Internetworkers: http://www.ibiblio.org/internetworkers/

[Steven Champeon <schampeo AT hesketh.com>]

on Thu, Oct 03, 2002 at 01:57:18PM -0400, Dan Smith wrote:
> Good afternoon!
> 
> In my ever continuing fight against spam operations, I discovered a few 
> things I thought should be shared.  Since we all know our ISP's won't do 
> much to block spammers, we have other avenues.
> 
>    1. Filter your spam into it's own directory, mine is called 'shit'.
>        I try to forward and dump the box once per week.

This is a good idea.

>    2. Continue to complain to your ISP, however.  They eventually get
>       tired of complaints about spammers and block all email from the
>       offending domains.

This is, however, a pointless waste of time. Both for the ISP and the
recipient of the spammer. Most, if not all, ISPs nowadays are using
DNSBLs, either their own or others, in addition to various other tricks
to try to cut down on spam. Complaining to your ISP if you receive spam
just boosts their costs and makes it more and more unlikely that they
will have time to implement a real solution.

We used to block by the domain, and still tag by domain, but too many
false positives made blocking a pretty expensive practice. I got nothing
but spam for three years from random addresses in @usa.net, so I blocked
them. A month later, we had a potential customer trying to email us from
usa.net, and a client had the same situation.

So now we mostly just tag email that fails certain checks, using a
header that the end user can filter on.

Razor/Cloudmark, SpamAssassin, and other tools are also helpful.

Most of the spam I get these days (around 3-5K messages a month) is
sent through unsecured proxies in other countries. I blocked SMTP from
most of East Asia, and my spam fell by about 2/3rds. But there's not
much anyone in the US can do about a open Chinese or Korean relay, so
drastic measures had to be taken.

Do your best to educate yourself about how to interpret spam and email
headers in general, and be selective in who you track and report. I have
received ~1500 ads for the "new .BIZ and .INFO domains", for example,
and nearly all of them were sent through insecure proxies. Not much you
can do about each proxy but block it, but you can complain to ICANN (not
that that's much better). You can pick "pet spammers", too, by looking
for patterns and tracking them down and getting them kicked off their
ISP it is possible to make their venture more expensive, which is about
the best you can do until the spam laws get better.

Oh, and you can report Nigerian "419" scams to the US Treasury Dept:

 419.fcd AT usss.treas.gov

Use the Subject [NO LOSS] if you aren't stupid enough to send money
to a random stranger, or [LOSS] if you are.

 http://home.rica.net/alphae/419coal/

Steve

-- 
hesketh.com/inc. v: (919) 834-2552 f: (919) 834-2554 w: http://hesketh.com
The average person needs trepanation like he needs a hole in the head. -ca