Reputation Lookup for IPs

xzap writes "ZDNet is running an article about TrustedSource.org which is a new portal that provides reputation information for IP addresses. It can be used to configure your spam filters or when deciding whether to add an unknown host to your blacklist. Dmitri Alperovitch, a research engineer at CipherTrust said "Often companies don't realize that they have zombie machines on their network that have been sending e-mail. It may be more helpful for organizations to identify which systems on their networks are sending e-mail." Users can drill down to find more information on each domain. The portal is an initiative of CipherTrust who have previously been covered on Slashdot."

Comments

Yeah, but do they have...

[FooAtWFU]

a reputation system for sites who don't try to slam you with a ginormous Flash advertisement the minute you load their site? Good Lord, and thank goodness for FlashBlock...

Not that impressed

[timbrown]

It showed my IP blocks as having raised concern, despite the fact that they're not on any black lists and I can't why it has drawn that conclusion. Also, using the domain checker, it has no knowledge of non-TLDs meaning it will treat xxx.org.uk and yyy.org.uk as the same domain - org.uk.

Re:Not that impressed

[Zocalo]

It seems that the system needs some data to establish a baseline and before that happens the default rating is "raised concern". My personal mailserver is in this category, while my work server which has been seen is "Inoffensive" and a healthy shade of green. There are a few other glitches to be ironed out, but all in all this looks like it will be very useful anti-spam resource once a decent amount of data has been collated.

Nice idea

[FirienFirien]

You can bet that the spammers will look for ways to improve their standing. Being able to use a compromised computer to rank a page with positive points/karma/rating etc seems like a significant problem. If it's a negative-only system then those same compromised computers can blacklist IPs that aren't compromised, effectively reducing the 'average' past their own, leading to their own standing out as relatively whiter.

Hopefully CipherTrust will have a look at (for example) things Google has done with pagerank, and be able to address a problem that is significantly tied in with the problem it is trying to help with.

Re:Great Idea

[Mattygfunk1]

of course this page would be more useful especially for everybody else... but at first glance at the summary I started to scratch my head and wonder why exactly somebody would make this.

Add to that admins who lease IP addresses for servers. You really don't need the IP address on your new dedicated server to have been recently held by a spam group.

__
Funny video clips for adults

Please, no outgoing SMTP server!

[RAMMS EIN]

``Why on earth should lots of machines be able to send email from inside a corporation? Surely some smarthosts and block port 25 at the border routers is the way to go.''

Hmm, I don't like that idea. It basically forces you to send your mail through an SMTP server on the same network. Most machines I use use the sendmail command, which, AFAIK, connects directly to the MX for the receiving domains. I like this behavior, because (1) it doesn't put unnecessary load on any outgoing SMTP server, (2) doesn't have a single point of failure, and (3) doesn't allow the administrator of the outgoing server to inspect/filter/modify/reject the mail I send.

How do other people feel about this?

BTW: I am aware that using an outgoing SMTP server is standard practice on Windows, that traffic that leaves the network can still be inspected/filtered/modified/rejected at the gateway, and that a gateway is also a single point of failure. The point is that having an outgoing SMTP server _adds_ a piece of infrastructure where these problems occur. Also, it's usually easier to do any kind of content processing on an SMTP server than on a router. So, considering all this, how do people feel about having or not having to use an outgoing SMTP server?

Re:Please, no outgoing SMTP server!

[abulafia]

Most machines I use use the sendmail command, which, AFAIK, connects directly to the MX for the receiving domains. I like this behavior, because (1) it doesn't put unnecessary load on any outgoing SMTP server, (2) doesn't have a single point of failure, and (3) doesn't allow the administrator of the outgoing server to inspect/filter/modify/reject the mail I send.

(0) Depends on how your boxes are configured. Once you have a smarthost, configing sendmail/postfix/whatever to use it is trivial.

(1) The incremental load of an email message is trivial. If you're smarhost is overloaded... beef it up - this is like any other capacity issue.

(2) Mail is robust. (spam is causing people to break some of the things that make is robust, but it is still pretty good.) Having a failover/backup MX host/backup smarthost is easy enough that organizations who do enough volume for it to matter should have a plan for that. Hell, my company does less than 1000 outgoing messages a day, and we do.

(3) Possibly legitimate, probably futile. If someone wants to read your mail and you're on their network, use PGP, or you're doomed. Transparent proxies are only the easiest way to grab it. Personally, I'm a big fan of companies/orgs running their own SMTP servers, and using them. Every-box-sends, especially today, is a real issue, and the win of not configuring sendmail to use a smarthost is balanced by the fact that if you want to get through spam filters, you need to configure DNS for every machine, and monitor them to make sure they're not doing something bad. Choose your poison.

I don't like taking this to the extreme that some seem to favor, requiring everyone to use the ISP's smarthost. That does become a real chokepoint where potential monitoring takes on a different tone, where I can't control the TLS, incoming authentication or spam filtering, and where someone else's actions can stop my mail delivery. But for companies, one (or sometimes more) outbound SMTP server(s) per site makes a lot of sense.

Again, a personal anecdote - If we didn't do it this way, it probably would have taken me much longer to realize the Windows installation I built under VMware a while back had been zombified before I could patch it. As it happened, while it was patching, I checked my mail and my firewall was screaming about it trying to send mail (and connect to IRC, but that's not the question at hand.)

I realize not everyone has the skill or takes the time to run a tight network, but mail isn't hard for the vast majority of sites to get right - there's almost nothing to it these days.

Fun facts

[miffo.swe]

China has surpassed the US in the zombie race. According to this page: http://www.trustedsource.org/zombiemeter.php China has taken the lead. Still the US zombies are more effective since almost all spam originates from the US. You just wait until the Chineese gets the Dragon CPU up and running.

Some of their data is bogus

[dskoll]

For example, on the "IP" page, it said that 255.255.255.255 is sending spam, and that 224.1.2.3 "raised concern".

Of course, those are not valid unicast IP addresses.

On the other hand, 192.168.10.12 is "inoffensive". Phew! :-)