Slashdot Mirror


AOL Placed on Spam Blacklist

Hacker-X writes "According to this item over at Spam Kings, AOL has had a large swath of its IP addresses added to the Mail Abuse Prevention Systems (MAPS) Real-time Blackhole List (RBL). The RBL is used by many corporations and large ISPs to filter spam. MAPS evidently started blocking the AOL mail servers less than 24 hours after filing a complaint with AOL's abuse desk. The block was initiated in response to spam emanating from AOL mail servers."

27 of 364 comments (clear)

  1. Overzealous by Oculus+Habent · · Score: 5, Insightful

    Overzealous RBL admins screw everyone. If they think everyone is going to sit back and not mind that major ISPs like AOL have been blacklisted, they are (hopefully) if for a rude awakening.

    How does someone seriously justify this? Isn't this like cutting off one's nose to spite one's face?

    Maybe it's time to come up with a hybrid system? How about a combinations of black and "gray" lists, where the gray lists are subjected to greater scrutiny or harsher limits by spam filtering software?

    --
    That what was all this school was for... to teach us how to solve our own problems. -- janeowit
    1. Re:Overzealous by Dionysus · · Score: 5, Insightful

      How about people stop using RBLs if it bothers them that certain ISPs get blocked?

      --
      Je ne parle pas francais.
    2. Re:Overzealous by PDXNerd · · Score: 5, Insightful

      So it's OK to blacklist a little guy that has a misconfigured/hacked email server that is spitting out spam, but if a big fish does this, we should justify and make excuses for them??

      This should be the rude awakening to AOL - clean up your act. Stop allowing spam to be sent, or your users might start getting peeved that their emails aren't getting through. Most rookies have been through this - how embarrassing for AOL to have to go through it to! ;-)

    3. Re:Overzealous by FortKnox · · Score: 5, Insightful

      Being in a blacklisted IP-Range before, I can share your frustration. But I do believe the motives behind this isn't to keep AOL blacklisted, but to motivate AOL to fix their outgoing spam problems. Nothing says "Fix people spamming from your service" like thousands of angry customers...

      --
      Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
    4. Re:Overzealous by jsight · · Score: 4, Interesting

      Isn't that what everyone does with the black lists anyway? I think most of the smarter software packages just use the information as part of their normal weighting systems for determining whether or not to reject a message as spam. Ie, if the message looks spammy, and it is from a site on an RBL, then it probably is spam. If it's just from an RBL, then pass it on as normal.

    5. Re:Overzealous by ShaniaTwain · · Score: 5, Funny

      How about a combinations of black and "gray" lists, where the gray lists are subjected to greater scrutiny or harsher limits by spam filtering software?

      What about silver lists that block AOL cd's?

    6. Re:Overzealous by Saxton · · Score: 5, Informative

      Well, it looks like things got turned around anyway:

      [UPDATE: Looks like MAPS changed its mind. As of Tuesday afternoon ET (GMT -4:00), AOL's listing at the MAPS site is gone, and a lookup shows AOL's mail servers no longer seem to be on the MAPS RBL list. No word yet on whether AOL resolved the spam problems, or if MAPS just decided to give AOL more time.]

      --
      My name is Aaron Landry, and I approve this message.
    7. Re:Overzealous by Oculus+Habent · · Score: 5, Interesting

      AOL is not "special" in that circumstance. The short response timeframe is a little harsh, but I don't keep up on my blacklist policies, so I can't compare it to others.

      I don't disagree with you. AOL shouldn't get preferential treatment because they are big, but blacklisting major ISPs comes with the very real possibility of hurting many other businesses by association. Yes, the same is true of the little guys, but the potential loss rate is likely much lower.

      That's why I suggest the gray/black list combo. If you could graylist someone immediately, and use that as a means for stricter spam control - combine it with Known Good Senders, whitelists, better heuristics or tougher Bayesian filtering - while mitigating the potential for lost business by not outright blocking all messages, I think that is an amicable solution. Blacklisting then becomes the consequence for not resolving your spam problem, not for simply having one.

      --
      That what was all this school was for... to teach us how to solve our own problems. -- janeowit
    8. Re:Overzealous by __aainau5532 · · Score: 4, Interesting

      Who said it bothers some people? They most likely don't get the traffic bill every month. And also since some providers think they can block everyone and whitelist only the one that have signed there agreement I don't really care any more about mailserver who are listed. I only care about national mailserver and the rest is allowed to unlist themselfs. I even think there comes a moment this year or next year that some RFC-issues are being required to mail my mailservers.

    9. Re:Overzealous by Matts · · Score: 5, Informative

      You need to look at the facts a bit closer. AOL *has* cleaned up its act, more than anyone else on the entire internet. It's stunningly clean for an ISP of its size.

      This was caused by one spam. Let me just repeat that: out of 60 million users MAPS saw one spam coming from AOL's outbound mail servers.

      Now AOL does have a set of IPs out of which some spam does emanate - the rlyIPXX block (64.12.138.(7-9)). This is the IPs that they redirect direct-to-port25 mail through, and they actively encourage people to block this range. It's been publicly stated that they intend to shut this activity down real soon now, but in the meantime most people just block that range and don't see a problem.

      Check the anti-spam newsgroups and mailing lists some time. AOL is hugely respected in anti-spam terms these days. And deservedly so.

      --

      Matt. Want XML + Apache + Stylesheets? Get AxKit.
    10. Re:Overzealous by jenkin+sear · · Score: 5, Informative

      I have to agree. We run some very large (1MM subscribers) mailing lists for our customers - not spam, just company announcements and such. AOL had a great process for getting whitelisted with them- they checked that you were legit, that your mail servers handled bounces correctly, and that your systems were rfc whatever compliant.

      Compared to Yahoo and MSN/Hotmail, AOL is completely buttoned down and has their act together.

      --
      What a strange bird is the pelican, his beak can hold more than his belly can.
    11. Re:Overzealous by berzerke · · Score: 5, Insightful

      AOL is not "special" in that circumstance. The short response timeframe is a little harsh...

      Well, if you've had your entire domain blocked by AOL without warning, you might disagree. You might disagree strongly if after contacting AOL, they admitted you were wrongly blocked but they were having trouble figuring out how to unblock you (took a week).

      How many double opt-in e-mail lists have been blocked simply because some AOL luser couldn't figure out how to unsubscribe (or didn't even try to) and just hit the report as spam button? (Hint: I know of 3 just off the top of my head.) AOL blocking is automatic. Guilty until proven innocent. Is 24 hours really that harsh given what AOL does to others?

      Of course, if we could all convince the idiots that buy from spam to stop buying, this whole problem would disappear on it's own.

    12. Re:Overzealous by gregmac · · Score: 4, Interesting

      So it's OK to blacklist a little guy that has a misconfigured/hacked email server that is spitting out spam, but if a big fish does this, we should justify and make excuses for them??

      NO -- it's not ok to blacklist the little guy either.

      If they're misconfigured/hacked, and spitting out spam, sure .. blacklist them (whether they're AOL or a little isp). Of course, you should probably send a message to abuse@ their domain trying to inform them..

      Too many lists don't check though. They get a complaint, and bam, blacklist. I run a small web/mail server (300 domains, 16 IPs), and this is highly annoying. We've been blacklisted before because someone complained about a legitimate mailing list they were on. No double-checking, no investigation into the complain, we just got blacklisted immediately.

      Most recently, we were blacklisted by SORBS because another system that shares colocation with our server was hacked. Immediately, they blacklisted the entire subnet. This affected us, and numerous other customers that have no affiliation other than sharing colocation space.

      I noticed we were on the list when someone in the office complained about not being able to send mail to an address she could send to a couple hours earlier. Upon looking into it, we eventually found out that teh entire subnet was blocked (and we couldn't even request to remove the block), so we contacted our ISP. They told us they had just discovered that hacked system and disconnected it, and tried to get the block removed from SORBS.

      In all, our ISP had found and disconnected the system within 3 hours of it being hacked, yet we were on the list at least 24 hours. During this time, none of our customers can send mail to anyone with a provider using SORBS. Our server was fine, their servers are fine, but because of a completely unrelated incident with unrelated people, it affects hundreds more.

      The big problem is, it's basically impossible to run a mail server without using RBL's (we tried).. you just get hammered. RBLs are definately useful, but there are too many run by over-zealous admins with basically an itchy trigger finger. Hopefully stunts like this will make people realize the problems with RBLs and maybe we can drop the ones that are run this way.

      --
      Speak before you think
    13. Re:Overzealous by finkployd · · Score: 4, Informative

      The big problem is, it's basically impossible to run a mail server without using RBL's (we tried)

      Try harder, PSU provides email for 130,000+ users (generally around 6 million emails a day) without a RBL. RBLs are a bad solution looking for a problem, there are much better ways to deal with spam that are not run by clueless zealots.

      Finkployd

  2. Won't miss them by Danimoth · · Score: 4, Funny

    I don't want to hear from anyone who uses AOL anyways.

    --
    No smoking sigs indoors.
    1. Re:Won't miss them by ScentCone · · Score: 4, Interesting

      I don't want to hear from anyone who uses AOL anyways.

      Yeah, who wants to do business, say, with tens of millions of people.

      I've got e-commerce clients that, unable to communicate gracefully with AOL users, would run into trouble with a third or more of their customers. This is not trivial, it's blacklist BS, and a sign of how that solution to the problem is part of the problem.

      --
      Don't disappoint your bird dog. Go to the range.
  3. Accountability by winkydink · · Score: 5, Interesting

    I'm a big fan of MAPS, but one would think that over the years they've developed some very high-level contacts over at AOL and that they would call these guys up and talk it out before undertaking a major blacklisting.

    Some BL lists have no published way to get off once on. There should be some consistency to at least getting removed. I speak from experience of having "inherited" an IP addr from my hosting provider that was formerly an open-relay. It took a lot of effort over 2 weeks to clean that mess up.

    --

    "I'd rather be a lightning rod than a seismometer." -Ken Kesey

    1. Re:Accountability by fm6 · · Score: 4, Insightful
      Get real. MAPS is a holy crusade, and all ISPs are presumed guilty until proven innocent. And proof ain't easy to come by.

      The assumption of anti-spam activists seems to be that spam wouldn't be possible without the knowing collusion of evil ISPs. Obviously, evil, greedy people will only respond to threats to their income. So never mind negotiations -- blacklist 'em until they repent.

      Which ignores the difficultly of enforcing a spam policy. You can't just terminate somebody's account the first time somebody accuses them of spamming -- it's not fair, and will probably get you sued. Having worked at an ISP, I can tell you they get lot of bogus spam complaints, mostly from people who don't know how to figure out who owns an IP block, or who misread mail logs. And in some cases, the owner of the IP block just rents rack space to the SMTP provider. Which may well do a poor job of policing spammers -- but you have to make some attempt to get them to improve before you ditch a customer who's paying you tens of thousands of dollars a month.

      MAPS and their ilk also seem totally ignorant of Hanlon's Razor. Very often ISPs assign their abuse issues to unsocial geeks whose communication skills and capacity for objective thought is quite limited. So of course they return MAPS's arrogant ignorant anger with more of the same. The resulting interaction is not conducive to solving the problem.

      So yeah, ISPs are not blameless. But they're not the greedy bastards the stupid bastards at MAPS like to get mad at.

  4. this is out of hand by nganju · · Score: 5, Interesting


    FTA:
    "the RBL blacklist is used by some of the biggest ISPs in the world, including RoadRunner, USA.net, BT, Telstra -- and AOL itself"

    I could send an email from my own account, to my own account, and it would be deleted as spam.

    --
    There are 2 kinds of people in this world. Those that can keep their train of thought,
  5. why is anyone still using MAPS? by frankie · · Score: 5, Interesting

    MAPS stopped being a reputable service ever since they joined MFN/Abovenet. I say this as someone who previously supported MAPS and even donated to their legal defense fund.

    It was quite sad to see them fall to the dark side. It's even sadder to see that MAPS is still in active use by anyone outside of MFN.

  6. Back-port by Kimos · · Score: 4, Funny

    Now we need to find a way to black-hole all of the AOL CDs being spamed to my snail mail address!

  7. Who still uses the MAPS RBL? by stilwebm · · Score: 4, Interesting

    I quit using MAPS years ago because it was no longer effective, especially for business use. Their solution to one spam from a customer of a large ISP is to block the whole ISP or, if you were lucky, just the whole contiguous IP space that one spam came from. Still, this meant something like a quarter of the Fourtune 500 had mail servers being blocked, which is unacceptable for a business-to-business email server. Worse, it rarely blocked much spam.

    In fact, I just searched the MAPS RBL for the last ten spams rejected by my mail server and only two of the hosts were listed in the MAPS RBL.

  8. On SpamCop too by goDzi7la · · Score: 4, Informative
  9. Re:AOhell by snorklewacker · · Score: 4, Insightful

    AOL profits from these spammers and they know it.

    Bullshit. MCI profits from spammers. You're talking out of your ass. You think they care about the monthly dialup access fees from spammers? AOL until recently had Carl Hutzler, one of the most respected names in anti-spam, who has turned AOL around and made them one of the leaders in anti-spam, from outbound port 25 blocking to SPF. Ask anyone on NANAE .. hell, ask the kooks, they'll tell you AOL has a fraction of the spam problem anyone else does, and their main complaint is only bounce spam, which they've nearly eliminated this year. Carl has since moved on (got promoted I think) and left two more in his stead who hopefully will continue to be as effective as him.

    MAPS is run by some righteous little twits driving their fiefdom of an RBL into irrelevance at flank speed. Most responsible admins have moved on to some subset of SORBS, Blitzed OPM, and the Spamhaus XBL, with perhaps SPEWS turned on for advisory data only.

    You on the other hand just think you're hot shit because you don't like AOL.

    --
    I am no longer wasting my time with slashdot
  10. Re:A.O. What? by TFGeditor · · Score: 5, Insightful

    Actually, this surprises me as an exception rather than the rule as far as AOL is concerned.

    (I posted the following in an earlier discussion on a different topic, but it is 100 percent applicable here.)

    I am not an AOL customer, have never been, never will be (at least, not by choice), but I am glad AOL is there to serve the unwashed masses. Because a huge portion of their customer base is, shall we say, "uninformed," AOL has taken a number of measures to protect them (and their network) from malicious traffic. Based on anecdotal observation, it seems to be working.

    Because hundreds of people have my "public" email address in their address books, I recive dozens (sometimes hundreds) of virues per week whenever there is an outbreak. However, I cannot recall the last time I received one from an AOL user.

    I receive hundreds of (filtered) spam messages daily, but again, cannot recall receiving any from an AOL machine. (This based on source IP address, not the forged FROM line.)

    On the flip side, 30-40 percent of spam comes from zombied Comcast and RoadRunner accounts (most from Comcast). The rest come from non-North American IP addresses.

    Like I said, limited anecdotal observation, but it appears to me AOL is doing something right, and is the perfect ISP for the "uninformed" user.

    Considering the size of their customer base, imagine how much more junk/malicious 'net traffic there would be without AOL.

    --
    Ignorance is curable, stupid is forever.
  11. Re:Receivers *choose* to use RBLs by zakezuke · · Score: 5, Insightful

    Is MAPS forcing you to use their lists? No. So what's your problem?

    So in the end no one is accountable. The ISP doesn't make the list MAPS does, so it's not their fault. MAPS says no one has to use their lists so it's not their fault they just make the list. Any collateral damage is just a figment of your imagination. Nobody's fault, nobody's problem.

    This is the major issue I have with many spam lists. You are fed this circular logic and the only way to break the circle is to change ISPs and hope you don't have a problem again.

    --
    There is no sanctuary. There is no sanctuary. SHUT UP! There is no shut up. There is no shut up.
  12. I am. by khasim · · Score: 4, Insightful
    Who is an RBL's "user?"
    I am. And I am also the email administrator for the company I work for.
    Most of the senders whose legitimate mail gets blocked are in no way connected to the RBL.
    The RBL's don't block anyone's email.

    It is people like me who use the RBL's and have my email server setup to reject (with proper attribution) email from sites on the RBL's.
    On the receiving side, how are you to know you should complain to your ISP about their crappy RBL (assuming you somehow know what they are) when the problem is you didn't get the message in the first place?
    The person sending you the message will get their message kicked back to them with a very clear "We rejected your message because your domain/IP address is on a blacklist at www.xxx.xxx".

    How much easier does it get then that?
    Even if you're an ISP mail administrator, who do you know the RBL did something stupid like this until the angry phone calls start coming in?
    Simple. I read the logs and the discussions. I've only had one problem since I put in the blacklists. And that was from a company with BellSouth who had had other problems with blacklists because BellSouth didn't handle the IP addresses correctly.

    Now, balance that against the thousands of rejected spams EVERY SINGLE DAY and the course is clear.

    With less than .000001% problems, I'm sticking with the blacklists. People who get on those blacklists do have other communication channels open to them and they can easily contact me if there is ever a problem.