said documentation for the software they use is often available only in English, which complicates securing their systems.
This is an honest problem, because it's not the the ISP's fault that they can't get native-language documentation for the software. But if they're running the software at all, it becomes their problem. Why would any responsible system administrator install software when he can't read the documentation? Educated English speakers aren't such a minority in the far East. It's the ISP's responsibility to hire them, or else get software documented in their own language.
Cultural issues also contribute to the problem. Many spammers in Asia say they do not understand why spam is a problem. "It's a sign of respect that someone sends you an electric business card. It means he wants you as a customer."
This is just willful naivete on their part. If they think that sending an electronic business card is a "sign of respect", that's fine. But they need to understand that in the West, unsolicited advertising is an overwhelming inconvenience and is not welcome by the vast majority. Cultural relativism swings both ways.
Piracy is free and open and common in the far East, which irritates Western corporations and makes poor Western college students and hackers giggle with glee. It's rampant and unpoliced because the notion of information ownership and copyright just don't exist over there. But here's the flip side to that coin: unrestricted dataflow from the West into the East also means unrestricted dataflow from the East to the West. As music, movies and software comes in, spam goes out. Like it or not, they're both travelling through the same door.
If the Chinese ISPs want to provide their people a gateway to the free world, then it's their responsibility to cooperate with how the free world works and act responsibly within that setting. If they don't, then they get blacklisted like this and lose their right to be a gateway.
Why not use a domain hitlist? Get more than a couple of spams from a domain, bounce everything from the domain[1]. It's less arbitrary than closing off everything from Asia on the basis of a few spammer ISPs.
[1] Bye bye Yahoo, AOL, Hotmail for a start.
Government of the people, by corporate executives, for corporate profits.
The Asian nations would not be in this situation if they understood the proper way to run a mailserver and dropped the insane cultural notion that obnoxiously shoving a business card in someone's face is courteous and expected. I worked in Asia during the early 90s (mainly Singapore, Hong Kong and Taiwan) and from my experience of working with Asian businesses, this problem will not go away. Unless it's not hurting their bottom line, it doesn't matter if its hurting ours.
Strange women lying in ponds distributing swords is no basis for a system of government.
Think of what goes through an asian sysadmin's mind when he sees an english email in his inbox....
SPAM! No thank you I do _NOT_ want to make my penis bigger!
Send political spam using thier servers to Chinese citizens. I bet it will become a number one priority then. :)
"Because we are not employing at entry level, offshoring will kill our industry stone dead."
while we're on the subject, what about these damned anonymous FTP abusing bastards at t-dialin.net (a german ISP)?
every time i open up an ftp port on a server or punch a hole in a firewall, immediately, i get hit with anonymous requests from *.t-dialin.net trying to use its disk space to store porn and warez. no, i don't leave anon services available, but it's very frustrating to see all the requests in my logs...
oddly, i haven't seen any kind of coverage of this exploit except on a web admin mailing list saying, basically, "Fuck 'em. turn off anonymous services"
where is the outrage? where is the debate? oh yeah.. this is slashdot.
I run several small community mail servers, and I firewalled off China, Korea, Taiwan and Japan about a year ago. It was the best thing that I ever did for those servers. Spam dropped down drastically, and I'm yet to get a single complaint about somebody not getting mail. Sucks to be in China, I guess, but this is a solution that, for me, has proved to be perfect.
-Waldo Jaquith
- frustrated sysadmins in the West are responding to a torrent of Asian spam by simply refusing all e-mail from that part of the world [says Slashdot]
Anti-spam activists confirm that a growing number of beleaguered systems administrators are now blocking all e-mail originating from Asia from their systems [says the article]Bollocks, says anyone reading it with a critical eye. There are no references or sources for this sweeping "all Asian email" statement. The single reference is to Spamhaus which implements selective listing of domains that persistently generate or carry spam and decline to respond to spam reports. Most of their listed ISP's are currently US based. There is specific mention of two Chinese ISP's, and none from any other Asian nation.
To make a story out of this, you have to cite metrics. The fact that Spamhaus are currently blacklisting China Telecomm no more proves that "the west" is blocking "the east" than a story about anyone temporarily blacklisting AOL (again) proves that there is some mass move to block "the west".
Without giving metrics, you're just providing anecdotes. Persuasive anecdotes, sure, that probably appeal to our personal experiences, but those are the most dangerous kind, because they stop you looking for the real story and asking the real questions.
The real question here isn't "Why do Spamhaus currently blacklist China Telecomm?" but "Why don't Spamhaus currently blacklist Roadrunner?" or any of another half dozen ignorant ISP's that deny that they are injecting spam even in the face of unequivocable header evidence. Perhaps we in the "west" (sweeping-generalisations-r-us) could go about cleaning up our own house before we go gunning for those coming late to the party.
If you were blocking sigs, you wouldn't have to read this.
I run several mail servers, and I admit my filtering is noxesitant, I have as of late however began to recieve spam by the boatload from asia, Myself and my clients would have no problem with such a filter ?
Are there any sample sendmail configurations out there to reliably do geographic filtering ?
Sig went tro...aahemmm.....fishing........
Education is the answer to this problem, and we need to take the lead.
Education is the answer to ignorance. Are we sure ignorance is the problem? With so many reports of mails to abuse@ going ignored, so many open relays reported and yet remaining open, I have to wonder whether it's not often an attitude problem (not that Far Eastern ISPs have a monopoly on those), and that's much harder to know what to do about.
GROGGS: alive and well and living in
I average several dozen connections from those idiots every week. If I had some spare bandwidth, I'd actually do what a friend of mine did and set up an anonymous ftp server that would only allow uploads. He got some neat goodies.
Hey, the Chinese built that darn Great Wall back then to keep out the barbarians and now the barbarians want to build a wall to keep out the Chinese spam....
If they really want to stay in touch with people on the other side of the block they would do just fine by getting a Hotmail or Yahoo Mail account to correspond with.
-- This Space Intentionally Left Blank --
It would be nice if the DNS protocol could be extended to store spamming information on ip addresses (someone tell D. Eastlake, he'd love to write another RFC :) ). Something like a count of verified reports. That way when an SMTP request comes in the recieving server can simply do a reverse lookup on the ip and retrieve spam information, apply some rules and refuse/grant the connection.
This would make IPs clean up their act faster than blocking them or threatening to block them.
My $0.02 will always be worth more than your â0.02, so
Fuck Em
-Anonymous Coward
Yes, I'm posting this as an AC. Too lazy to create an account.
A few months ago my email address ended up on a Korean spam list. I've been using the following procmail rule since:
:0:
* (^From:.*\.kr |\
^.*ks_c_5601)
SPAM
It catches about 95% of the spam from Korea. It's sad that I've had to resort to filtering email from an entire country.
What has amazed me about the whole thing is the spam I receive from there is usually written in the ks_c_5601-1987 character set. Since Korean is not a really popular language throughout the world, the chances of someone understanding the spam is very slim (I haven't been about to find a good Korean to English translator that actaully works). IMHO, the spammers are just wasting their time.
Go not unto/. for advice, for you will be told both yea and nay (but have nothing to do with the question)
One thing you should consider for your antispam filter is spamassassin I recently set it up on a couple of mailboxes via. procmail, but it also sports a site wide daemon.
:)
After a little bit of tweaking I know use it to check for matching mails in the razor spam archive, against ordb.org and it's own check that sees if it matches usual spam criteria like claiming you can be removed from the list, claiming that the mail isn't spam or is in accordance with some US law etc - untill now it has cought every piece of spam I recieved (around 5-10 a day) and I've had no false positives yet.
Try it out - it's really great
Resistance is not futile - www.gnu.org
Shouldn't I block USA? It's the same arguments, right? Didn't some dude say: "How can you say to your brother, 'Let me remove that splinter from your eye,' while the wooden beam is in your eye?"
...
Blime...
-99999999, Criticizing a non-US culture
I recently got a spam that was relayed through an open relay at a huge IT contracting firm! I sent them an E-mail and asked them if they needed some more security people to help with their network management, along with a copy of the offending E-mail (Heh heh heh.)
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
I moved to Taiwan a while ago...since that time I have seen many companies (big computer companies of mainboards and notebooks included)....they just run their webserver over an ADSL connection and the mailserver (open of course) over another ADSL connection)....so what do you expect....English is still no motherlanguage here. Another thing is that it is sooo easy for them because they also want to send their private mail over the own mailserver....so they DONT WANT TO close the relay.... until the server is spammed and there are 1 million messages in the queue with the message to YOU PAY TOO MUCH..blabla
Internet Mail 2000 seems to me to be a nice solution to the spam problem! This way you don't have to download the spam if you get it, and if you do, the spammer (or their ISP) has to be online. This especially solves the problem of spammers that send out mail directly to your ISP/mailserver without using a relaying SMTP-server.
The cool thing is that Internet Mail 2000 can coexist with normal mail as we know it today. Smarter servers can check if the recipient supports IM2000, and if they don't, send normal SMTP.
I don't actually think it has been implemented yet, and it looks like there are a few issues left to solve, but nothing unsolvable.
This technique worked wonders last time I had that problem at Bellsouth. N.B. When you do this, it is important that you don't forward the mail directly, or else they'll just firewall you off. If you use the spammer's own open relays, either:
Say no to software patents.
Pacific rim hosts dominate the SpamCop statistics.
Well, there's always this tactic...
Simply report them to the police - identity theft and fraud are considered real crimes even by clueless law enforcement offices that usually don't do anything about spammers. (Yes, I've done it before).
This message is provided under the terms outlined at http://www.bero.org/terms.html
I keep a junk domain that I dont actually use for anything (used to belong to a small ISP 5 years ago), which gets nothing but spam. Every so often I change the dns record to point the mail to one of the ips that the spammers use. Let them deal with it. Changing the IP address periodicly to whoever last checked for an open relay also seems fitting...
If I point it to 127.0.0.1, will it just try to connect to their own server? (I'm somewhat new to mail server configuration, tho my relays are closed)
Anyone can sign up for free email with Yahoo and use it to mail their friends in the US. I doubt Yahoo would be black listed...
I know it affects traffic to ISPs a lot, but as a user, the amount of spam I recieve relative to normal emails is on a ratio of about 3% or less (that's with 4 accounts all with visible addresses all over over the place). Could it be that spammers are targetting the US from specific Asian countries? It could be due to my ISP's diligence, but I don't get enough spam that a few filters wouldn't stop.
I have refusing email from all Asian sites for about 3 years now, it's only come a bigger problem in the last year or so. For the few friends I have in that area I allow their messages to get through Sendmails filters, otherwise all of that part of the world (including anything that had or has to do with Russia in it's previous or current form are also blocked, same reason). It's shame really, the Internet use to be a nice friendly happy place at one time.
Translate your messsage into Chinese, Korean whatever before sending it. It probaby wont help, but I think there is a slightly better chance of a reply. (I tried pasting results here but it wont allow it. Oh well.)
Have you read the Moderator Guidelines yet?
I've sent scores of notifications to Chinese and Korean ISPs about their infected (NIMDA, CODE RED) systems detected here, and have for the most part received bounced emails saying the server name or user name (pointed out by tools such as GEEKTOOLS WHOIS proxy) doesn't exist. One ISP insisted that the IP address of an infected system didn't belong to them, even though every WHOIS out there pointed to that ISP. Probes from these infected systems continue, and are apparently out of control.
I don't really feel sorry for the Asian ISPs or their customers. Sucks to be them-but this is the kind of thing people have to do to clamp down on bad behavior without the intervention of government. I don't think spamming should be illegal-it's annoying as hell-but pressing the delete button seems to be pretty easy. In addition-as most slashdotters know, there are ways to avoid spammers. Have several e-mail accounts, one with your ISP that you use for personal correspondence, and another with a free e-mail account that you use for "official" purposes and in newsgroups (I actually did a test without two hotmail accounts I created, and the one that I used for what was then dejanews quickly got about 10X as much spam). Also, it's not like they can't keep in touch with their friends in the US. I assume e-mail can come through-and they can always get a free e-mail account with yahoo, excite or even hotmail. Anyway, ignorance is no excuse.
NO gods, NO governments, NO [OPTION]....
It seems to have escaped Slashdot's collective notice that the same nations that have uncontrolled spamming also have uncontrolled piracy. It's breathtaking how quickly this community embraces strongarm tactics to stop spam (a crime they don't like) but protests any attempts to stop piracy (a crime they do like). Just for kicks, imagine that there is a group of people out there who feel as strongly about stopping piracy as you all do about stopping spam. This should help you come to the realization that many of the arguments posted here about the evils of anti-piracy laws apply equally well to anti-spam laws.
Go on. give it a try.
As most /.ers should know by now, the Chinese government just ordered all ISPs in China to start monitoring
. ,It is glad , :
email for subversive phrases and the like, so just reply to
Chinese spam with little replies of the form at the end of this spam.
Might be a useful tactic on companies who think that unsolicited
email is "just regular advertising".
Bill
"Jack(export manager)" wrote:
>
> Dear Sir
> How are you
>
> We are a lighting factory in China
> to introduce ourselves to you:
>
> I am XUBIN (Jack) , XUBIN is my chinese name , you can just
> call me Jack !! , I am export manager of [deleted]
> China, our group have four factory
[snipped]
>
> Here is our company profile
>
[Rest of sales talk snipped]
(And now, the reply)
Thank you for your coded order. The weapons and ammunition
will ship by way of the usual route in ten days, and you
already know our secret Swiss bank account number to
wire the payment to.
It is a pleasure doing business with you for so long,
and I hope your cause will prevail. I am new to this
particular computer, so I hope the encryption is
working and the monitoring authorities cannot read
what I am sending you.
Long live the Falun Gong! Free Tibet!
Best regards,
Your arms supplier
There's 10 types of people in this world, those who understand binary and those who don't.
I've read a few of the opinions here about why they're uneasy about blocking off entire domains like this, but I still can't see this as anything but a Good Thing(tm).
There are those who are uneasy about blocking off access to a free and open medium. But if the medium is truly free, then you should also be free to block traffic that you don't want. Seriously, if you carry that point of view to its logical conlusion you shouldn't be trying to avoid spam to begin with and reading it should be compulsory. Just because everybody has a voice doesn't mean you have to listen.
Should ISPs be held accountable for the actions of their users? No. But they should be held accountable for their own actions, and one of their actions is aiding and abetting known spamers. They've received the warnings and complaints, they've seen their own mail server traffic and have access to their own logs, and their decision to do nothing implicates them. If a bartender can be held accountable for letting a known drunk drive home and if a gun store owner can be held accountable for selling a gun to a known felon, why shouldn't ISP's be held accountable for selling service to a known spammer?
And as for the legitimate mails that may get blocked by firewalling off Korea or whatever, why should we be held accountable for the foolish choices made by these customers? If anything, blocking their e-mails should be seen as a benefit, allowing the user to learn first-hand the despicable pro-spam tactics of their ISP and make an informed decision. If they don't jump ship after that they deserve what they get.
They're our routers, our mail servers, as long as our actions don't abuse other peoples' resources (like spammers) why shouldn't we do whatever we damn well please with them?
At my last job, working for a NASA contractor, we suffered a constant barrage of attacks that all seemed to originate in Beijing, or Seoul. Blocking Class-C blocks at a time knocked out the Seoul communications, but China was another matter. This went on for some time, with myself sending e-mail after e-mail to China Net with no responses. The difficulty arose from our having offices in Shanghai, so a total block of all addresses was next to impossible. (Anyone who has worked with China Net before can attest to the difficulties of getting static IPs, or *anything* for that matter) Another difficulty arose from the dynamic assignment of IPs by China Net as packets cleared their network. It was difficult to trace and block, and eventually my edge router configurations wound up with quite a group of extended access-lists. We had to ship off a VPN solution to our Shanghai offices, and hold our breath while we punched down tightened controls. After a couple of months though, we finally managed to stop the assault. It was annoying to be forced to such extreme measures, that wound up costing the company significant dollars in manhours, equipment, and travel time just because of the lack of professional courtesy from across the ocean. On a positive note, at least it taught me to be entirely proactive with my blocks, and now I don't hesitate to toss people's packets into /dev/null. Cynical perhaps, but necessary IMHO.
It doesn't hurt a random asian ISP that they are blocked, meaning that there wouldn't be much change.
Let's rather block the #1 origin of spam: US.
Oh, wait a minute... that would be pretty painful, right? It would actually have influence? ISP's would risk getting a clue when americans couldn't e-mail other Americans?
No, nevermind. Let's keep out of sanctions that actually hurt. Let's block someone, we don't care about. Let's stay out of sacrifices. No need to let American ISP-spamhauses suffer. After all, they are the good guys, right?
- Peter Brodersen; professional nerd
In addition to using the ORBZ list we block out the other three big domestic Spam sources, msn.com, hotmail.com, and yahoo.com. This helps a lot, but in general any web-based mail service that allows anonymous accounts is a good target. As the co-owner of several small private (not an ISP) domains, we can do this. As digital snobs, we don't really want mail from the digitally impaired, so, we can do this.
Actually, the few people trapped on those services that we want communication with we make exceptions and allow their mail to pass, but they have to know their recipient well enough to call first and set it up.
Some ISPs were simply getting so many connections from Asian ISPs that they had to firewall them off in order to get connections from the mail servers they wanted to connect to.
Sneakemail -- Disposable email address service
I use these guys and I never get spam, the rare ocasion I do, I know who leaked it/sold it... or where it was harvested from.
1. The mail claims to be From someone I have pre-approved.
2. It's from a mailing list I've registered with.
4. The email contains a special approval code to bypass the checking.
The way you describe it make's sense. It's almost like a stateful firewal for email. Block all incoming, with certain exceptions. Allow all outgoing. Allow the responses to those back in.
Hmm. Perhaps my SMTP server should keep track of who I send email to, so it can automatically accept the replies and block the others. There'd be problems with that of course, since replies don't always come from the same address. But it's an idea to play with.
they usually surrender right away ;)
OK, this conspiracy theory nonsense, but here goes anyway:
Suppose you're a regime that doesn't WANT its people communicating with the rest of the world. Building a firewall is part of a solution, but no firewall is perfect. Why not get the "enemy" to build it for you? And then blame them.
How to get them to do it? Let open relays run. Let spam happen. Give everyone else a reason to block. When they do, they've built your firewall for you. And when there are any complaints about communications failures, your regime can truthfully say it's THEM that are doing the blocking.
I am NOT saying that the spam should be tolerated.
Nor am I willing to say the above speculation isn't a lot of hooey. Myself, I wish my ISP would get around to blocking a few alleged ISPs in the region that seem to have NO non-spamming users.
also known as Sneakemail.
What I find frustrating as someone that filters a whole lot of spam on my servers is that I can't get usable information out of the APNIC WHOIS. I really can't find anything worthwhile in about 90% of my queries while LARTing spam. It's quite frustrating. I've considered blocking all .cn, .kr, .jp, .tw, .ar, .br, and other TLDs since I don't directly contact any body in those particulat TLDs. I am on mailing lists that have addresses with those TLDs on them that I would have to account for. As a sysadmin I find the quality of foreign WHOIS to be a major problem.
"...but when the originating ISPs refuse to take responsibility for the actions of their users..."
Excuse me... but am I the only one who read this part...
Do you take responsibility for a 16 year old kid on your network hacking ? what about so f*#$wit looking at kiddy porn ?
Didn't think so
We aren't blocking every country that sends us spam...
"Whataya MEAN we can't get mail from our own country?"
Unfortunatly, blocking entire ranges of IP addresses is not a possibility for us since we have many international clients. The one time we tried to block a mexican ISP because it was spam-bombing us - we had 3 of our best clients complain that their mexican customers could no longer reach their website -- so blocking is not a possibility.
We have had limited success (more so in the US than elsewhere) in contacting upstream haul providers. It does work however... especially if you can save the proof of the spams to show the routing to the ops.
One thing that would help (though some you won't agree on this)... is to do away with HTML Attached email and go back to the (thankfully) good old days of text-only email. This not only decreases the size of the spam... it makes it less attractive as an advertising mechanism because you can't push photo's, etc... and do tricky 1x1 gifs to trace emails (plus it increases security since text-only emails cant be *executed*).
However... the single largest thing that people here in the states can do is (1) Fix your form remailers so they can't be used by webcam spammers (HI... I'M SUSSY AND I JUST GOT MY WEBCAM... SEE ME AT...)... and fix your sendmail so it doesn't act as relays... most of these foreign spammers do their best hiding by using legit US ISPs as unwanton relays... fixing our own software would reduce the number of places these spammers have to use and hide.
If you start looking at the ISPs you'll find that it's not always the fault of the ISP itself (who probably has marginally capable staff) but of their clients who have unsecured boxes hosted. Client systems are rarely vetted before they're connected to the Net, and few are even contractually obliged to do the Right Thing (tm). I've been involved in cleanup operations, and it essentially involves three steps:
:-)
1) clean up the main ISP mail relays
2) force mail to travel via the cleaned up relays (router or firewall redirects - if it doesn't travel via the relay it doesn't travel, full stop). That will stop a lot of relay abuse - and gives you a log of those that originate spam email (forensics help if you want to take someone to court
3) clean up the client systems inside the mail cordon. Only those that have been cleaned up are allowed back raw on the Net.
I'd be the first to agree that it's brutal, but it can be quick if clients cooperate. Make sure your contracts state terms of use, though - you'll need them to fight the ignorant few.
BTW, blacklisting will only help if it's made very public, loss of face counts far more than anything else. If it's sufficiently embarrassing it'll work, so inform their local newspapers...
Most of the spam I receive originates from .msn.com. When are we going to ban them too ?
Here's my suggestion: Instead of sending an automated reply to the sender, put the received email that failed the whitelist tests to a special "hold" folder. Process that hold folder every three days or so, and mail a summary of the contents to yourself, such as: This way I'd reduce the amount of spam I get from about 60 per week, down to two summary emails per week. The valid emails can be then rescued from the hold folder after I've read the summary email. This way I can be sure that I don't send any automated replies to addresses where they don't belong. The golden rule of handling spammers also applies -- don't reply to spammers. Using your method would send the spammer (or rather, the person whose address was forged into the headers) an email, confirming that my email is valid but it is not currently accepting email from that address. The obvious downside is that people who aren't yet on my whitelist may experience a minor delay in email delivery, but they'll most probably understand when I explain the situation. I guess I'll try implementing this method on my own mail server some day.
Follow your Euro bills at EBT
Maybe it's me, but it seems like the time might be right for lawyers to entertain us with a class action lawsuit. If China's ISP and telecomunications companies are state owned enterprises it seems like you might be able to do something silly like sue China under one of the anti-spam laws some states have. I think the one in washington provides something like $500 per offence.
I'd love to see that full page ad, or even better commercial on late night tv. Have you recieved spam? You may have been harmed, and be owed a thousand dollars or more! We can help, but you need to help us. You can't spell sue without u!
The best would be a bulk e-mailing titled that Make Money Fast and promised thousands of dollars without ever doing anything! And best of all, nothing to pay, ever!
--Jimmy has fancy plans; and pants to match.
As to parts of the story:
That's so ironic it's funny!
Not just Duh!, but Duh! So hire some english fluent contractors to help with it. Damn. That excuse is as bad as the crematorium in Georgia, USA, where they tossed bodies in the woods, for 20 years because, and this is just fantasy to think anyone could believe this, because the cremation chamber was broken, like 20 years isn't long enough to actually fix it... So how long before these ISPs decide to stop putting it off and actually fix it? Sorry man, if you get blocked, you did everything to earn it, as inaction is action in this regard.
A feeling of having made the same mistake before: Deja Foobar
Uh huh. I'm sure the amount of spam you received would drop like a stone if you just blacklisted the .us TLD.
Personally, I receive as much spam from AOL users as I do from China. The problem, of course, is that I'm corresponding with people from AOL. I'd be seriously torqued if my ISP decided to ignore AOL.
It's not just volume that has to be taken into account; it's signal/noise ratio. The fact that most American ISPs are more helpful in stopping abuse than most Asian ISPs is also a motivating factor.
You want the truthiness? You can't handle the truthiness!
We have only our .cn spam to lose.
I personally handle spam from the .cn domain with a note to the postmaster/abuse address for the domain congratulating him on his new spiritual journey in the Falun Gong. My .cn spam has decreased markedly since I started doing that.
One CPU cycle wasted on digital restrictions management is ONE TOO MANY.
Please indulge me a bit. Why on such a connected internet are open relays used at all?
Someday, I'll have a real sig.
Shouldn't I block USA?
Sure, if you feel it will help you.
It's the same arguments, right?
No, it's not.
When you complain to an ISP in the US, you will usually get a response, and they will terminate the spammer's account.
When you complain to an ISP in Asia, you get no response, and the spammer continues on their merry way.
We've already got semi-intelligent filters that can analyse and rate e-mails on the likelihood that it's spam-content, so how about we filter suspect regions instead?
We'd also have to be careful about blocking all Asia too. I hardly get any spam from Japan, whereas China, Korea and Taiwan generate quite a lot.
Anyone ever considered that this is what the Communist Chinese Government wants?!? Having government agents producing the spam would certainly be the easiest way to make sure that the chinese population can't communicate with the outside world... Noone can hear the e-screams when they're blocked at the border router.
There was a joke, which if you look at it the right way, underscores the problem that is overlooked.
Imagine even half the people in China trying to send you an email, "Hi, How are you? I am from xyzzy and would like to tell you about ..."
A feeling of having made the same mistake before: Deja Foobar
To be paranoid: Cutting off the Asian (and esp. China) because of spam may be exactly what the Chinese government wants - cf. their national firewall. Maybe agents of their government are behind much of the spam, or are forbidding ISPs from doing anything about it.
Hail Eris, full of mischief...
E pluribus sanguinem
odd, i thought the /. reaction would be "censorship!, outrage!". Isn't it troubling that an organization would block traffic from an entire nation because of some abusers? I would find it unfortunate if a foriegn provider wouldn't let me email their nation's citizens because they were sick of American spam.
Anyway, these schemes aren't ineffectual; I'm just saying from experience that they don't work out as well as you might at first expect, and there are some unintended consequences.
"Meanwhile, Europe and the U.S. are closing the doors fast on China's IP space, and at the rate this is happening the problem is going to almost certainly go diplomatic within months." [Steve Linford, a member of the Spamhaus Project]
This sounds like the way to go. If the problem gets elevated to the political, diplomatic level, it might get some press in Asia and help educate local sysadmins. It might even generate some local government incentives for ISPs to get their act together. If nothing else, it should get good old capitalism working, as in customers walking away from ISPs that are no longer able to deliver their email to the West.
So get busy and get those blocks in place on your email servers.
And remember kids: Never trust a computer you can actually lift.
Filtering on sender address is rude too. I wouldn't want to assign unique addresses to senders. People send from too many different addresses. If I email someone's personal account and they try to use my return address to email me from their work account, I don't want to bounce their mail.
I think if I quit publishing non-munged email addresses in my news posts and junkfile the incoming mail to the addresses I post news from, that should get rid of most of my spam.
So what if you get a lot of spam from some isps -- why block mail from a an entire region. This is the manfestation of traditioanl western arroigance at its worst. If you get spammed , block the ISP instead of blocking the whole continent. Could it also be the fact the the westerners have tradionally eyed Asia with a fear and loathing ?
I'm still waiting for a law that says your ISP must give you every e-mail that's sent to you. There are too many roadblocks in the e-mail system already without blocking whole countries. We can't have a delivery system with holes and roadblocks in it.
I personally had to help a customer last week who signed up somewhere like onemail.com, apparently they're a redirection service so you can use the same e-mail address forever even if your actual e-mail address changes. Well, his ISP was blocking mail redirected to him from onemail.com, so I couldn't reply to his inquiry! After looking at the bounce headers I saw what was happening and luckily it included his real e-mail address. But why should I spend my time studying the bounce message and resending messages just because his ISP doesn't do what it's supposed to do? And if I didn't know how to reply to him, he would just think we were ignoring his e-mail, not good for PR.
And don't bother saying he doesn't have to use that ISP. Maybe it's his only choice in a rural area. But either way, I think ISPs should be like telephone companies, just patch me through and keep your hands off the information!
Well, tell us at least. Did it work?
Anonymous Coward guess why?
This is no different than what many IRC networks do. For instance, Dalnet has a policy where they will ban entire ISP's because they will not eliminate hackers.
The idea goes like this:
Why not have a sort of "Name" tag in email. This tag could be an MD5 Hash of anything you want. If the people who sent you the email knew your name, or any valid name tag that you gave them (Multiple Name tags would be simple, just sort them into folders) You could just supply the "Name" with your email address, something like "Yeah, email me at prudan@example.com, name tag (prudan)" Anything that doesn't have your name tag would be sorted into a spam / unknown folder, or you could even bounce it back saying that the name was invalid.
Some pros and cons to the idea:
Pros:
It will require more processing power for spammers to send out lots and lots of spam. Each message would need its own checksum if they are guessing at a valid name tag.
This would really make it so that you have different email addresses, without all the aliasing. You want to use a business address? Make one of your name tags "Business", and assign that nametag to a folder just for that.
Adding this to email clients would be a trivial task.
Done at the client level, so it adds no server processing overhead.
Cons:
Spammers will start trading name tags too, so changing your MAIN name tag every so often would probably be necessary.
Getting this to be accepted everywhere would be quite a chore.
Maybe this won't work. I don't know.
-- Dan
So, there's the ROKSO list of spammers, plus the usual MAPS and so on. Of course, there's also hieristic software such as Spam Assassin...
However, does anyone know of any web hosting providers that actually use these tools? I'm particularly interested in any that use SpamAssassin, as that appears to be very effective.
Alex Bischoff
HTML/CSS coder for hire
I once e-mailed a Russian ISP about a spammer. I had a sarcastic remark in there implying that probably nothing would happen because they were in Russia. They took some offense, kicked the guy, and e-mailed me back about it.
I cut them off half a year ago. Hotmail is still open, because they at least try to do something about it.
now we need to go OSS in diesel cars
Irresponsible administration doesn't only come from Asia.
Many sysadmins, like me are completely blocking France Telecom's Wanadoo.fr. Wanadoo is France's largest provider and, according to my system log, the largest home for script kiddies and crackers wannabe. Do a web search on Google and see what I mean.
High on the list are also xs4all.nl and t-dialin.de. At least the folks at t-dialin.de do try to address your complaint. Don't bother sending mail to abuse@ for the other two providers.
A (now) Chinese Hong-Kong e-mail service (www.graffiti.net) gives almost no spam (of course, they're not low latency kings).
I seldom need to contact them, but always got a fast, polite and efficient response in English (I speak Portuguese, maybe I should try Macaw, hmmm...).
They use javascript (no Links nor Dillo) and don't POP3, just IMAP.
Other than that, they are excellent.
Just for comparison:
Of three US free e-mails I got, one closed 2 years ago (almost no spam), one excellent is closing on 28th February (no spam at all) and another remains working (little spam, paid POP3, paid IMAP - yeah, lame).
-- Try to not slashdot them too much! --
Bet that'll get them to fix the problem within 24 hours
I don't read ACs: If a post isn't worth so much as a nom de plume to its author then I wont bother either.
Come on! I realize this is a problem, but is the only solution to compartmentalize the world? Some of us have legitimate email exchanges with Asia for business, and otherwise.
I think SysAdmins need to realize there is life (other than spammers) off of American soil!
I've kind of given up on educating sysadmins about their Open Relays. I never received a single response out of over 50 incidents where I tried to contact them.
In one case, 210.217.41.84 was an open relay running SCO with an old sendmail. I tried to contact them at various email addies and got no response. I even got a Korean associate to try to contact an IT type at the company that owned the server; blank stares.
I checked that IP address 6 months ago, sendmail said "out of memory." I checked it today, its gone now. All this was over a period of at least a year; I wonder who finally pulled the plug and why...
-
In reply to this move, the Chinese government said, "Thanks", and asked if we could block Chinese access to our evil, subversive websites next.
Please donate your spare CPU cycles to help fight cancer and other diseases
Just remember, they have the great firewall that sniff out words...
How to deal with Chinese spam
I take it you consider yourself part of the "civilized" bit?
I don't read ACs: If a post isn't worth so much as a nom de plume to its author then I wont bother either.
I don't know that it's 95%, but certainly a lot does. There are dregs in every population, and the USA is no exception. The problem is, because China hosts so many open relays, the USA spammers can bounce through there to evade the blacklisting that has been placed on them already. The end result is to block the USA spammers I still have to put in filters with Chinese IP addresses.
now we need to go OSS in diesel cars
I haven't implemented automated domain blocking yet, but it shouldn't be all that difficult to do.
I'm seriously considering it though. AOL, Yahoo and Hotmail will be the first up against the wall when the revolution comes.
Government of the people, by corporate executives, for corporate profits.
At least AOL will attempt to do something about spam originating there. They may not be able to prevent it the first time around, but once they cut that leecher off (using the 1000 free hours) they at least have a CC number they can store in a DB (hopefully as an MD5 checksum) to compare against to prevent another signup with the same number.
now we need to go OSS in diesel cars
IMHO, not everyone in the world speaks English! If you received an email in Mandarin Chinese, would you read it and reply?
What if you could get a pre-written spam abuse letter in Chinese, Japanese, Korean, whatever... and cut, paste, fill in the blanks. That way the ISP in China might actually read your email.
If someone posted a generic (Fill in the blank) email, I could start my translating it to Japanese.
Any takers for the other languages?
Add some spamtrap accounts to poison the mailing lists and sugar to taste.
Government of the people, by corporate executives, for corporate profits.
While I've been sorely tempted to wall off anything coming from the Pacific Rim or Latin America, it seems that there are two more constructive ways (OK, maybe only one :) to proceed:
1. Multilingual spam report generator. Seems as if there's already an autogenerator (which is probably English-centric). Why not add multilingual support to it, or build a new one? You don't have to add every language, just the major ones that affect spam traffic (Spanish, Chinese, Korean, and French and Japanese for good measure).
2. Enable open relay autoprobing for certain incoming SMTP requests. This may be slightly more problematic, but it'd be nice if I was to configure my MTA of choice to test the sender IP of an incoming messagefor an open relay hole. The check would only occur if the IP address was determined to be within the range for a certain group of countries. This might be a feasible solution for those who either can't or don't wish to subscribe to an RBL.
The problem with SPAM is partly due to the definition of "opt-in". Many spammers will claim that whatever list they bought/stole/harvested was an "opt-in" list and that you had to do something to sign up on that list. And the spammer is probably innocent until proven guilty - how can we prove that we never opted-in?
-dbc
Mod him up!
You want me to pay for a translator to contact a bunch of deadbeat sysadmins that aren't going to care if I complain or not because they leave their systems open to make money?
Umm... No. If you know anyone that will translate to Chinese for free let me know. I'd like to send some explitives.
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
...the number of wget attempts we get on our Apache web server from China Telecom is amazing. 99.9% of them are attempted proxy gets for some hits-for-money thing. Somehow we got on a list of hopeful open proxy servers (which we aren't) that 3 geniuses run through 17 - 20 times a day.
Do they really hurt us? No, not really. It simply clutters up our weblogs. Does it follow any acceptable use of the pay-per-impression system? Nope, not at all. It's annoying to pay real money for my service so some foreign kiddie can (attempt) to abuse it.
Consequently, the only domains we allow any sort of port 80 access from Asia/Pacific are the Aussies and Japan.
We got tired of all the spam, too.
TiFox
-- I'd say your post was about 3 monkeys, 18 minutes.
You scare me. More precisely, your attitude scares me.
If you really value free speech, you *must* accept restrictions based on time, manner and place. The alternative is to allow some bad players to use their speech to effectively suppress others.
In meatspace, a classic example of this is using a bullhorn to heckle a speaker using his own voice. An unaided voice gets the message across without making it impossible to hear the speaker, an aided voice makes it impossible to hear anyone else.
In cyberspace, a classic example are the 'bots that flood newsgroups with irrelevant messages so that the legitimate messages are lost in the volume.
As for spam, most of the messages are either illegal or for some highly questionable product or service, yet the sheer volume of it often causes legitimate messages to be overlooked.
You may evaluate the proper balance differently than me, but I have no more qualms suppressing a spammer than I do the guy disrupting a public meeting with a bullhorn.
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
Thanks for the idea.
Does anyone have an IP range that will block most of China?
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
As the postmaster for kitv.co.uk I've found that this problem (no, flippant, hostile responses) is also starting to become a regularly feature with ISP from the Eastern Europe and Baltic Republics.
They are able to setup linux and configure sendmail and bind to add additional relays without instructions in their native language but they can't figure out how to turn them off or install a more recent version of sendmail??
Something stinks like chinese fish!
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
Or rather than excluding huge portions of the internet and taking massive strides in a negative direction, why not re-think e-mail stanards and fix this fsking problem once and for all.
;)
Step one: Remove the Open Relay from the e-mail server software.
Step two: Consider changing the process of sending/recieving e-mail. What if rather than actually recieving an e-mail message, a link note was sent to your mail server, The user would see an e-mail address (sender), and a subject line pop-up in their mail box. If they delete the message, a reply is sent to the originating mail server, End of Story, if they open it, a request is sent to sending server to recieve the full text.
The only real gain on this is that the sender would then be forced to carry the burden of expense.
Or we can just block people from the net in large groups, which is obviously in keeping with the inclusive nature of the original architecutre, and the free information movement in general.
-GiH
Use Opera, it's better.
Unfortunately, SpamCop gave that up, as "too annoying for senders", and went to a mediocre system based on heuristics and spam reports.
Rather than blocking mail, I'd suggest automatically filtering it with something like that. Maybe based on the IP block.
To the "Axis of Evil?"
Two vital facts
- I live in Hong Kong
- I've never spamed anyone in my life
I'm from the UK hence I have family and a number of good friends in the West, both Europe and the States. I'm a good e-mail user and I've never sent spam. I read GNU mailing lists and I post toDoes the fact that I happen to live in Hong Kong for a year mean that all of this is forgotten and I can no longer talk to my friends?
Please, this is supposed to be an open forum of worldwide communication. Lets not let a few rotten apples spoil it for everyone.
I realise that since this discussion is now a little old there is little chance that this will get picked up on but I had so say it anyway. Just my 2cents if you like. (That's Hong Kong cents, of course :) )
This is my sig.
Ive had it installed on my shared hosting server, I activated it and its been great. Although I dont receive a lot of spam (thankfully) it still catches all of the odd ones that come through.
:)
Well worth using if you arent already
A solution to/from UK UCE.
Make the sending or receipt of UCE against your AUP/TOS then any repeat occurrences following notification are illegal under the Computer Misuse Act Section 1.
I usually respond with the following email which has proved to be surprisingly effective even with non-UK UCE. Perhaps because most of the developed world has similar legislation, design to make cracking illegal.
--- UCE RESPONSE ---
The attached unsolicited bulk email has been received from [or downstream from] your domain. The sending or receipt of unsolicited bulk email is a breach of our Acceptable Usage Policy and is unauthorized.
This is a breach of 'The Computer Misuse Act 1990' Section 1;
1.--(1) A person is guilty of an offence if--
(a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer;
(b) the access he intends to secure is unauthorised; and
(c) he knows at the time when he causes the computer to perform the function that that is the case.
(2) The intent a person has to have to commit an offence under this section need not be directed at--
(a) any particular program or data;
(b) a program or data of any particular kind; or
(c) a program or data held in any particular computer.
(3) A person guilty of an offence under this section shall be liable on summary conviction to imprisonment for a term not exceeding six months or to a fine not exceeding level 5 on the standard scale or to both.
http://www.hmso.gov.uk/acts/acts1990/Ukpga_1990
We expect your immediate attention to prevent a reoccurrence.
thanks
Postmaster [@kitv.co.uk]
--- END RESPONSE ---
for i in `echo
do
echo $i" REJECT" >>
done
sudo
www.dedserius.com
VB != VisualBasic
We should carefully draw a distinction between Japan and the rest of Asia. The spam problem comes mostly from non-Japanese Asia. Specifically, the spam problem comes mostly from Chinese businesses.
The Chinese really do think and act differently from Americans.
An alternative to razor is TMDA.
While razor attempts to blacklist spam, new spam will still get through. TMDA attempts to deny everything until it's confirmed. A bit inconvenient and painful? Yes, but perhaps this is the only strategy that will be effective against spam.
While looking through my Hotmail inbox a couple of weeks ago I found a message sent to me from my own Yahoo! account about enlarging my (certain male body parts). Now, I didn't send that to myself. Shouldn't that sort of thing be illegal or something? Could they send trash email to someone else using my Yahoo! account?
Netname: APNIC-CIDR-BLK
Netblock: 202.0.0.0 - 203.255.255.255
Maintainer: AP
vascogate.vasco.com[209.140.121.226]
I am PERPETUALLY (every 15 seconds!) being hit by attempts from this address to use my mail server. They are far worse than any site in Asia. and worst of all, vasco.com is a security related site
VASCO secures the enterprise from the mainframe to the Internet with infrastructure solutions that enable secure e-business and e-commerce, protect sensitive information, and safeguard the identity of users.
Am I the only one being abused by these people? My log files are almost useless because of their entries.
I have sent repeated requests to any address I could think of, and never even received the courtesy of a response.
They are blacklisted on RSS.
Have you read the Moderator Guidelines yet?
How chauvinistic is it to expect the whole world to speak your language.
Let's block the rest of the world, because they dare to bug The Brightest Beacon of Freedom and Civilization.
Hey, why does the rest of the world hate our guts...
Go ahead, mod me down, hide your head in the sand. I hope some people finally start to get that this almost unconscious racistic attitudes will bounce back and explode in your face, before Afghanistan II happens.
--
Ceterum censeo America delendum.
A cell phone I had in Tokyo was constantly flooded with spam. Most of them were match-making related. what a waste of resources.
Since we all know that most U.S.-originated SPAM comes from Florida, the next logical step seems obvious: when to we get to cut the Net pipe to Florida? Deposing JEB wouldn't hurt, either.
I use fetchmail and exim for my mail, and I set it up to reject anything coming from or through *.kr *.ru *.cn *.my and *.jp
That cut my spam down by a huge amount. This technique really works.
If tits were wings it'd be flying around.
Korea has to be the biggest offender here. I gave up on sending SPAM reports to .kr ISPs because I have never received a response back. Never! You listening Korea?!?! I understand that there may be a language barrier in some instances, but the letters S-P-A-M are well known throughout the world. Great gobs of kimchi...
Have a day.
whoops.
;)
here.
grep APNIC.
Of course, that includes AU, and NZ too. The other poster's idea is better
I have heard tell of a guy who is getting more than ten million spams a day from btamail.net.cn. Wow!
Last time I got spam that wasn't getting responded to, I wrote back to the ISP saying that I shared their customer's interest in a Free Tibet, and then
went on with my normal abuse complaint, and I think that one actually stopped.
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
But it came from South Korea and was badly formatted email, how was I supposed to know it was legit. Man that would have been cool if I would have went, I might have won too.
I wonder if putting up a headline like the one for this story to attract readers could be a form of SPAM, or even posting misleading stories so they get listed on /.?
Seriously, I seriously doubt any system admin worth his title with block an entire country from there servers. If anyone has bothered to monitor the RFC Duscuss posting boards, you will see that blocking is done on a case by case basis.
The person who wrote this article should have their email address changed to one based in China so we won't have to deal with them anymore.
Funnily enough, when I submitted a story about this, the Slashdot editors rejected it within minutes :-)
Oolite: Elite-like game. For Mac, Linux and Windows
61.128.0.0 - 61.191.255.255
63.0.0.0 - 63.63.255.255
65.128.0.0 - 65.158.159.255
66.24.0.0 - 66.27.255.255
66.81.0.0 - 66.81.127.255
128.121.122.33 - 128.121.122.43
161.207.0.0 - 161.207.255.255
167.107.0.0 - 167.107.255.255
193.227.32.0 - 193.227.63.255
200.13.160.0 - 200.13.175.255
200.28.0.0 - 200.28.255.255
200.63.0.0 - 200.63.31.255
202.90.0.0 - 202.207.255.255
208.253.172.0 - 208.253.175.255
209.196.2.0 - 209.196.43.255
209.235.3.0 - 209.235.47.255
210.25.0.0 - 210.47.255.255
210.90.0.0 - 210.127.255.255
211.32.0.0 - 211.71.255.255
211.80.0.0 - 211.119.255.255
211.152.0.0 - 211.255.255.255
216.64.152.0 - 216.64.255.255
216.143.68.0 - 216.143.76.255
216.205.5.0 - 216.205.191.255
217.8.160.0 - 217.8.191.255
oh yeah, and china.com
- Entertaining Bits from the Ancient Kernel Tree
The other reason spam is popular is because in perhaps one out of 100,000 messages a spammer might hit paydirt. Now, suppose there were a bandwidth charge each country imposed on various governments based on the percentage of spam reported. And naturally, as SPAM levels increase, the bandwidth connection costs charged will go up exponentially.
THAT will get their attention --and ours. If you don't keep your own act clean, expect the costs to go up! And by the way, this isn't really that different from snail mail. If you're in the habit of sending bulk mail from overseas, expect to pay a premium as shipping and processing costs
go up.
Blocking is overkill. Make them pay.
Nearly fifty percent of all graduates come from the bottom half of the class!
I think that the way to shut them down once for all is to educate people about what spam is and why it should be reported, and above all, not responded to. This way, the market that spammers will target will dry up and then they will stop sending their UCE out.
If a bartender can be held accountable for letting a known drunk drive home and if a gun store owner can be held accountable for selling a gun to a known felon, why shouldn't ISP's be held accountable for selling service to a known spammer?
Has recieving spam ever killed anyone?
Perhaps the chinese(insert other country) don't get the cultural refrence to Spam?
I have seen hundreds of newbie posts questioning internet lingo and definitions, Perhaps they don't get it?
How does the fish translate Spam into chinese? Can a native speaker tell us if it makes any sense?
We need to keep in mind that our grandmothers don't understand the words we use and ESOL classes don't teach much lingo.
pending committee review
I, too, was dying to block certain asian domains from our mail servers at my former company. But, as my company was an ISP with int'l offices in Beijing and Taiwan, that solution was not going to fly. As a result, we were spammed mercilessly and infected with ILOVEYOU once before management finally approved my (year-old) proposal for anti-viral protection.
The question was raised as to why nothing is done by these ISPs. In my limited correspondence with these sysAdmins, it seems to come down to the laissez-faire attitude of many asian governments regarding technology. We've all heard the stories about China wanting to block Internet access, and build their own national Intranet. But the fact of the matter is that the digitally inclined are still largely unmolested by law enforcement in matters of e-"commerce" (just look at the blatant disregard for international copyrights). Many asian sysAdmins simply don't feel that the law is on our side in this situation.
Background: I'm self-hosted (read: I run all my own servers -- mail, web, DNS, the works), so the only things I'm dependent on my ISP for are my DSL pipe, static IP's, and Usenet (the latter soon to change, once I set up NNTPCache locally). My ISP greatly appreciates this as I am pretty much zero drain on their support desk.
.cn, .kr, or .tw. Thanks to increasing spam from Mexico and Argentina, and equally clueless admins in both countries, I've also blocked the entire 200.0.0.0/8 subnet.
I used to complain to ISPs in China, Korea, Taiwan, and parts of South America (Argentina, notably) about their spammers, and their open relays. I kept giving them chance after chance to Do The Right Thing and Get A Clue.
Unfortunately, they never did. As of last October, I set up the 'Deny Access' listings on my mail servers to block traffic from any domain ending with
Did I want to do it? No! I have a regular customer in Chile (I opened a hole in the blocklist for their IP range), and I had (before I closed the metaphorical doors) gotten an occasional query from the Asian arena. Unfortunately, it was either run the risk of losing a little business or be deluged by spam. Guess what I chose?
If blocking that region is the only way to get some action, so that it'll be safe to UNblock in the future, great! So be it. I sympathize with those in the respective country who are caught in the crossfire, but I would also point out that those same folk are in an excellent position to put pressure on their local ISPs to cut the spammer's access. Permanently.
Until I see some clear evidence, preferably from indpendent sources, that the Asian arena is no longer a spam source, then it will remain blocked at my servers.
Bruce Lane, KC7GR,
Blue Feather Technologies
Don't block yahoo.com down. If it's really from yahoo.com, email abuse@yahoo.com with the full email (including headers) and the original subject. They actively shutdown spammers, including the Nigerian "419" fradulent spam.
Same here. My portsentry logs are filled with wandaoo.fr. What is up with that?
Me too!
At least 5 times a day from wandaoo.fr. I think I'll set me firewall up to just drop all attempted connections from there.
Last summer, I did something similar with CGI scripts on one of my web sites. The site has a number of scripts that convert files in a compact notation to an assortment of output formats. What the data represents isn't too important; the problem arose from the fact that a single small file could be converted to things like PS or PDF or GIF or PNG or ...
;-)
I'd been reading about research at the big search sites that was working on the problem of "hidden" web pages; i.e., pages that are generated on the fly by scripts that read from databases. The idea was to learn what was in a site's databases by calling the CGI scripts to extract it all. I found myself thinking "Uh, oh; I'd better watch for this."
One day it happened. A search site suddenly started invoking my scripts, methodically trying to extract all the data that I had in all of the output formats that I supported. And it did this in parallel from a large number of machines. This brought my server down and kept it down.
So I added a "blacklist" to my code. Any requests from any of those IP addresses got only a small page saying that they were on my blacklist. I included my email address in case anyone wanted to discuss the situation. Over a few months, my blacklist grew to include a few dozen blocks of addresses.
I've never received any email from any of the search sites. However, a few weeks back I got a message from a person in Singapore who wanted to use my site, but only got a blacklist message. I checked, and sure enough, his address was an ISP in Singapore. No way of telling him apart from the search bot at the same address (but presumably on a different machine).
The ISP didn't respond sensibly to my query, so I have no choice but to continue the blacklist. All I have for identification is the ISP's IP address, so I have to block everything behind that address.
I don't like blocking everyone behind an ISP, but I can't think of any other way to prevent this sort of attack on my server.
(Yes, I do have a robots.txt file. And I know how to use it.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
I've had the fortune (misfortune) to deal with some of this first hand.
About 1.5 years ago I was working for iPlanet as a backline support person. The summer of 2000 we had a rash of Asian telecos running our e-mail server and crashing and burning.
So I got sent to Asia to try and figure out what was going on at our three largest telcos there, Unitel and Hanaro Telecom in Korea and Jiangsu Telecom (can't find their homepage at the moment) in China.
What I found in both cases was frightening. Pro-Serv had done a good job of implementing a mail system that would handle a normal user load just fine. But, in both cases the load was 5 times what was planned for. So the servers we're dying under the load.
After very little investigation it found out that several of the subscribers were spamming via their ISP. When I first pointed this out to the powers that be there I got a blank reply along the lines fo "So?".
As management and I delved into it the opinion that the ISP was forming was that these are customers, we can't just cut them off, they will leave and we will lose money.
I tried the normal counters like, "The abusers are bringing down the service for your normal subscribers. The normal subscribers are getting mad (some even started anti Unitel sites) and they're going to leave in droves if this keeps up. And then all you're going to be left with is a few subscribers who are costing you more in the long run. Bandwidth costs associated with the spamming, hardware upkeep for a few users, etc.
The sysadmins and techs got all this but management was so scared of losing a customer and that customers money that they would not dare do a thing about it.
I ended up leaving both sites having accomplished stabilizing the systems as much as I could but not solving the actual problem, getting the ISP to come up with and enforce some terms of service.
So to me what it comes down to is capitalism run amok, espically in Korea. Management is so blinded by "making it big" they fail to see the real disaster looming on the horizon.
Don't blame uncaring techs, blame the top level for driving this thing into the ground.
At least I can say I had a great time visiting those countries and taking in the other parts of their real culture. But, July in Seoul is miserable.
-- This space intentionally left blank.
The problem is that most ISP customers do NOT view their provider as a common carrier.
;)
They expect the provider to do something about the spam, and become frustrated when things don't improve. Many problems are the direct result of ignorance on the part of 'netizens'. I'm sure plenty of people here can attest to still being hit by CodeRed probes by @Home and consumer DSL IP's. Spam, open relays, vulnerable boxen, customers that fuck-up a simple peer-based network in their home, customers that send useless BlackIce "I'm being HaX0red!" emails to support, people that respond to the wrong ISP when they get a 5.1.1 from MAILER-DAEMON....*sigh*, the people have no clue what's going on behind the scenes. This is a global information network, they want it to "just work".
I see your point about ISPs keeping a hands off approach, but then the majority of users are left to fend for themselves. If the users are frustrated by spam now, imagine their exasperation when they have to actually configure filtering rules in their mail client
You have to inform everyone that you're communicating with of your name. Just like you have to inform everyone you'd like to communicate with of your email address. In order to not stifle communication with strangers, you will always have to publically communicate your "address" whether it consists of just the email address or additional information.
What your basically saying is: "I won't accept email from anyone who doesn't know my address." Which is a system of blocking spam -btw- already works now!
Adding this to email clients would be a trivial task. Adding this to all the worlds email clients is far from trivial.
Done at the client level, so it adds no server processing overhead It also doesn't serve to reduce bandwidth consumption.
Then you sure as heck need to take some lessons in hyping from the good folks here at Slashdot. Banning one domain in China just isn't a story. All kinds of big ISPs have gone through phases of being home to spammers. To really drive up the crowd (and hits) you need to get everyone on a crusade.
:)
See what it's done here? People complain when posters don't read articles and such. But it's really quite clear the "editors" don't do it either.
I was subscribed to a Korean shop network mail list accidentally. Someone did it I assume. One who did it knew I wouldn't get rid of it simply and subscribed me to it.
Now I get legal (non spam) mails to my Yahoo mailbox everyday. As I check, I figure its simply Korean mail advertising some t-shirts etc. Mail sent to MY e-mail, the one listed on Yahoo... I block it. Than next day I get mail from same company groups another company, of course, with another mail adress...
Guys aren't spamming me. Just they stupidly made a system easy to abuse. Like no verification like "Click YES or reply to this message" verification included.
I contacted them via Spamcop, they said they now figured I don't want those mails and they are investigating who subscribed me to that. The problem is, I believe those systems as Yahoo etc. has a system that after certain people click on "block e-mail adress" while reading mail, they a) automatically add them/their IP block to spammers list b) they investigate.
I don't think in such a closed country as China there aren'T people to abuse SMTP servers as they are owned by the goverment or companies really near goverment already.
In my experience, AOL is actually very responsive to spam compliants, and will actually tell you when they've 'nuked' someone for spamming. (for mail that actually originated from AOL, of course.) That's more than can be said for most large ISPs.
wanadoo.fr, chello.nl, all of .tw, all of .cn, all of .th are blocked from my servers, and good riddance. We catch several megabytes per week from those places, and it's nothing we want... massive unreadable binaries, old e-mail viruses... and no way to stop it.
I'm not an anonymous coward, I'm just io...
English people store a cake during monthes before eating it.
Chinese burn dog's hair while they are alive because for asian the more the meat suffer the better it tastes.
American only eat industrial food then no need to ask ourself why they are so fat.
I don't like snails and frogs' legs even if we cook it... I don't like horse anymore... But I think what we eat here is much better than US Pizza Hut, MacDo and co !!! Here when we cook some meat, it is not alive !!! Here we don't eat rotten cake !!!
You have your bad sides and we have ours...
To finish my ACL logs are full of IP from Asia, US, Germany... French scan outside France... Yes, it's surely true but some non-french people scan in France and not in their country. What's the problem ???
"Script kiddies" are not french words... May be it's because "script kiddies" appeared in YOUR country.
Is there any way of stopping them? The only thing I can thing of is a direct attack on some of their systems, but that probably just reduces me to their level.
Fish fileted alive is one of the best tasting sushi you'll ever have.
I've had raw horsemeat before, I thought it was tough, though it had a good flavor.
True: in the waning months of WWII, when the city of Strasbourg was threatened by a German counter-offensive, DeGaulle insisted on a militarily unwise defense. Eisenhower then insisted on an offensive to clear the Germans west of the Rhine to end the threat. French troops made no progress. American reinforcements were necessary. DeGaulle angrily asked if Ike "questioned the valor of French troops." I think the question was settled in 1870, again in 1917, and for all time in 1940. 3 French divisions were then withdrawn without permission for "rest and refitting" (with American supplies) in spite of the fact that American divisions had just beaten back the Germans in the Battle of the Bulge and probably needed the rest more than the French. And then the Frogs ^H^H^H^H French disobeyed orders and attempted to seize additional occupation territory in Germany at the expense of the US/British plan. For some reason, Ike didn't simply cut off the supplies. It was American gasoline, food, and ammunition the French forces were using.
In addition, DeGaulle snubbed Roosevelt on FDR's return from Yalta. Staggering ingratitude, considering the American death toll for the Normandy campaign was 29,000, another 106,000 wounded/missing.
In Ike's place, I would have liberated Holland and Belgium, and invited the Germans back into France.
pff, what has spam to do with privacy... they enoy me, but they do ot invade my privacy, i just use my mutt keysequence and bye bye spam for a long time.
and blocking out country's??? desentecing their isp.. you must be an american to use such words... maybe i should start blocking all american tld's because yoou all seem to be people who want war... hell, there are mor asian people who are able to use a computer, so there will be more spam from that way. an even then, most of them have an asian charset so how the hell can they insult me if i can't read it anyway...
English is not widely used or known in Asia. And engineers are notorious for bad language skills.
Try Korean next time.
Marko
I keep getting about 3 to 5 pieces of spam email from korea per day! My attempts to get off of the mailing list that I am on have been fruitless. I'm all for blocking it.
Would the spams be from 'Universal Advertising Systems' or Internet Information Services' by any chance?
They've hit summerisle.demon.co.uk the same way too, but at the rate of about 1000 a day for a couple of weeks. (see http://slashdot.org/comments.pl?sid=28202&cid=3030 850)
ISPs in the Phillippines I've tried to contact about this are:
N.B. Cureinc at least appears to have no abuse and postmaster accounts (!?) I think they should read RFC 822 and RFC 2142
Not a response from any of them and it's still pouring in.
Troll????
This is pretty insightful actually, because it's the friggin' truth.
So... What was it?
-- It only takes 20 minutes for a liberal to become a conservative thanks to our new outpatient surgical procedure!
It's just a joke. I love France, but people make fun of it because it's an easy target.
We make fun of people who are different. It's human nature.
What a new low. First it was spam we didn't want to read, now it's spam we can't read. And the worst part of it? I don't event know how to unsubscribe (or let them know they have a 'live one'..) So I just delete it.
I get about 50 spams a day (in addition to the 300 or so messages I get from various lists that just get filled away in folders). Some day soon, I'll get tired of it all and get a new email address. Until then, it's not worth the trouble to try to get off the lists.
Two years ago my email address appeared on a list of email address that was freely distributed in China as a list of
people who wanted email about new web sites. Once that started my mailbox was filled with over 40 messages a day in
Chinese extolling the virtues of some idiots Chinese web site or product. My only choice was to block the entire IP space
of China from my mail servers for both my users and myself.
I provide email services for 22 users. Today my email server rejects over 600 emails per day from China, and the
number only seems to increase with time. Neither I or any of my users have any reason to get email from China, thus all
of these rejected messages must be spam.
The damn spam is IN the native language of the sender.
Which is compleatly stupid.
Why the HELL are they sending me spam in another language?
The Russians do this too.
Do they think that I am going to go through babelfish JUST to read THEIR spam?
Honestly, how stupid are these spammers? Why not just send out compleatly random junk characters on a massive scale, the profits would be the same.
Need help treating your acne? Come here!
First off, I would like to say that I despise spam. I hate it in the worst way. But, to do something like "ban Asia" is a bit of an overkill. Part of what makes the internet great is the ability to ignore what you don't like. Is it really such a big deal to simply hit the delete button? The people who say they don't want any gov. interference with the internet are the same ones that want spam laws made. Is it just me or is that a bit of an oxymoron? Of course that is just my opinion, I could be wrong.
The flying hamster of DOOM rains coconuts on your pitiful city.
So, it is ok and even mandatory that an ISP monitor spmamers using its service but totally un-OK that the same ISP drop your web page if someone claims (not proves) copyright enfringement or hands over your records to government officials who claim it is the responsible thing to do? Methinks we are a bit two-headed about our support of freedom and privacy. Also, any reasonably competent spammer (oxymoron I know) would relay through some other smtp equipped but inadequately guarded machine.
A people that insist that the Prime Meridian runs through Paris, 100+ years after everyone ELSE agreed on it running through Greenwich, is insane.
Holding a parade to celebrate this fantasy is f**king nuts.
You think the rest of the world is trying to take your culture away? Honestly we could care less - you are destroying your culture better than we ever could (if we wanted to, and we don't, we really don't) every time you insist on such insane fantasies.
Hell, I'd like it if the Prime Meridian just followed me around wherever I went - the rest of the world can just live with computing their time relative to me. Maybe I'll hold a parade during lunch to celebrate.
After all, when was the last time You, as a sysadmin, responded to an informative message to postmaster@your.org that was written in an Asian language??
Wow, it's so rare that slashdot speaks to me this personally, since I'm the owner of your.org. (Really! Go do a whois on it).
I have to say I'd probably throw away any e-mail in an Asian language, since up to this point, every Asian language e-mail I've received appears to be spam.
There, wasn't that esay! That's what I'd do, case closed, problem solved.
P.S. When you guys fill out forms asking for an e-mail address, PLEASE PLEASE PLEASE do not use domains like that. Someone owns them. Use "domain.com" or "example.com" instead, which will never resolve to anything. "your.org" gets more spam than you could possibly imagine.
No, that's the access of evil.
The axis of evil started out as the States of Iraq, Iran, and North Korea.
Last week, after meeting with the Canadian Prime Minister, Bush added French Skating Judges to the list.
Meanwhile, there's a figure skater from North Korea who threatens to win Gold Thursday night, because she's the only one who can perform the dreaded Quadruple Axel of Evil.
Practice random senselessness and act kind of beautiful.
Spammers have for a long time made money off of all of us by using up bandwidth that we end up paying for. I say we turn the tables. Here's how:
We make a new unreality TV show called Slam A Spammer. We dump 20 or so spammers dressed up in Porky the Pig costumes onto a deserted island. We give them and hour or so head start.
After that 100 or so victims come on shore wearing Elmer Fud costumes.... You get the idea...
The race isn't always to the swift... but that's the way to bet!
huge_penis_now@yahoo.com
-
Inventor of the term 'pardon my French'.
Anyone try to use a client side spam scanner? Are these too hard to use?
...blocking based on geographic location is borderline political statement. My company has lost customers over this. We eventually relaxed our policies and the spam flows freely.
:)
One thing I noticed is that alot of these asian spammers use IP numbers without reverse DNS. This is a no-no, and any competent sysadmin will have reverse DNS for all hosts (especially important ones like mail exchangers). We implemented that yesterday and have seen a dramatic reduction. Most of the denies are from the 210 and 211 prefixes, which are delegated by APNIC. Gofigure
Abstainer: a weak person who yields to the temptation of denying himself a pleasure.
--Ambrose Bierce
What's perplexing is that some of the folks posting here seem to think that blocking beyond individual addresses is somehow morally reprehensible. How they come to this conclusion is beyond rational analysis, for one very simple reason:
My machines are *my* machines. They aren't *your* machines. Once you've grasped the basic idea behind 'property', followed by the qualifier that 'my property' *is not* 'your property', then perhaps the naysayers will begin to clue in on the fact that whatever rules I set up for the use of my machines are perfectly acceptable no matter how different they are from the rules these folks have set up on their machines. There's no moral argument to be had here, and no high ground to take.
I've blocked aol.com for years, and over time have added hotmail.com and other repositories of clueless idiots and spammers. Soon I'll be moving from a 'blacklist' approach to a 'whitelist' approach, based on the idea that if I don't know you I really don't want to hear from you. There's absolutely nothing wrong with this. If larger companies wish to ban entire blocks then that's their business; if their customers don't like it then those customers can either try to get the company to change their minds or use some other mail account. There are so many different free webmail services out there that there's no reason that someone who objects to an ISP mail policy can't use webmail instead. Hell, get a hotmail account and you're assured that *nothing* will be blocked, ever.
Sometimes it seems that some of the people here can't get a solid grasp on the idea of 'property'. Just a couple of days ago it was the concept of 'wasted cpu cycles', now it's 'shame on you for banning Asian email'. Communists.
Max
My god carries a hammer. Your god died nailed to a tree. Any questions?
I've been operating my own domain 94 or so. Since I've kept the same addresses and aliases for this long as well, I receive more spam than any Hormel-loving person can stand.
.com. At least then I could read the porn spams.
My most recent hosting moves have been spam related. The primary problem, though, has been a lack of worthwhile response from _MY_ hoster, not the spammer's ISP. Decent email blocking is almost non-existent. Well, perhaps only in the cookie-cutter dominated hosting market. You know the ones I mean. The "5OO MB and 20GB for $19.95" "control panel administration" kind of marketing identifies them fairly well.
I have changed to a dedicated host simply to be able to use sendmail's spam-blocking capability. Sure, it's about three times as expensive, and some (hell, a lot) of the 300 GB of bandwidth will go to waste, but it sure won't be wasted with spam.
The Asian spam would not be so bad if most of them would at least have the sense not to send BIG-5 encoded email to my
I now block China, Korea, Taiwan (damned seed.net.tw). This is in addition to blocking open relays and a few countries in Europe.
I'm egotistical enough to think that everyone should speak English. But now, if I get spam from a country whose language I can't read, I'm going to block mail from the entire country. It isn't hurting me to refuse foreign language email. It's meaningless, anyway.
The frequency of spam from that domain increased exponentially.
NR
How will I get mail from my friend in Korea if some ISP sysadmin decides that Korea is no good. One thing is for sure, I pay for my mail and I want it.
All your database are belong to U.S.
Americans are not renowned for knowing anything about other cultures. Guess whether cutting off all email communication with the continent where over half the world's people live, is going to improve that.
Personally, if my ISP blocked mail from Asia I'd have to change ISP immediately, because I have a friend in Beijing, a friend in Tokyo, and a friend in Kuala Lumpur. Email is by far the most practical way of communicating with them regularly.
You can reduce spam by (1) getting a Yahoo (or similar) email address - they have a pretty good bulk-mail filter - and (2) changing your email address every couple of years.
"Has anyone ever had any kind of constructive conversation with one of these ISPs to see why they are unable or unwilling to do anything?"
All I ever got was, basically, "bite me, round-eye!" Not helpful...
Yep. If you were China and you wanted to prevent data flow with the west you would want to cause a waste of money for those enabling the data flow... say ISPs. This was a cheap tactic by China to make a different internet. By playing both sides (ie paying some US corps some money to help with some part of their problem) they draw your attention elsewhere.
/. kneejerk is off target
once again the
@rsa
BTW best wishes with the gal Taco boy!!
The proverbial "voting with your dollars": If the ISP can't connect because its spam policies suck, then it's customers "vote" them off by changing ISP's.
More power to them!
Tequila: It's not just for breakfast anymore!
One place I worked had to block credit cards that were issued by the bank of Taiwan after a bunch of bad transactions were traced back to them. The bank never answered any querries or ever flagged the CC numbers as bad.
The article may think it's hype, but about three days ago I turned on all of Spamcop's blacklist options, including one that read "Korea (the country)".
When you receive an e-mail from China, entirely in Chinese, do you find someone to translate it for you, or just delete it assuming it's spam? After all, all your customers are in the US, and even if some of them are Chinese, certainly none of them would expect *you* to speak Chinese. The only Chinese e-mail you've ever received is (by all accounts, though you can't be sure) spam, and it's well known that lots of spam comes from China.
When an admin at a Chinese ISP receives an e-mail entirely in English, does he find someone to translate it for him, or just delete it assuming it's spam? After all, all his customers are in China, and even if some of them are American or British, certainly none of them would expect *him* to speak English. The only English e-mail he's ever received is (by all accounts, though he can't be sure) spam, and it's well known that lots of spam comes from the US...
Or maybe not.
I think we're well past the point where arguing with spam hosts makes any sense. We would do better spending our time developing a replacement for RFC822. When people started sniffing Telnet sessions we created SSH. When people started attacking FTP we gave HTTP the ability to do uploads. Now that spammers are killing the internet we simply have to abandon SMTP/POP and move to a more intelligent delivery system. For example, perhaps all email should be left on the originating server for pickup (with only the headers sent to the recipient) rather than filling mailboxes at the receiving end. If you're writing a completely new email protocol you can do whatever it takes. Of course, the hard part would be to introduce a new protocol without giving Microsoft the ability to embrace and extend it into a proprietary produce. I'd be surprised if MS and/or AOL aren't already working on it...
Forwarding a mail to abuse@blah or postmaster@blah
with the single word "spam" and full headers should be all the info you need.
AFAIK, a sysadmin or postmaster should already understand the headers. So the only thing left which might confuse a non english speaking (yet otherwise competent) admin is the obscure single word "spam".
When in doubt, have a man come through a door with a gun in his hand.
What about those places where the local telco has a monopoly on isp services? It might not care about user pressure.
The obvious thing to do with open relays is to use them yourself. If top party leaders/businessmen in China suddenly found pro Taiwanese rants in their inbox, or penile enlargement ads, then I think the Chinese Telco would become very responsive to closing the relays.
It's a no brainer. If you have 0 abuse staff and 1,000,000 censors -- change the definition of debate.
When in doubt, have a man come through a door with a gun in his hand.
I find it really funny to see people replying that they get their logs filled with "wandaoo.fr". Well for your information the correct spelling is wanadoo.fr, so please check your spelling if you want to be taken seriously.
"Naughty, naughty, naughty, you filthy old soomka !"
Lessee.... I don't really want my people to see outside the box I have built for them. How can I annoy the world so that my people cannot see outside the box?
Oh my God, oh my God! My twin brother's been spammed! I think it was some Asian spam or something... there was this spam; it looked Asian! It was written in another language, I'm pretty sure it was... Asian!
God bless Ben Affleck.
I don't know how many of the "letter from high-placed officers" I've gotten from Nigerians.
You name it, they have it.
High places from the "daughter" of the Nigerian president, to the "son-in-law" of the Nigerian Agriculture Minister, to the "right-hand-man" to one of the "Top General Of Nigeria", all saying, one way or another, "We need your bank account number so we can transfer some dirty money and you help us clean up the money and you get a portion of it".
It's a scam of course. Even if it's NOT a scam, I won't participating in money laudrying operation.
But these scam emails come from Nigeria - or people claiming to be Nigeria - all the time.
I get these emails in my mailboxes located in Asia, Europe, Americas (North and Souths). Seems like they spam the entire globe, looking for "bank accounts".
If there is a _real_ need to ban anything, why don't we start by banning Nigeria ?
Muchas Gracias, Señor Edward Snowden !
While I would like to block cn, hk, kr, nz, sg
and tw, and some of the begies providers in oz, I
haven't yet received enough spam from in or jp to
want to block them.
Try www.mailexpire.com. It's a very simple but very effective solution to your problem. You create a temporary address with a 'note' so you can remember what/who it was for and set a timeout, after which the addr is simply invalid. Works a treat.
Post with an email address using a subdomain under your aegis. After a couple of days change the MX record of that subdomain to localhost.
People wanting to contact you about old posts won't be able to of course, they'd have to find a recent post of yours.
But spam would never hit your network and with any luck it'd make a right dogs breakfast out of theirs.
Richard Sexton
No, the other one
Need Mercedes parts ?
We had some problems with an open relay once, but just one notice from an outside ISP and we fixed it good, we were a small operation and we really could not afford to give free rides on spammers on our BW.
Why other prefer to just wait bandwidth and earn the ire of BOFHs everywhere i do not know, it aint THAT hard to fix your sendmail.cf or main.cf or whatever.cf to prevent spamming.
I love the part of the article where it basically says that the Asians don't understand why spam is such a problem, and that receiving an electronic business card or communique from someone should be an honor...
NOT! Here's a tip to the Chinese and any other "culture" out there - THIS IS THE INTERNET! We have OUR culture. Respect it or get out.
You've been told, and you choose to ignore us. Now we choose to prevent you from entering until you RESPECT US.
assholes...
..watch out for e-mails with messages such as:
"ALL YOUR BASE ARE BELONG TO US!!"
or
"YOU ARE ON THE WAY TO DESTRUCTION!"
These are obviously terrorists and should be reported to the feds. (-;
While you're at it, don't forget to block yahoo, aol and hotmail. Pretty much anyone on uunet too.
Mike
Hello Fellow Slashdotters and ISP Admins,
I have the perfect solution (well almost perfect). We have started to filter out unverified mail servers (if you check the received: header tag) and it has been great. Within 10 days, we have caught over 100,000 SPAM messages and about 0.5-1% were actual e-mails. Currently we have our mail server filtering system to send an Auto-reply to the remote ends to fix their mail servers. This is for the legitimate mail that is going to be blocked when we go full blocking in about a month's time.
Works great, had a few complaints but atleast once it is turned on, we will be cleaning up about 80-90% of spam off our network. The rest will be handled by mail-abuse.org and other Anti-Spam blacklists.
But is 95% of all mails coming from USA SPAM?
RealMail/SPAM ratio is rather poor from China.
its only forms man. It would probably take me about 10 minutes to sign up a hotmail account and write a basic perl script to submit mails through it. From here its a simple step to send those 100,000 emails. Blocking them is not pointless, its a damn good idea.
As an aside have you seen how much spam you get on hotmail? sign up for an account and don't use it...don't sign up for any information or free services, just maybe mail yourself to check the account works...i guarentee within one month you will have at least 20 spams.
Rec.Humour.Funny recently posted an elegant
answer to Asian spam, at least when it originates from China...
I don't want to give it away, read the link, but I promise any Chinese spammer getting this email in reply won't be sending spam for long...
Made the mistake of saying Godzilla had been spotted, and was heading their way. There was a lot of screaming and they dropped the phone and ran. My ANI has been blocked from calling any phone number in Japan ever since.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
we can all fight spammers use spamcop.net
http://Lenny.com
4 great justice!
SMTP AUTH will do fine.
:)
And simply disallow plaintext auth methods, and no SSL and that kicks Outlook Express and Outlook off the net too. Major riddance for spam
I can throw myself at the ground, and miss.
There is a good article about dealing with China's Beijing Capitalnet ISP and SPEWS that came out yesterday at http://www.chinainternetupdate.com/index.htm#5 called Mr. Bush don't block the Chinese INternet because I guess dubya is in PRC now.
That's The Way They Do It.
MX resolving to 127.0.0.1: Bright idea !
Doing so massively would cause great trouble to owners of open relays.
BTW look at my address: it is replyable if you _do_not_ remove "nospam".
Based on some discussions with actual Nigerians, I think it's likely that they are. A few years ago, the "60 Minutes" TV crew even met with some of these bank scammers in Nigeria.
"Those who have never entered upon scientific pursuits know not a tithe of the poetry by which they are surrounded."
As a legal resident of both the Singapore and the US who has spent a lot of time working in Taiwan, I'm afraid you're the one who's dead wrong. Any given restaurant can blow it, but the consistency is remarkable, though there are local menu additions and deletions, of course.
"Those who have never entered upon scientific pursuits know not a tithe of the poetry by which they are surrounded."
TMDA removed my spam problem. It blocked more than 100 spam mails in the last 14 days. Enuff said.
This happened to my wife. The person used her hotmail address as the From. They included a link to a webpage where you could buy stun guns etc. I contacted the abuse people there and they removed the website.