Re: DRAFT minutes Anti-spam WG RIPE 39 Bologna

[furio ercolessi <]

Hi all,

for workload reasons I could not attend any WG meeting so far, 
and my participation to this list has been very moderate.
Anyway we are an ISP following the spam problem with attention.

On Thu, Jul 05, 2001 at 09:20:45PM +0200, Frank Altpeter wrote:
> 
> > C3  Reporting spam
> > 
> > Question from the WG Chair:
> >   Who is reporting every piece of spam they see?

We report every piece of spam we see, directly or submitted by our 
users, by hand (no scripts).
The amount (of what we see and report, not what we receive!) is of 
the order of ~10/day.  This low amount is due to aggressive filtering, 
roughly described at http://www.spin.it/spam/spam_filters.php3#eng
About 60% of spam is blocked by locally maintained blacklists 
containing single hosts, networks, single addresses and domains;
the rest by RSS and other mechanisms.

Filtering also takes away time to explain people filtered
(we indicate a web form in error messages), or customers at the
receiving end, _why_ mail is being rejected.
We use RSS with a delay time window of one month given to hosts
in our country observed to send legitimate mail.  The start of this
time window is accompanied by a "please fix your server" notification
sent to postmaster, whois contacts, ISP and the italian NIC.  This year 
we have sent about 600 notifications so far.  Of the notified hosts, 
about 60% are still in RSS after one month while 40% are removed.
This activity takes a few hours per week but it greatly helps in case 
of controversies.
I wish there were more ISPs around using RSS (or perhaps some
"son of ORBS").  So far, the open relay operators we contact
usually say that they have no trouble sending mail to other destinations.

We also make public (nanas) all spam reports, in the hope that spammers 
take notice and avoid us.  This also seems to help in the long run.
Sometimes we are victim of spammer retaliations, usually in the form
of forged subscription to mailing lists of our role addresses.

Regards

furio ercolessi
Spin - Antispam operation
http://www.spin.it/spam/#eng