North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: ISP wants to stop outgoing web based spam

  • From: Ken Simpson
  • Date: Fri Aug 11 12:31:06 2006

Alexander Harrowell [11/08/06 17:09 +0100]:
> Holding the geek snobbery for a moment, I don't think I've ever worked
> anywhere where the e-mail wasn't that would kill 100% of
> "e-mail containing actual financially meaningful information".

Yes it would if host type was the only factor you used to decide
whether to block a connection. It would be silly and unwise to block
based on host type alone. However in the absence of any other
information about an IP, it's at least a good and safe way to trigger
rate limiting or throttling of a connection. Once the sender gets a
few good mails through and proves its worthiness, its good reputation
will vastly outweight the host type.

Legitimate senders don't move around a lot, so their positive
reputation has time to build. Spammers on the other hand use very
short-lived IPs which do not have a chance to build reputation.

The next iteration for spammers will be to move in a big way toward
sending via legitimate outbound mail servers. A previous thread was
already discussing a variant of this technique, where webmail accounts
are automatically plundered from cafes in Nigeria to exploit the good
reputation of ISPs.


> On 8/11/06, Ken Simpson <[email protected]> wrote:
> >
> >
> >> On 10 Aug 2006, at 22:07, Barry Shein wrote:
> >> [...]
> >> >The vector for these has been almost purely Microsoft Windows.
> >>
> >> I wonder. From the point of view of a MX host (as opposed to a
> >> customer-facing smarthost), would TCP fingerprinting to identify the
> >> OS and apply a weighting to the spam score be a viable technique?
> >
> >We have been doing that in our traffic shaping SMTP transport for a
> >while now. We have found a 95% correlation between spam sources and
> >Windows hosts. If you drill down to specific versions of Windows, the
> >correlation is even higher.
> >
> >For _blocking_ connections (as opposed to, say, just slowing them
> >down), you must combine host type with reputation information.
> >
> >Regards,
> >Ken
> >
> >--
> >MailChannels: Reliable Email Delivery (TM) |
> >
> >--
> >Suite 203, 910 Richards St.
> >Vancouver, BC, V6B 3C1, Canada
> >Direct: +1-604-729-1741
> >

MailChannels: Reliable Email Delivery (TM) |

Suite 203, 910 Richards St.
Vancouver, BC, V6B 3C1, Canada
Direct: +1-604-729-1741