Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×
Spam Businesses The Internet Your Rights Online

UUNet Is The Number 1 Spam Host 346

An anonymous reader submits "Statistics for February have UUnet leading the Spamhaus top 10 worst Spam ISPs chart. The Register point out that ISPs like UUnet and Abovenet continue to host spammers despite advertising anti-spam AUPs." And the competition is probably wishing they had as much luck.
This discussion has been archived. No new comments can be posted.

UUNet Is The Number 1 Spam Host

Comments Filter:
  • Largest ISP? (Score:5, Insightful)

    by fewnorms ( 630720 ) on Monday March 01, 2004 @08:00PM (#8435108)
    Could this probably be because UUNet in my understanding is one of the largest ISP's?
    • Re:Largest ISP? (Score:5, Informative)

      by Anonymous Coward on Monday March 01, 2004 @08:04PM (#8435144)
      UU carries 50% of the US's total Internet traffic and 90% of its e-mail. It makes an easy target.
    • Could this probably be because UUNet in my understanding is one of the largest ISP's?

      UUNet is now part of MCI (formerly WorldCom^Hn) do you think they care?

      "Johnson, why are our revenues down?"
      "We kicked off some spammers, in accordance with company policy, Sir."
      "Well, put them back on, dammit, we need every cent we can get, it's a tough economy!"

    • Re:Largest ISP? (Score:5, Insightful)

      by Anonymous Coward on Monday March 01, 2004 @08:10PM (#8435202)
      That may be part of it, but back when I worked as an abuse admin (in 1998) they didn't care much (we had a deal with them for our dial up customer to use their POPs in areas where we didn't have any) and near as I can tell that hasn't changed a bit. It's PC to have an anti-spam AUP, so they have one (and had one back then, too) but it's not profitable for them to enforce it.

    • Re:Largest ISP? (Score:5, Insightful)

      by koan_72 ( 569629 ) on Monday March 01, 2004 @08:26PM (#8435332) Homepage
      They probably are, but resources that deal with abuse should grow proportionally with size, if you try to cut corners in that department, as in the case of UUnet, you end up with a bad reputation, and hopefully, a whole lot of IP address blocked. I know from experience when I was manually reporting spam, back in the day when the amount still permitted it, they took months of complaints sometime to drop a spammer, and it was usually due to being blocked by Spamhaus or Spews. Aren't the internet arm of Worldcom anyway? You see where they get their code of ethics.

      Spam would not be a problem if all ISPs dealt efficiently with open proxies and spamvertised sites.
    • Re:Largest ISP? (Score:4, Informative)

      by JeremyALogan ( 622913 ) on Monday March 01, 2004 @08:42PM (#8435441) Homepage
      Could this probably be because UUNet in my understanding is one of the largest ISP's?
      You are correct... they are North America's largest ISP. The problem lies in that, whether you realize it or not, you are probably one of their customers. Back in the day it was common for a company to buy one of their T1s (or T3s, or OC3s, or OC12s, or OC48s, or whatever), a couple phone lines/modems and WHOLLA... instant dial-up ISP. I'm not sure, but I wouldn't be surprised if this doesn't still go on (not everyone uses AOL and Earthlink, ya know). At my last job we had one of their T1 lines and, so far as I can tell, they didn't really cared what we did with it. The only time we ever heard from them was when they couldn't ping our router and then it was just to make sure everything was okay.

      And yeah... why do they still use that name? They've been owned by MCI/Worldcom for years now... eveen says so on their front page.
      • Re:Largest ISP? (Score:5, Informative)

        by slash-tard ( 689130 ) on Monday March 01, 2004 @09:46PM (#8435949)
        The MCI / UUnet thing is mostly internal politics but also a little bit business related. You can get 2 internet circuits or 2 frame relay connections from the company and have it go over 2 different networks for diversity. One would run on the MCI network, the other would run on the UUnet network. This gear is supposed to be completely separate.

        Also they dont monitor your traffic, can you imagine the logs that would create. They only contact you about spam (or whatever else) if someone complains to them about something coming from your IPs.
  • What comes around... (Score:5, Interesting)

    by rf0 ( 159958 ) * <rghf@fsck.me.uk> on Monday March 01, 2004 @08:00PM (#8435112) Homepage
    ...goes around. I'm sure when spam block become so vicious that ISP's like this are blocked off they will either go under or change their mind

    Rus
    • by orion024 ( 694922 ) on Monday March 01, 2004 @08:06PM (#8435158)
      That's a valid point. Or... we might help accelerate that process. What if filtered spam was "returned" to the sender? Granted this would put extra load on all of our own ISP email servers, but it would put a MUCH greater load on the ISP's who host the spammers. It's one thing to send out 1million spam messages on your server, but to have to deal with all of those emails coming right back at them...
      • by taustin ( 171655 ) on Monday March 01, 2004 @08:19PM (#8435280) Homepage Journal
        Or... we might help accelerate that process. What if filtered spam was "returned" to the sender?

        How do you identify the sender? The From: address is forged, the envelope MAIL FROM: is forged, the Reply-To: if forged, and in most cases, the originating IP address (the only one you can count on) is a virus infected zombie.

        Granted this would put extra load on all of our own ISP email servers, but it would put a MUCH greater load on the ISP's who host the spammers.

        No. All it will do is bombard some innocent victim (probably somebody who complained about spam to the spammer's ISP) with thousands - or millions - of emails that they were not reponsible for. That means that you are part of the attack,, part of the problem.

        It's one thing to send out 1million spam messages on your server, but to have to deal with all of those emails coming right back at them...

        Which is precisely why spammers forge all identifying information they possibly can, and why your plan will make spam worse, not better.
      • In case you haven't received spam lately, spammers usually use some random person's email address as a return address (i.e. a joe-job). So the ISP that sent the spam would not get any messages bounced.
      • by chimpo13 ( 471212 ) <slashdot@nokilli.com> on Monday March 01, 2004 @08:30PM (#8435352) Homepage Journal
        I love, love, LOVE getting tons of messages bounced back from when one of my domain names gets used as the From in spam. Or when I get MS virus' bounced back saying "You sent a virus" even though I'm not running microsoft.

        But it does sound good on paper.
    • by Saeed al-Sahaf ( 665390 ) on Monday March 01, 2004 @08:07PM (#8435172) Homepage
      ...goes around. I'm sure when spam block become so vicious that ISP's like this are blocked off they will either go under or change their mind

      I think it's pretty much been proven that this is wishful thinking. When a provider starts blocking large stretches of IP blocks owned by a particular ISP like UUNet, average users scream bloody murder. My prediction is UUNet will do nothing, and nothing will happen to UUNet. Sad but true.

      • by ilctoh ( 620875 ) on Monday March 01, 2004 @08:18PM (#8435272)
        Correct. It is the ISP's responsibility to prevent SPAM at its source, not merely block users from it. Users are also responsibile for using available filtering technology, and being careful about giving out their email address (especially on personal web pages). Perhaps the most useful thing that any ISP can do right now is to provide an easily accessed and located "Anti-Spam Information Page", with instructions and suggestions for users of that ISP to control SPAM.
    • Unfortunately, UUNet is Worldcom, and they handle something like 50% of all internet traffic at some point. They could block the entire rest of the internet easier than we could block them.
  • why? (Score:2, Interesting)

    by .silG.00 ( 683700 )
    why would the competition would have luck by hosting SPAMMERS? get payed because of all the traffic?
    • Re:why? (Score:3, Funny)

      by justMichael ( 606509 )
      When a spammer finds a "spam friendly" ISP they generally pay a premium for their access. Which is why the ISP is spam friendly in the first place.

      Disclaimer: NO I am not a spammer. If you want I'll supply the "XL Humungous Butt Plugs" to give to spammers as a gift, you are going to have to deliver it yourself. With dimensions of 5" x 9", most folks are not gonna like it, unless the gaotse guy is a spammer.
  • I know not (Score:4, Insightful)

    by ackthpt ( 218170 ) * on Monday March 01, 2004 @08:02PM (#8435128) Homepage Journal
    I know not where it comes from, but I know where it goes. About 500 pieces of it each day, most of it filtered. I have to wonder aloud, with such a deluge, do any of these fools pushing junk actually believe such an onslaught will generate business?
    • Re:I know not (Score:5, Insightful)

      by Kenja ( 541830 ) on Monday March 01, 2004 @08:05PM (#8435146)
      "I know not where it comes from, but I know where it goes. About 500 pieces of it each day, most of it filtered. I have to wonder aloud, with such a deluge, do any of these fools pushing junk actually believe such an onslaught will generate business?"

      It DOES generate buisness, thats one of the problems. Stupid people are out there on the internet trying to make there "members" larger.

    • Re:I know not (Score:5, Insightful)

      by pangian ( 703684 ) on Monday March 01, 2004 @08:14PM (#8435240)
      Yes. They do. Therein lies the rub. Either:

      1) Spamming does make money, because some idiots actually buy things from spammers;

      2) People don't actually buy directly from spammers, but for marketers of some products (illicit, low yield) mainstream media just isn't an option, so the only way to make people aware that these products exist is through spam. (i.e. I may not buy herbal viagra, or dental insurance or an MBA directly from the people flooding my inbox, but now I know that I can buy these things online. If me and 100 of my neighbors search for these products later, at least a few will buy from the original spammer.

      3) Professional spamming shops are doing a good job of convincing retailers that 1) and/or 2) are true.
      • Re:I know not (Score:3, Insightful)

        by Fnkmaster ( 89084 )
        I think you're right. Even if nobody buys Viagra from a spam email, the first place anybody thinks of to get Viagra is online - why bother going to see a doctor, you can just Google for Viagra and buy online! It's interesting, the real benefit from a lot of spam would seem to be for the manufacturer who benefits from the brand-building and the awareness of an online market created (thus also benefitting those who rank high in Google results).

        In fact, it would seem possible that some of the egregious vio

    • I know not where it comes from, but I know where it goes. About 500 pieces of it each day, most of it filtered. I have to wonder aloud, with such a deluge, do any of these fools pushing junk actually believe such an onslaught will generate business?

      Uh, if it didn't generate revinue, then people wouldn't do it. A huge amount of my spam gets filtered, but not enough for me. (I just updated my baysian filter yesterday, and it works much better now, but spammers aren't stupid and know how to get around filt
      • Re:I know not (Score:2, Insightful)

        by ackthpt ( 218170 ) *
        I just wish they would enforce that new law. The federal government took the time to make most harsher state laws moot, and now they arn't even doing anything to enforce their bullshit laws.

        As one critic voiced it, on the BBC this morning, the current administration doesn't do anything until it's crisis. I wish that weren't true, maybe they are actually gathering up a pile of this trash and getting ready to haul in about 500 people, which should scare the bejeezus out of most of the rest. If Bush wants

  • by laymil ( 14940 ) <laymil@obsolescence.net> on Monday March 01, 2004 @08:03PM (#8435132) Homepage
    The easiest way to stop spam is as follows:

    Step 1: Buy an aluminum baseball bat.
    Step 2: Find spammer.
    Step 3: Beat spammer with aluminum baseball bat.
    Step 4: Sell what is left of spammer to Hormel, makers of spam.
    Step 5: Deposit money into legal fund for defense against spam. (Baseball bat Distribution center)
    • by laymil ( 14940 ) <laymil@obsolescence.net> on Monday March 01, 2004 @08:10PM (#8435204) Homepage
      On a slightly more serious note:

      While I advocate extreme violence against spammers, I do feel that it is the responsibility of an ISP to stop spam at the source.

      However, if the spammer is merely leasing an IP/Dedicated connection from the ISP, this involves placing restrictions on the actual line - which isn't called for.

      In essence, if you are leasing directly from an upstream provider, they aren't so much an ISP in that case. If the customer was grandfathered in under an old contract, the provider could be left without any legal recourse against the person.

      However, if a customer is in violation of their AUP and the AUP was agreed upon at the initiation of the transaction (leasing the line, buying the connection, etc), then the ISP should be held to enforcing that, be it by terminating service or installing filters, etc.

      I suppose the most difficult thing is when someone leases a line to run a dedicated server serving legitimate mailing lists, etc.

      This becomes a case of "How Draconian do you want your ISP to be?"

      I know I can deal with the spam. I hate it, but I'd rather deal with spam than be incredibly restricted by my AUP.
    • by FattMattP ( 86246 ) on Monday March 01, 2004 @08:13PM (#8435234) Homepage
      I know that everyone is going to read the parent post and think what a funny and great idea it is. Well, it's not. A nice solid wood bat is the right way to go. It'll be heavier and will get your point across in much less swings.

      :-p

  • Clue (Score:5, Informative)

    by Cranx ( 456394 ) on Monday March 01, 2004 @08:05PM (#8435152)
    Spammers can sneak into even the most STRINGENT anti-spam ISP network. A stolen credit card that works only once gets a spammer an account that can deliver many thousands of letters before they're shut down. UUnet isn't spam-friendly anymore than Rackspace is spam-friendly. Spam is going nowhere until good authentication techniques are implemented internet-wide.
    • Re:Clue (Score:4, Insightful)

      by neiffer ( 698776 ) on Monday March 01, 2004 @08:13PM (#8435228) Homepage
      This is what makes acts like the CANSPAM act so silly. Does anyone really think we'll be able to deal with it, legally or otherwise, until we have the technology implimented to do so?
      • Re:Clue (Score:3, Informative)

        by LostCluster ( 625375 ) *
        The only thing that can truely take care of spam is a protocol for the provider upstream of a user to be able to revoke an e-mail that passed through them. It means moving to an e-mail system that doesn't trust home e-mail servers that don't pass through a trusted company anymore.

        Right now, any IP address holding computer has the ability to become a mail server, so any IP address holding computer has the ability to spew spam.
    • by enosys ( 705759 ) on Monday March 01, 2004 @08:14PM (#8435238) Homepage
      Do they use stolen credit cards regularly? I wouldn't think so. You can get away with spam a lot of the time without legal conseqences but credit card fraud is another matter. Wouldn't any spammer that did this sort of thing get caught fast? Or do they go through chained proxies to do it all and regularly get away with it?
    • Re:Clue (Score:5, Informative)

      by eaolson ( 153849 ) on Monday March 01, 2004 @08:24PM (#8435317)
      Spammers can sneak into even the most STRINGENT anti-spam ISP network. A stolen credit card that works only once gets a spammer an account that can deliver many thousands of letters before they're shut down.
      The question isn't whether or not spammers get on the network. Any system that allows people to sign up automatically with a credit card is vulnerable to that. The question is whether or not UUnet is willing to do anything about a spammer once he's brought to their attention. Although some of the SBL records for UUnet appear to be out of date, some spammers dating back at least to April 2003 are still present on their network.
      UUnet isn't spam-friendly anymore than Rackspace is spam-friendly.
      It's amusing that you mention Rackspace. I understand they appear to be cleaning up recently, but previously, they were more than happy to host spammers, so long as they paid their bills.
      Spam is going nowhere until good authentication techniques are implemented internet-wide.
      You'll excuse me if I don't hold my breath. IMHO, so long as there is a China, there will be spam. Until then, I'm going to keep using Spamcop [spamcop.net] and SPEWS [spews.org].
  • by teutonic_leech ( 596265 ) on Monday March 01, 2004 @08:06PM (#8435159)
    ... or does anyone really think that these guys are NOT aware of this?
  • by James A. H. Joyce ( 757819 ) on Monday March 01, 2004 @08:06PM (#8435168)
    Big ISPs which can afford to lose customers talk shit and do nothing. You know as well as I do that it's going to be us, the end-users, who have to be proactive about this. These ISPs don't give a fuck. They're probably run by cable school drop-outs.
  • Large portions of UUNet have been listed by the various anti-spam blacklists, such as Spamhaus [spamhaus.org], and all of UUNet is blacklisted in SPEWS [spews.org]. These providers are the scum of the Earth. They will delay, misdirect, and outright lie to keep their sweet large contracts with the spammers, at the expense of all their other customers.

    Do you want to put your faith in a business that is indirectly lining the pockets of spammers?
    • by Anonymous Coward
      because the reality is:

      1. every person who buys hosting just cant afford to deal with being "politically correct" when choosing providers. Its not practical to change ISP's every 3 months because their current ISP pisses off some vocal minority who represents some whacko cause (take porn, for instance, whom hosting providers get a lot of flack from Christian groups)

      2. Sometimes financial constraints force you to go with one provider alone

      3. If an ISP shuts down spammers, some other ISP will be happy to m
  • by aldridge ( 740912 ) on Monday March 01, 2004 @08:13PM (#8435229)
    Its time for ISP's to take responsiblity for the shit that they host. Didint Gates say that spam will be dead by 2006? ( http://www.cbsnews.com/stories/2004/01/24/tech/mai n595595.shtml [cbsnews.com]). Time to start breaking down doors Bill. I guess he could just use a backdoor in to the spammers running windows.
  • by KalvinB ( 205500 ) on Monday March 01, 2004 @08:14PM (#8435241) Homepage
    UUNet should give known spammers on their network their own IP range. If you spam, you get moved into that range. Those who don't want their crap can then easily filter it out by blocking those allocated spammer IPs. And the ISP still gets paid.

    Customers who are running legitimate mail servers can stay out of that range as long as they don't break the AUP. The ISP doesn't even have to kill port 25 on the spammer IPs. They could simply limit the amount of bandwidth that can be used to something like 10MB per day on port 25. Which is reasonable. There's no incentive to out and out ban those IPs if no massive amount of junk can come out of them. The spammer is just forcibly restricted until they can behave themselves. At which time they can go back to a less restricted IP range.

    I don't think there's any law that says ISPs can't selectivly put people in certain IP ranges. I don't think spammers have any way to fight it under current anti-discrimination laws. If you can even call it discrimination since it's would be based solely on the actions of the person and not who they are.

    Ben
    • by bigberk ( 547360 ) <bigberk@users.pc9.org> on Monday March 01, 2004 @08:33PM (#8435385)
      UUNet should give known spammers on their network their own IP range
      Are you kidding me? UUNet should boot known spammers from their network. Sheesh. ISPs get bad reputations precisely because they do what you describe (tolerate spammers and try to manage around them).
      • It's easier (Score:5, Interesting)

        by KalvinB ( 205500 ) on Monday March 01, 2004 @09:16PM (#8435737) Homepage
        to just automatically move an account over to a spam IP if port 25 traffic gets too much than to pull the account entirely. Cox Communications supposedly already has an automated system to redistribute IPs (mine's never changed). So it's not something drastic that would need to be implemented.

        As other people have mentioned, relays are a big part of the problem. It's better to "punish" ignorant customers by moving them to a restricted port 25 IP than to cut them off entirely. By moving them there's no harm no foul since they weren't the ones directly spamming anyway and probably won't notice they were moved.

        If they do notice and call then the ISP can tell them to do something about their excessive e-mail sending and point them at the AUP. It's all very quick and painless to resolve the issue since it's the customer that has to take action to speak with people and not the company making the calls. People who have to call when they know they broke the rules are far less likely to do anything.

        Cox recently cut off incomming port 25. Probably because of myDoom. I'm not about to call and complain because I was trying to run a spam can on my home system. Outgoing port 25 has been blocked since I got the service. And it would be a waste of time and money for them to call me and yell at me. They quietly cut off my server and I just shut my mouth about it.

        By having a no harm no foul automated system you can punish a spammer as soon as say X MB of e-mails get sent in Y amount of time. Versus finding out about it later after it's too late and gigs of e-mails have been sent.

        Automatically kicking customers entirely is just asking for trouble because the ignorant (those who unknowingly relay) will be kicked which will result in bad PR where there should be none.

        You can still kick the spammer entirely. It's just a matter of starting with a little punishment and then escelating only as nesseccary.

        Kicking a customer should be the last resort when just limiting port 25 traffic is sufficient.

        Ben
    • Actually, the idea is a great one, which will never work. Stick all of the spammers in a known IP range, great. Now everyone simply rejects all mail from that IP range, and the world is happy. Problem is, eventually, some ISP is going to get it in thier head that they can squeeze a few more dollars out of the system by offering a "premium" spamming package. This gives the spammer an IP outside the listed spammer range, and allows them to spam to thier black heart's content.
      As good as it sounds to put a
  • by netik ( 141046 ) on Monday March 01, 2004 @08:16PM (#8435251) Homepage
    Before this debate gets too out of hand, has anyone weighted amount of spam vs. size of network?

    UUNet is a large, large carrier with many networks globally. Are they the worst spammer because they have the most network entry/exit points, or are they unfairly attacked here because they are just large?

    • by Jayjay75 ( 468973 ) on Monday March 01, 2004 @08:52PM (#8435509) Homepage
      Did we RTFA?

      "UUNet hosts more spammers than any other ISP. It has 151 listings on the Spammers Block List (SBL), including 34 known spam gangs with ROKSO records, according to the anti-spam organisation Spamhaus' records for February 2004."

      They host 34 known professional hard-core spam-gangs. Size has nothing to do with it.
    • by Mesaeus ( 692570 ) on Monday March 01, 2004 @08:56PM (#8435537)
      UUnet is not being attacked because of the number of spam originating from its networks, but because of the large number of KNOWN spamgangs STILL residing on their network after literally thousands upon thousands of complaints. Some of the spammers haven been there for over TEN MONTHS now.
      This leaves us with two possible scenarios to explain this :

      1) UUNet is a spamhaus and will host spammers as long as they pay.
      2) UUNet is dead set against spam, however somehow their abuse department has never read all the complaints, including ten month old ones. Maybe they got "lost in traffic or stuff". Or maybe those poor abuse department people are overworked ? Or just plain DEAD ? After all this silence you start to wonder...
  • by Dezsr5 ( 749977 ) on Monday March 01, 2004 @08:19PM (#8435274)
    The reason UUNET is known as a facilitator of the largest amount of spam is that they are the largest ISP. And many of their customers have what is called an open relay. Since most UUNET customers send thier outbound mail through mail.uu.net (UUNET's mail relay), spammers that find an open relay send email that looks as if it is coming from a UUNET customer (and UUNET's mail relay.) This is a problem that UUNET tries to remedy, but educating a I-D-10-T customer )not to mention 10,000 customers) about his/their own mail server's open relaying capabilities is difficult to say the least. If a spammer tries to use UUNET's mail relays directly, it does not last long and eventually he is told to take his buisness elsewhere. The people that think that UUNET is using spammers to make more money are just plain ignorant.
  • You're paying for it (Score:5, Interesting)

    by ZakMcCracken ( 753422 ) on Monday March 01, 2004 @08:21PM (#8435299)
    At issue is the business model for interconnection agreements between carriers. When an IP carrier interconnects with another, the basic metric to see who pays whom and how much is the download/upload ratio of the connecting carrier. Peering (at-cost interconnects) is only granted to carriers with whom there is a level upload/download ratio.

    So if you're an IP carrier with no or little hosting on your network, you mostly download from your interconnects. Therefore you pay more to interconnect with the big IP backbones like UUnet.

    If you're UUnet, there is an economic incentive for you to host spammers, because it boosts your upload; therefore you pay less (or, in the case of UUnet, get more money) on interconnects.

    If I was UUnet, I don't see why I would waste money on fighting spammers who (1) are my customers and (2) increase my bottom line by boosting upload at interconnects.

    By considering all packets to be equal on the backbone, you're averaging "unwanted" traffic vs. "useful" traffic such as web traffic (aka porn). The side effect of this is, you're paying for spam with your Internet connection.
  • by Gurezaemon ( 663755 ) on Monday March 01, 2004 @08:26PM (#8435328)
    Oh the irony...

    I particularly enjoy the "Ads by Google" in the banner at right of the article, for
    Bulk Mailer
    Reach 500,000 opt-in recipients

    and Bulk Email List
    Low Cost Bulk Email Marketing Full Email Reports.
  • by ph43thon ( 619990 ) on Monday March 01, 2004 @08:28PM (#8435341) Journal
    A domain [burga-flippa.com] of a spammer listed [spamhaus.org] for level13 was rooted. OR did a spammer root all of this users domains and use them to spam?


    p
  • by MoFoQ ( 584566 ) on Monday March 01, 2004 @08:33PM (#8435378)
    of course, I've used blacklists and whitelists on my acct (from softhome.net). They also have a thing called greylisting (some opensource guy came up with the idea; sry, don't have linkie) which is like the telezapper I have on my phone; it holds an email and doesn't tell the sender's server if it was successfull or not [timeout] then waits for the sender's server to try again and since most spammers use a mass-mailing program that uses a "take it or leave it" tactic, it catches most spam.

    Of course, I've added ppl I know to a whitelist so there's no delay and added IP ranges (typically uunet or above.net and some from the UK, china, korea, etc.) [Class B and Class C] to my perma-blacklist. Being able to blacklist IP ranges {or even mail that doesn't have a sender address regardless of IP) is very useful. I don't get spam that's mailed directly to me anymore (still get some spam that's sent to a mailing list like sourceforge's MLs, though).

    One odd thing I've noticed is that softhome's implementation of one of the blacklisting options has changed and effectively blocks all email that's not ok'd by me (the blank sender address filter that is). But it's ok, most ppl I know get placed on my whitelist or if I'm sending to some company, I make sure I add the companies domain(s) to my whitelist as well. Hey, it's a small price to pay for lack of spam.

    Also, if someone legit tries to email me and gets blocked, they get an error from their host that reports that "the server doesn't like them". Good for those pesky relatives...hehehe
    • by msimm ( 580077 ) on Monday March 01, 2004 @09:05PM (#8435630) Homepage
      Although I'm not sure its the project you've described: Tagged Message Delivery Agent (TMDA [tmda.net]), from their site:
      TMDA is an open source software application designed to significantly reduce the amount of spam (Internet junk-mail) you receive. TMDA strives to be more effective, yet less time-consuming than traditional spam filters. TMDA can also be used as a general purpose local mail delivery agent to filter, sort, deliver and dispose of incoming mail.


      The technical countermeasures used by TMDA to thwart spam include:

      * whitelists: accept mail from known, trusted senders.

      * blacklists: refuse mail from undesired senders.

      * challenge/response: allows unknown senders which aren't on the whitelist or blacklist the chance to confirm that their message is legitimate (non-spam).

      * tagged addresses: special-purpose e-mail addresses such as time-dependent addresses, or addresses which only accept certain kinds of communication. These increase the transparency of TMDA for unknown senders by allowing them to safely circumvent the challenge/response system.
      I currently use bluebottle.com [bluebottle.com] who just recently re-emerged after shutting their service down (siting DDOS attacks by spammers). Their service is basically what the TMDA site describes with a nice setup and a few extra features. Its a free service so if your thinking about trying something like this out, this is the one. I personally am not a fan of filter and to date this is my favorite option. Stuff that I need gets in.
    • [...] it holds an email and doesn't tell the sender's server if it was successfull or not [timeout] then waits for the sender's server to try again and since most spammers use a mass-mailing program that uses a "take it or leave it" tactic, it catches most spam.

      Link to more information here [puremagic.com], just to make sure that people don't get the wrong idea: a greylisting server will respond to all attempted deliveries from unknown sources with an RFC-compliant deferral, which should cause the sending MTA to queue t

  • At least they are bigger than Exodus & Level3 in one way. Bill LaPerch is doing such a great job at Abovenet, you'd never guess that he's such a gravy-sucking pig.
  • by Anonymous Coward
    Does anyone remember when UUNet was black listed? Or when Rogers was blacklisted?

    Those were the days... but the age of activist sys admins is gone... we have been replaced with dot bomb drop outs who care about nothing more than a few $$$.

    We are finished.

    And think about it... what antispam technique can you think of that is more effective than filters and less intrusive (IE less clicking) to the users?

    Loads of things are effective but all make the user work harder than they would by just deleting the s
  • I'm not seeing it... (Score:5, Informative)

    by chriskenrick ( 89693 ) on Monday March 01, 2004 @08:41PM (#8435431)
    I run a report daily that tells me where my Bayesian-identified spam came from (IP address and host name via reverse lookup).

    Out of the approximately 16 daily reports in my inbox, only two addresses are uu.net. I'm seeing comcast.net (37 occurences) and adelphia.net (29 occurences) a lot more, by comparison.
    • Comcast is my number one source of domestic spam as well. My largest source of foreign spam is coming from Wanadoo.fr. That's after I was forced to refuse connections from the plethora of Chinese IPs that seem to solely exist to promote penis-enlargement and home mortgage scams.
  • by csk_1975 ( 721546 ) on Monday March 01, 2004 @08:42PM (#8435440)
    My experience with UUNet:-

    1. In 2000 a spammer in Louisiana forges one of my domains in spam runs sent via UUNet - I get tens of thousands of bounces and hundreds of complaints.

    2. I complain to UUNet - no action.

    3. I phone UUNet security as the runs are being sent - no action.

    4. Every weekend for 2 months this happens and I get sick of it.

    5. I start to autobounce all this junk back to abuse@uunet.com.

    6. Spammer sends a run using a different ISP.

    7. UUNet gets really pissed that I bounce 1000 mails to abuse@uunet.com which didn't originate from their network (with some justification).

    8. UUNet block all access from my class C to their servers.

    9. The spam runs sent via UUNet continue....

    Forward to 2004, I still can't send mail to uunet.com!
  • by humankind ( 704050 ) on Monday March 01, 2004 @08:54PM (#8435525) Journal
    I am a UUNet/Worldcom customer and have multiple pipes to my network from their backbone. I think they have one of the best-performing backbones on the Internet.

    Unfortunately, while I am happy with UUNet's performance and stability, I am even more unhappy with their apathy towards their network being clogged by spam traffic. And at least 40% of the bandwidth I pay for is consumed by unwanted UCE, so they actually profit from this crap. As a result, there's not much incentive for them to address it. And I have to grudgingly pass these expenses on to my customers.

    But UUNet is not any different from other top-tier ISPs. They hide behind the "common carrier" metaphor, using it as an excuse to justify a large portion of the bandwidth they sell to others which is unuseable due to spamming.

    I can't help but think if I ordered a telephone line, and 40-60% of the time I had "noise" interfereing with my ability to communicate, that the phone company would be obligated to resolve the situation. Unfortunately, with ISPs, there doesn't seem to be anyone at the top that really gives a damn, nor any incentive on their part to address the situation.
  • by readpunk ( 683053 ) on Monday March 01, 2004 @09:21PM (#8435786) Journal
    The issue of spammers is fairly unrelated to the different major bandwidth suppliers. We have three different providers here and spammers rarely request or care which network we put them on. They just want to get their 1.5 day's of major spamming done before we shut them down. The issue is what is going on at data centers to stop spammers quickly and what is being done on the internet to make spamming unprofitable.
  • by sik puppy ( 136743 ) on Monday March 01, 2004 @09:44PM (#8435941)
    I was getting deluged by uu.net originated spam, and of course abuse@uu.net is ignored.

    Finally I resorted to bouncing all uu.net originated spam to sales@uu.net and info@uu.net

    make the sales scum suffer the same problem they inflict on everyone else by selling their pink contracts.

    Some of the indignant replies from the sales staff were quite amusing. I guess they told their spammers to delete me from thier spam runs, as the volume quickly dropped and then finally stopped completely.

  • Spam solutions (Score:5, Interesting)

    by jonwil ( 467024 ) on Monday March 01, 2004 @10:11PM (#8436140)
    Firstly, all ISPs (and corperations, schools, unis and so on) should block port 25 by default.
    Those that want to run a mailserver for legitimate reasons can do so but anyone who hasnt speicificly said "I want to run a SMTP server on my connection" will be prevented from doing so (this would cut out 99% of the spam comming from spam zombie boxes)

    Second, close open relays (if you need to have an "open machine" run some kind of SMTP authentication)

    Thirdly, implement SPF for more hosts and more clients (if you want to run your own mail server with xxx@mydomain.com addresses but relay through mailservers at ISP, work etc, just add those SMTP servers to the SPF record)

    And forthly, be more proactive in blacklisting ISPs that are known spam havens (if enough people block the IP ranges of bulletproofspamhosting.com, spammers wont be able to get their messages through and bulletproofspamhosting.com will go out of business when the spammers leave)
    If its a regular ISP with non-spam customers as well, pressure from the non-spam customers (especially if those non-spam customers are big) might convince the ISP to dump the spamers.
    Eventually, if this happens enough, ISPs will realize that hosting spamers means that they will be blacklisted.

  • It's worth noting... (Score:5, Informative)

    by signe ( 64498 ) on Monday March 01, 2004 @10:24PM (#8436221) Homepage

    I know they're not anyone's favorite company, but it's worth noting that AOL is not anywhere on the top 10 list. Not so many years ago (less than 5), they used to top that list most of the time, and the rest of the time they were in the top 3 (not necc. Spamhaus's list, but Spamcop's definitely, back when they meant something).

    Having been involved in the work, I can tell you that AOL was one of the first, if not the first, large ISP to implement tagging of outbound email with the true email address of the sender, regardless of whether or not they put it in there (the X-Apparently-From header that AOL inserted). Also close to the first, or the first, to implement outbound filtering of email for spam. When the second one was put into place, I watched the ranking and saw AOL drop from #1 to nowhere on the top 10.

    -Todd
  • by JeffHeatonDotCom ( 755297 ) on Monday March 01, 2004 @10:32PM (#8436267) Homepage
    The spammyness of your web hosting ISP can be a major factor. When you sign up with a host company, either dedicated or shared, you are assigned an IP address from their "pool". If you get an IP from a former spammer life is not good!

    I got an IP address that was blacked listed by SPEWS once. Much of my email would not work and the web host company would not change my IP. They suggested I contact SPEWS. I later learned that the host company was a spammer magnet and I was not alone. I switched companies and all is well.

    Jeff
  • by ZB Mowrey ( 756269 ) on Monday March 01, 2004 @10:38PM (#8436298) Homepage Journal
    The major ISPs charge in a metered fashion. That means all their customers pay by the MB, GB, etc. A spammer who uses bandwidth to send spam is going to pay for all that data - but so will the end user in the ISP's system. The ISP knows that spam is an issue, but it provides them with zero-maintenance traffic, constantly running up the user's 'meter'. In a capitalist society, profit is always the motive. The ISP doesn't just charge you what the bandwidth costs them... They add a percentage that equals profit. [Begin technically inaccurate but wholly educational example] XISP has a fixed cost of 10 cents per Gigabyte of traffic, upstream or down. They charge 12.5 cents per Gig. Spammer_X sends out 20GB of spam. He pays the ISP $2.50 for that privilege. Since cost was $2, they made 50 cents. Now, assume that the mail is primarily directed at ISPs who lease lines from XISP, and who pay that same 12.5 cents per Gig. If they get 60% of the downstream covered, they'll be able to make another $1.50 off the traffic they originated. So for transferring 20GB across their own network, they made $4 on something that cost them $2. THAT is why the "Common Carriers" take their time getting rid of spammers. The longer they can let the guy spew his mail, the more 'incidental revenue' they can scrape together.
  • by buss_error ( 142273 ) on Monday March 01, 2004 @11:11PM (#8436550) Homepage Journal
    The Register point out that ISPs like UUnet and Abovenet continue to host spammers despite advertising anti-spam AUPs."

    Gee, isn't it deceptive trade to say one thing and do another? Is failure to enforce a published contract, saying that everyone has to abide by it fraudulant?

    On the email servers I manage, UUNet, Level3, Shaw, Cox, and Above.net are all almost completely blocked. The bounce message says "This site does not accept email by default from your current ISP. Please call xxx-xxx-xxxx to request whitelisting."

    I love it when spammers call and try to get whitelisted. Like I've never heard of SpamCop, SpamHaus, SPEWS or News.Admin.Net-Abuse.Sightings...

It is easier to write an incorrect program than understand a correct one.

Working...