tag:blogger.com,1999:blog-338496082009-06-22T09:44:57.857-05:00Information and commentary about spam blacklists.Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comBlogger56125tag:blogger.com,1999:blog-33849608.post-48186514468017332632009-06-22T09:38:00.003-05:002009-06-22T09:44:57.867-05:00

As reported on Spamtacular and on SORBS' website:"ANNOUNCEMENT: Possible SORBS Closure... It comes with great sadness that I have to announce the imminent closure of SORBS. The University of Queensland have decided not to honor their agreement with myself and SORBS and

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-92129004806099335052009-04-29T11:17:00.002-05:002009-04-29T11:20:59.635-05:00

The blacklist at dnsbl.net.au has announced it is winding down. As noted in a February 25, 2009 posting on its website, "Please note that as of Wednesday, April 1, 2009 the DNSBL.NET.AU blacklist will cease to exist."As of this writing on April 29th, 2009, I do still see active entries when querying via DNS, but I assume that these are likely to go away soon. If you utilize this blacklist, I'd

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-54022584869625160122009-03-31T10:54:00.005-05:002009-03-31T11:03:58.350-05:00

The DNSBL called "DSBL" is no more. As of March 11, 209, their website reports: "DSBL is GONE and highly unlikely to return. Please remove it from your mail server configuration."DSBL was an open relay/open proxy DNSBL. From the website: "DSBL relied on volunteers who, upon receiving spam, would test the IP addresses that sent them spam for open relay and open proxy vulnerabilities. "The tests

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-90462862838493867412008-10-06T10:26:00.006-05:002008-10-07T14:03:11.397-05:00

As I often do, today I'm receiving reports about a DNSBL (which I've previously warned was dead) is returning false positive entries for those still using it today.What does this mean?IF YOU ARE AN EMAIL ADMINISTRATOR WHO USES BLACKLISTS, you need to start paying attention. Blacklists are not "set it and forget it." Instead, you should periodically check the blacklists you're using. Ensure they

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-46772135005766893972008-08-17T16:07:00.002-05:002008-08-17T16:10:01.668-05:00

I haven't posted DNSBL stats for a while now; the server it was on crashed. Thankfully, all the data was recovered, and I have it right here with me. I just haven't had the time to get everything up and alive again on my new server quite yet. The good thing is, I do have a new server, and plenty of bandwidth to deal with the rigmarole of parsing many tens of thousands of spams a day (which is

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-81384833928115863692008-07-23T13:28:00.001-05:002008-07-23T13:29:12.294-05:00

Just wanted to let everybody know that I'm aware that the DNSBL stats are not currently updating. The server this process runs on has crashed. I'll be restoring the data to a new server sometime in the near future.

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-68316304817426624842008-05-26T13:19:00.001-05:002008-05-26T13:20:42.488-05:00

It seems today as though the Security Sage domains have expired and/or replaced by "placeholder" pages by their registrar. Net result: Bad things. If you were still using their BL, you're probably having problems receiving inbound mail right about now.

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-48032190294063104562008-05-20T10:06:00.004-05:002008-05-20T11:08:26.568-05:00

DSBL, the Distributed Sender Blackhole List, seems to have gone missing. The list appears to have been in operation since at least May, 2002.The website at www.dsbl.org is not currently responding. Their mail server specified in their MX record is non-responsive, and any DNS mirrors still responding seem to be hosting an out-of-date copy of the blacklist's zone data.I've talked to the maintainer.

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-86711110721271258552008-03-26T10:51:00.003-05:002008-03-26T10:56:31.352-05:00

I've received multiple queries about this today, so I figured it would be wise to put up a quick message about this.ORDB is a long dead blacklist, gone for more than a year.Recently, they started "listing the world" -- meaning everybody using ORDB is now blocking 100% of inbound mail. Blacklists do this to shed themselves of any excess DNS query traffic from sites who haven't yet ceased querying

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-62077596797160618422007-11-19T17:03:00.000-06:002007-11-19T17:05:22.734-06:00

One of the things I measure over at the Blacklist Statistics Center is false positives. What are false positives? How do I use the term, exactly? Ultimately, there are three different ways to define false positives, depending on whom you ask and who they are. Allow me to explain.Here's what I think of as a false positive(1) in the context of DNSBLs: You did not receive a mail message you signed

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-24903038483960652442007-11-10T17:53:00.000-06:002007-11-10T17:54:00.780-06:00

The folks behind UCEPROTECT asked me what it would look like if I were using all three UCEPROTECT backlist zones together. I thought it was a neat idea and decided to share the results publicly. Click here to take a look.

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-7515118831508782242007-11-10T17:27:00.000-06:002007-11-10T17:43:48.606-06:00

A lot of people have asked how the spam and ham (non-spam) data is compiled for the Blacklist Statistics Center here at DNSBL Resource. Where does it come from? What senders does it represent? Here's an updated overview of what goes in to the spam and ham (non-spam) feeds here at DNSBL Resource.On the spam side of things, the input comes from a series of spamtrap domains and email addresses.

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-51813429479954955292007-11-03T10:35:00.000-05:002007-11-03T16:21:18.645-05:00

McFadden Associates has been publishing two different, spamtrap-driven DNSBL zones since October 2003.A primary zone, bl.csma.biz, containing only aggressive hosts that have spammed repeatedly during a short (recent) timeframe.An additional zone, sbl.csma.biz, with more aggressive listing criteria. It lists hosts that have generated spam within a 45-day period. They recommend that this one not be

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-63191530267795068232007-11-03T10:16:00.000-05:002007-11-03T10:35:12.316-05:00

My friend Mickey Chandler pointed out recently that he's been seeing some unusual bounces that look like this:Host blacklisted - Found on Realtime Black List server blocklist.address.is.wrong.spamhaus.orgIt turns out that you block all of your inbound mail with an error like this if you configure "rbl.spamhaus.org" in your mail server as a DNSBL zone for blocking purposes.Why? Because there is

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-7125025153838215582007-10-26T15:30:00.002-05:002008-05-26T13:19:31.247-05:00

The RHSBL (right hand side blacklist) blackhole.securitysage.com appears to have been created by Jeffrey Posluns and appears to have been around since at least August, 2004.I received a report today indicating that a mail administrator has been unable to reliably query the blackhole.securitysage.com blacklist zone. With the help of my friends, I was able to confirm this issue.It looks to be a DNS

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-34417337662248530682007-10-18T16:19:00.000-05:002007-10-18T16:20:59.040-05:00

As always, I'm looking to maintain and improve the accuracy of the data behind the reports over at the Blacklist Statistics Center here at DNSBL Resource. Here's a quick overview of a couple of recent improvements I've made. Just this week, I've turned up an additional spamtrap feed. This data is based on a set of domains that were no longer routed, but are found on many spammer lists. Not sure

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-14344062940566565162007-10-14T16:56:00.000-05:002007-10-14T17:09:01.322-05:00

The Passive Spam Block List, or PSBL (psbl.surriel.com) is a spamtrap-driven anti-spam blacklist that has been around since at least June, 2003. Created by Rik van Riel, who explains on the PSBL website that “the idea is that 99% of the hosts that send me spam never send me legitimate email, but that people whose mail server was used by spammers should still be able to send me email."The passive

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-87652143754568413922007-10-13T13:53:00.000-05:002007-10-13T14:37:04.600-05:00

“Fiveten” (blackholes.five-ten-sg.com) is a combination anti-spam blacklist run by Carl Byington, publishing under the name of “510 Software Group.” This blacklist has been available since at least February, 2001. It has a multitude of criteria for listings. As of this writing, the website lists the following current criteria:Individual spam sources: “These are generally taken from spam samples

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-65544213376825811482007-10-12T12:35:00.000-05:002007-10-14T17:40:04.866-05:00

Spamhaus ZEN is a composite blacklist run by the Spamhaus Project. This UK-based organization was created in 1998 by Steve Linford, and is maintained by a group of employees spread across the globe.Spamhaus runs a number of different spam-blocking lists. These include: SBL (Spamhaus Block List), which aims to block verified spam sources, spam gangs, and supporters of spam. This list is manually

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-60434109635960004912007-09-29T22:44:00.000-05:002007-09-30T14:04:44.702-05:00

Please take a moment to check out the new DNSBL Resource Blacklist Statistics Center. Replacing the old DNSBL stats page, this new section of DNSBL Resource provides week-by-week graphs for twenty different blacklists. At a glance, one can easily see the accuracy rates and false positive rates for the past thirteen weeks for any blacklist in the system. This data will be refreshed weekly,

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-74008485721970917062007-09-24T10:50:00.000-05:002007-09-30T14:31:37.175-05:00

Update 9/30/2007: The website www.completewhois.com is operational again, but some links appear to be broken. My attempts to query their DNSBLs have all timed out. While CompleteWhois may be on the mend, it seems that it may be too soon to give the all clear.Previous updates below:This post in the newsgroup news.admin.net-abuse.email, and my own testing both confirm that any DNSBLs running under

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-10316098051699749802007-09-03T23:09:00.001-05:002007-09-03T23:32:23.040-05:00

I'm guilty. I admit it. I've called APEWS listings "random," which isn't quite right. Arbitrary would be a better word for it. Not to mention broad, and questionable.APEWS, the "anonymous" blacklist meant to be an early warning system for spam, generates a lot of worry from administrators and end users who find themselves listed by way of plugging their IP address into an online lookup tools like

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-20246205798305064332007-08-13T18:52:00.000-05:002007-08-13T18:54:12.444-05:00

If you are listed on the APEWS blacklist, as confirmed by checking their website, here's how I would recommend that you handle the situation. (Who the heck am I?) Note: This isn’t guidance on how to avoid a blacklisting or sidestep anti-spam groups. If you have a spam issue, fix it. Don't spam, ever, for any reason. This is information is regarding how to address an issue with a blacklist that

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-92138479072534654032007-08-11T12:38:00.001-05:002007-09-03T23:34:08.974-05:00

APEWS, the Anonymous Postmasters Early Warning System, is an “anonymous” blacklist that claims to run in the style of SPEWS. That is to say, its goal is to be an “early warning system,” catching and stopping spam before other blacklists or filters have the opportunity to do so. The APEWS blacklist was first announced by way of an anonymous posting to the newsgroup

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.comtag:blogger.com,1999:blog-33849608.post-27851863851500809072007-07-20T18:03:00.002-05:002009-04-08T16:31:48.120-05:00

The blacklist SORBS (aka the “Spam and Open Relay Blocking System”) was created in 2002 by Australian Matthew Sullivan. SORBS publishes a main “aggregate zone” (dnsbl.sorbs.net) containing listings meeting a multitude of criteria beyond open relaying mail services. SORBS also publishes multiple other zones meeting various criteria. As related previously, SORBS appears to be undergoing changes.

Al Iversonhttp://www.blogger.com/profile/14312013852191097352noreply@blogger.com