[anti-abuse-wg] Abuse: dnsbl - trust and other factors

On Wed, 10 Aug 2016 14:05:51 +0530
Suresh Ramasubramanian <ops.lists at gmail.com> wrote:
> There is something that Spamhaus, after operating a respected and
> widely used block list since the 90s, understands and you don't 
> The focus isn't just blocking spam, any random wannabe bofh can do
> that. The focus is on as far as possible not blocking legitimate
> email, and blocking / unblocking based on clear and maturely
> implemented criteria 
> 
You are 100% correct!

This is also why we still have a spam abuse problem, why our users are
phished and why we cannot stop spam abuse.

Also, Google.com transmits arguably around 50% plus of all email on the
planet.

yet, on superblock.ascams.com - no google.com listing...
even a week ago, when superblock.ascams.com was sitting at 4,2 million
ipv4 - 3 google.com servers
today (around 2,6 million ipv4 - 0 ZERO google.com )

Yes, spam-traps receive copious amounts of spam from Google...!

BUT, maybe once or twice to the same trap. Google manages abuse well,
they respond to abuse complaints (by action) and they do not have
ongoing abuse.

Twitter.com does not even WANT abuse complaints...

yet, society saying that "we do not want to drop legit email" is WHY we
still have abuse.

Andre


> --srs
> 
> > On 10-Aug-2016, at 1:38 PM, andre at ox.co.za wrote:
> > 
> > On Wed, 10 Aug 2016 09:19:21 +0200
> > Antonio Prado <thinkofit at gmail.com> wrote:
> > 
> >>> On 8/10/16 8:28 AM, andre at ox.co.za wrote:
> >>> So why is this? - It is all about trust.
> >> 
> >> well, trust has to be earned.
> >> 
> > agreed, trust is reputation. In the case of a blacklist, it is quite
> > simple though - if it is transparent, like mine
> > superblock.ascams.com each and every listing has been abusive and
> > either is not responding to abuse complaints or is simply ongoing
> > in the abuse...
> > 
> >> just two recent examples:
> >> 
> > thank you so much! lets deal with that - please see below each
> > of your examples
> > 
> >> Aug 10 08:52:16 zimbra-1 postfix/smtpd[27024]: NOQUEUE: reject:
> >> RCPT from 66-220-144-147.outmail.facebook.com[66.220.144.147]: 554
> >> 5.7.1 Service unavailable; Client host [66.220.144.147] blocked
> >> using superblock.ascams.com; 66.220.144.147 Listed For Abuse. To
> >> delist please email del at ascams.com;
> >> from=<notification+zj4ooysyaz0y at facebookmail.com>
> >> to=<mylegitaddress at mylegitdomain.tld> proto=ESMTP
> >> helo=<mx-out.facebook.com>
> >> 
> > Yes! because 66.220.144.147 is BLOCKED for abuse 
> > 66.220.144.147 sends email spam, on an ongoing basis, to FAKE people
> > and, even after receiving three or more abuse reports, is still
> > sending the same SPAM to the same fake people.
> > 
> > So, what I am saying: facebook.com sends spam to example at example.com
> > Facebook then receives 3+ spam reports/complaints
> > And then
> > After that
> > Facebook.com STILL sends spam to the same example at example.com
> > 
> > So, Facebook.com (66.220.144.147) is blacklisted for spam abuse.
> > 
> > Thank you, Antonio - for pointing this example out - This is why we
> > cannot stop spam! - the SENDERS or transmitters of spam - are never
> > punished - but we have to field complaints from our USERS when the
> > senders MIX legit email with spam email.
> > 
> > next example below the example
> > 
> >> Aug  9 17:57:23 smtpfe01 postfix/smtpd[15131]: NOQUEUE: reject:
> >> RCPT from o4.email.wetransfer.com[192.254.123.89]: 554 5.7.1
> >> Service unavailable; Client host [192.254.123.89] blocked using
> >> superblock.ascams.com; 192.254.123.89 Listed For Abuse. To delist
> >> please email del at ascams.com;
> >> from=<alegitaddress at email.wetransfer.com>
> >> to=<mylegitaddress at mylegitdomain.tld> proto=ESMTP
> >> helo=<o4.email.wetransfer.com>
> >> 
> > 192.254.123.89 - EXACLTY the same as Facebook.com - transmits spam
> > to fake people/spam traps - and does not do anything about spam
> > abuse complaints!
> > 
> >> therefore I'm forced to delete superblock.ascams.com
> > 
> > indeed... - this is why the spam problem persists... yet, if you
> > were to continue using superblock.ascams.com - you may actually
> > force the senders of spam to CHANGE their abusive and crappy
> > behavior
> > 
> > But we, society, we do not have the BALLS to do that.
> > 
> > Can we at least have the decency to be honest with ourselves?
> > 
> > Why lie to ourselves?
> > 
> > We do not want to solve the spam abuse problem.
> > 
> > Andre
> > 
> > 
> > 
> > 
> > 
> >> --
> >> antonio
> >> 
> > 
> >