|
|
Up |
|
|
  |
Author: Shmuel (Seymour J.) MetzShmuel (Seymour J.) Metz
Date: Mar 31, 2007 20:48
In reader2.panix.com>, on 03/31/2007
at 12:14 AM, nospam4me@mytrashmail.com (Herb Oxley) said:
>It would be nice if APEWS "showed their work" the way SPEWS did. For
>instance 50 UCEPROTECT listings is hard to square with "thousands of
>spambots".
Can they, without compromising spam traps? Mind you, I'd like to see
lots more detail in APEWS records, but I wouldn't want that if they
turned out to be more useful to the spammers than to us (TINU).
>Given the past history of Primus,( at best "empty hat") soothing
>words from one of their managers are not likely to convince hard
>core spammer-fighters such as the keepers of APEWS.
Or soft core admins who are still getting crap in their spam traps.
One log entry is worth more than a thousand "bedbug" letters.
--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
< http://patriot.net/~shmuel>
I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to spamtrap@ library.lspace.org
|
| Show full article (1.31Kb) |
|
| |
no comments
|
|
  |
Author: Shmuel (Seymour J.) MetzShmuel (Seymour J.) Metz
Date: Mar 31, 2007 20:47
In <130t0fibg0klf50@ news.supernews.com>, on 03/31/2007
at 02:47 PM, Stephen Satchell satchell.net> said:
>If you are really, really concerned about the over-wide escalation
>size, consider contacting IANA and the various IP number registries
>about making a suitable facility available for determining
>allocation that *can* be access by automated means, in addition to
>the human-only WHOIS system.
Not every RIR has even that :-(
--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
< http://patriot.net/~shmuel>
I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to spamtrap@ library.lspace.org
|
| |
|
| |
no comments
|
|
  |
Author: Hal MurrayHal Murray
Date: Mar 31, 2007 20:46
>I already refuse email from any host without a valid rDNS. When I find
>a network I want to block in whole, what I do is replace their rDNS by
>overriding the NS records for their in-addr.arpa delegation in my DNS
>cache server. It breaks their rDNS and all email from that whole network
>is no longer accepted.
Do you do something to generate a sensible error message? Or do you
return a typical error message that will confuse things if the sender
really does have DNS setup correctly?
--
These are my opinions, not necessarily my employer's. I hate spam.
|
| |
|
no comments
|
|
  |
Author: Stephen SatchellStephen Satchell
Date: Mar 31, 2007 20:21
> But do they also bloat the rDNS delegation space with distinct authoritative
> servers for different /24's? That's what I use these days to finds the
> boundaries of address allocation, and "identify" who owns what space in a
> canonical way (approximately so, based on the name server delegated to).
Do you mean, do they use separate DNS servers? Perhaps they do, perhaps
they don't. In my case, I have a pair of authoritative servers handle
all rDNS requests. I don't have to...but do I really want to run an
instance of BIND for each /24? I choose not to.
> If mail servers get rDNS delegation blocking implemented, either in the
> mail server if it does the recursion itself, or in DNS, then a blacklist
> could be published with a list of rDNS delegation servers to block. It
> would certainly be a very aggressive method since it blocks whole ISPs
> all at once, or at least major chunks of it if they use more than one set
> of rDNS name servers.
Once that technique became known, there is a possibility that ISPs could
counter, so that you end up only blocking a part of their space at any
given time. I'll need to investigate that. ("How to burn up even more
IPv4 space", perhaps.)
|
| Show full article (1.72Kb) |
|
no comments
|
|
  |
Author: phil-news-nospamphil-news-nospam
Date: Mar 31, 2007 17:56
On Sat, 31 Mar 2007 14:47:55 GMT Stephen Satchell satchell.net> wrote:
| Because all of the WHOIS server owners make a big noise about *not*
| allowing automated processes to use their service. Add to that there is
| no automated way to determine routing without access to a BGP table.
| (And *that* is questionable because of all the networks -- including
| AT&T -- who bloat the table because they announce non-aggregated /24
| routes!)
But do they also bloat the rDNS delegation space with distinct authoritative
servers for different /24's? That's what I use these days to finds the
boundaries of address allocation, and "identify" who owns what space in a
canonical way (approximately so, based on the name server delegated to).
I already refuse email from any host without a valid rDNS. When I find
a network I want to block in whole, what I do is replace their rDNS by
overriding the NS records for their in-addr.arpa delegation in my DNS
cache server. It breaks their rDNS and all email from that whole network
is no longer accepted.
|
| Show full article (3.46Kb) |
|
no comments
|
|
  |
Author: Stephen SatchellStephen Satchell
Date: Mar 31, 2007 07:47
Andrew Hood wrote:
> On Fri, 30 Mar 2007 20:35:35 +0000, Herb Oxley wrote:
>
>> iPrimus Network Abuse iprimus.com.au> wrote:
>>> Dear Apews,
>>> I'm writing in regards to your blacklisting of one of our /16's namely
>>> 203.134.0.0/16 (E-57606)
>> You might want to review the UCEPROTECT listings for that /16; currently
>> there are 50 IPAs listed because they've sent spam to UCEPROTECT spamtraps
>> within the past 7 days.
>>
>> For your convenience I've pasted them to the end of this post. Please do
>> note I have no official connection to UCEPROTECT or "Admins.ws".
>>
>> Be aware not that many people send spam complaints these days; most have
>> found the time involved to be a pure waste.
>>
>> And do keep in mind, whilst you profess to be Doing All The Right Things
>> to control the amount of spam emitted from iPrimus net space, there are
>> those in the community with long memories - back when people did send ...
|
| Show full article (4.34Kb) |
|
no comments
|
|
  |
Author: John DoeJohn Doe
Date: Mar 31, 2007 07:39
Andrew Hood grunted:
> Why can no-one distinguish between these APNIC assignments?
Could it be because it's got to the point that nobody cares who they
belong to and that APNIC space has become "block on sight"?
--
The e-mail address in the From: header of this post is valid.
Add [NANAE] to the Subject: of any correspondence or said
correspondence will be deleted unread.
|
| |
|
no comments
|
|
  |
Author: Andrew HoodAndrew Hood
Date: Mar 31, 2007 05:52
On Fri, 30 Mar 2007 20:35:35 +0000, Herb Oxley wrote:
> iPrimus Network Abuse iprimus.com.au> wrote:
>> Dear Apews,
>
>> I'm writing in regards to your blacklisting of one of our /16's namely
>> 203.134.0.0/16 (E-57606)
>
> You might want to review...
|
| Show full article (2.77Kb) |
|
no comments
|
|
  |
Author: Seth BreidbartSeth Breidbart
Date: Mar 31, 2007 04:36
>It would make me very happy if you could use your spamtrapping system
>to send automated emails telling me when any IP's in my network are
>Spamming your traps.
Many large networks are set up to do essentially that (they use "This
is spam" buttons that their users press to send the reports). You
should sign up with as many as you can find. I'd start with AOL,
Outblaze, and hotmail (assuming they all have them available; I know
AOL does).
Seth
|
| |
|
no comments
|
|
  |
|
|
  |
Author: Matthew SullivanMatthew Sullivan
Date: Mar 31, 2007 04:35
Chris Lewis wrote:
> According to Matthew Sullivan sorbs.net>:
>
>> For those looking for a DUL you are performing a disservice pointing
>> them at the PBL. You should be pointing them at the SORBS DUHL or the
>> NJABL DUL.
>
> You are aware that the NJABL DUL isn't a DUL (by your definition of
> DUL) anymore, aren't you?
>
> It's a mirror of the PBL now.
No I wasn't - I was under the impression the NJABL DUL had been rolled
into with the Statics in the PBL, and that t was soon to be closed.
I was not aware that the PBL was being mirrored out as the NJABL DUL.
Regards,
Mat
|
| Show full article (0.86Kb) |
|
no comments
|
|
|
|
|
|
|