Slashdot Mirror
Ask Slashdot: Should I Publish My Collection of Email Spamming IP Addresses?
An anonymous reader writes: I have, for a while now, been collecting IP addresses from which email spam has been sent to, or attempted to be relayed through, my email server. I was wondering if I should publish them, so that others can adopt whatever steps are necessary to protect their email servers from that vermin. However, I am facing ethical issues here. What if the addresses are simply spoofed, and therefore branding them as spamming addresses might cause harm to innocent parties? What if, after having been co-opted by spammers, they are now used legitimately?
I wonder if there's a market for all the thousands of webmail addresses that send Slashdot nothing but spam.
I think you answered your own question. The only situation might be to share it privately with others, but publicly, no!
As is, nobody cares about your list. Use an adaptive blacklist and join Project Honey Pot.
You can't shut us down! The Internet is about the free exchange and sale of other people's ideas!
There are hundreds of blacklists out there: https://mxtoolbox.com/problem/blacklist/
No, really, go talk to them... they've been doing just that as a community for a lot longer, and probably have nearly all the stuff on your list and then some.
Quo usque tandem abutere, Nimbus, patientia nostra?
If there's a yes/no in the headline, the answer is invariably "NO".
Apart from that, considering how easy it is to spoof an IP, then you might actually be breaking the Law by enabling targetted attacks on private computer systems which is covered under the Computer Misude Act (in England) and on public systems, potentially you could be engaging the Official Secrets Act and the Terrorism Act.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
There are plenty of RBL's out there already. I would suggest talking to one of them and contributing your list.
.
Many, many spamming IP addresses are hijacked hosts that are cleaned up eventually. Are you planning to ban those IP addresses permanently?
So I ask the question, how frequently do you plan top re-validate the addresses that are on your list as still spamming?
http://www.projecthoneypot.org...
A better way would be to collect the ip's over time, those ip's that keep reoccurring over a period of say a few months are most likely dedicated spamming addresses. Although most large spammers probably keep shifting address and spoofing as you said since it would be to easy to stop them if they always used the same address. Unfortunately, a simple list of ip address won't really do much as they are not likely used more than a couple times each.
Sig?
Well don't... cause there are already lots out there. These lists keep track of spamming ips and it is usually pretty annoying to get off the lists if you do spam. This means that if a server was compromised and used for spamming the innocent person can usually have the server up and sending legitimate email within a week or so after blacklists accepted that they fixed their issue. MXToolbox has a nice tool to see if a domain or ip is already blacklisted https://mxtoolbox.com/blacklists.aspx
There are professionals who do this for a living. Keep your day job.
It little behooves the best of us to comment on the rest of us.
Yes. Publish them through a DNS Blacklist similar to others or add them to an existing one. Establish rules and guidelines for removal procedures.
-- Stu
/. ID under 2,000. I feel old now.
What about the spam sent by the big email providers? It's a really interesting question what to do when you get -recurring- spam from these. (I get an offer for "Sun Microsystems User Lists" once a month from a chronic spammer sent either through Gmail or now Outlook. I report them to the abuse@xxx, but they keep on coming.) Do you blacklist a chronic spam source, that also has legitimate users? Do you quarantine everything from them, placing the burden on users/administrators to inspect and release legitimate mail from quarantine?
There are certainly lots of IP addresses that can be 'safely' rejected. Unfortunately, the growth of outsourced email makes it increasingly hard to depend on DNS information for sanity checks (e.g. there's an MX or SPF record that associates the "From" domain with the domain actually establishing the SMTP connection.)
There are plenty of such blacklists already published.
https://en.wikipedia.org/wiki/...
You can compare your list to others to see if you have anything unique, and if you do I guess your options are either publishing your list on your own, or seeing if any of the other list would like to merge in your list. Some of the lists allow sites to remove themselves. Some of the lists appear to only have "recently" spamming addresses. Some lists specifically exclude residential ISP connections. There are probably other methods of addressing your ethical issue too.
As I type there are twelve, TWELVE!, comments on this thread. Comments should have been closed after 3 comments.
Q: Should I Publish My Collection of Email Spamming IP Addresses?
Comment 1: Yes.
Comment 2: No.
Comment 3: Maybe.
No other comments are necessary. Close the comments for this thread!
I also have my own blacklist. I thought about publishing them however, I expect If you publish them you may be subject to some kind of retaliation.
This is more of an individual asking a yes/no question than a publication asking an inflammatory question just to get clicks.
Also, Yes, you can spoof an IP, which means that you can make packets that you send look like they came from another IP address than they actually did. This may be fine for the one-off UDP packet or such, but email is sent using SMTP, which requires a TCP connection. If your return IP address is spoofed, the 3-way handshake cannot be completed, and therefore, the TCP connection will never be made. If the TCP connection is never completed, then certainly the SMTP email will never be sent.
While the poster's list may contain IPs that were spoofed, none of the spoofed IPs actually SENT any email.
A 1 person maintained blacklist!! Sign me up!
Exactly, if the submitter is talking the IPs of machines that connected to their mail server, that can't be spoofed. The "received from" headers for servers on previous hops CAN be spoofed, and often are.
As you said, while a _single_ packet can be spoofed, that wouldn't allow an SMTP connection to be established, so the IP which connected to their machine is reliably known. Their mail server adds a "received from" header with that known IP.
Whatever. Unless you are high up in management, you do not know everything that is going on at your company.
Anyway, I think you are full of shit.
There are no innocent companies that are accused of spamming - they are either doing it themselves or allowing.
Verdict : guilty.
Don't like it? Fix your problems and stop bitching because your stupidity.
If you think you can spoof a TCP connection you have no business running a RBL.
No sir I dont like it.
There isn't much of a point to doing it. Most of this stuff is sent via botnets now so most of those IPs are probably DHCP addresses from ISP pools for home users. Maybe if there are addresses that constantly keep popping up, that might be somewhat useful, but those are probably on the existing blacklists already.
I browse on +1 so AC's need not respond, I won't see it.
And getting your new VPS servers IP out of the god damn IP blacklists is a shit job. Took 6 months to clear them out for my servers.... except from microsoft blacklists, which still put anything sent from my servers to trash.
Spammers mint, use, and then abandon email addresses so quickly that a list of (outdated) addresses wouldn't be of much use to most people.
Just cruising through this digital world at 33 1/3 rpm...
This has already been done by numerous places. One that I've found especially good for stopping bots from using signup forms is http://botscout.com./ The free daily limits are a little low but for us they're very, very effective. Using them dropped our bogus signups from 200/day to about 1 or 2 per day, sometimes zero.
Just cruising through this digital world at 33 1/3 rpm...
If you aren't willing to make maintenance of the blacklist your full time job, don't bother. You will cause more problems in the world than you solve. I speak from 20 years of experience as a sys admin dealing with mail systems. The last thing the world needs is a poorly-maintained blacklist.
Everyone here seems to be looking for "the other guy" to fix the SPAM(tm) problem.
The SPAMmers know all the tricks, they were trained the same as the rest of us.
The big question is, What can be done, now or in the future.
My virtual server apparently used to be owned by spammers before I rented it. Several web sites ban its IPv4 due to alleged proxies and/or spam.
Thinking it might be a one-off false positive, I cancelled the server and got a new one within the same network, to no avail.
So I contacted the admin of one of the websites that banned it. Turns out they blacklisted the whole network of cheap virtual servers years ago.
IP blacklists should have expiration dates. Apparently most don't.
1) You don't want the legal ramifications of publishing this, especially if you live in the USA. I am American, so I know what I warn of.
2) Black lists are so old as an anti-spam approach I don't know that anybody takes them seriously any more.
3) Related to #1, do you really want the responsibility for situations where someone on your list was there due to ignorance and they fixed the open relay problem that led to the spam, they are no longer spamming at all, and yet there they are on your list? I thought about going into details, but on my previous job I know of cases where this actually happened and it's one of the reasons that many of us stopped taking Spamhaus and similar services seriously. It was almost impossible to get off the black list, even if you fixed the problem that got you there or were put there by mistake.
Definitely publish Timothy's email address. He has been a source of spam on the front page of Slashdot for a long time now.
Dsheild.org
Look at it use it and have fun.. /.??
Why is this posted on
What could possibly go wrong?
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
Why should anyone trust YOUR list?
I have many times tries to report spam and website breakins to the abuse address of the IP address owner. A great percent of the abuse email addresses are fakes. The reporting effort just causes the email to get stuck in my server's mailq. Then I have to go back in and delete that.