You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Hirotaka Fox <hi...@yahoo.com> on 2004/06/10 14:38:25 UTC
Blocking all of China
/Also, apparently 70 percent of spam is sent from China by American spam
outfits who in turn have hosting arrangements with Chinese ISPs."/
Does anyone have a SpamAssassin related way to block all of China? I
read things like this on SpamHaus and just want to block all of China
from sending my company mail. We don't have any business dealings in China.
Hirotaka
Re: Blocking all of China
Posted by Nix <ni...@esperi.org.uk>.
On Thu, 10 Jun 2004, jdow@earthlink.net spake:
> Because there is a more time consuming but fun approach to the Chinese
> problem. If the address for a message source or relay point happens to
> fall in China (not Taiwan or Korean) you harvest the address and send
> back to that address an official looking invoice with a thank you for
> your order of 100,000 copies if the Feng Sui Handbook.
>
> I have heard this is remarkably effective.
Not as effective as an email reading, in part,
`Thank you for offering to provide the Falun Gong with financial
assistance...'
;}}}
--
`If you believe in strong AI, then death is no longer a mystery,
but merely a lack of adequate backups.' --- Steven McDougall
Re: Blocking all of China
Posted by jdow <jd...@earthlink.net>.
From: "John Andersen" <js...@pen.homeip.net>
> On Thursday 10 June 2004 07:26, Matt Kettler wrote:
> > It's not like there's one "blackholes.us" query that you use and it just
> > lists every IP. You query "verio.blackholes.us" and it tells you if the
IP
> > belongs to verio.
> >
> > It's hard to understand why this could be confusing to anyone.
>
> After stateing that so well, you ratteled on for another dozen paragraphs
> based on the premis that the OP suggested to use blackholes.us.
>
> He suggested china.blackholes.us.
> It's hard to understand why this could be confusing to anyone.
Because there is a more time consuming but fun approach to the Chinese
problem. If the address for a message source or relay point happens to
fall in China (not Taiwan or Korean) you harvest the address and send
back to that address an official looking invoice with a thank you for
your order of 100,000 copies if the Feng Sui Handbook.
I have heard this is remarkably effective.
{^_-}
Re: Blocking all of China
Posted by Greg Kopp <gk...@gregkopp.com>.
And you sir, were under the impression that I was under the impression
of making the impression ... oh whatever.
Not being the super-detailed person some would like us all to be, I was
merely pointing out that blackholes.us lists ENTIRE IP address ranges
and not ONLY those of known spammers.
I'm certain I wasn't clear and may have strayed too far from what I
meant to impress upon the impressionable people on this very impressive
list. :-)
Greg
Matt Kettler wrote:
> At 03:38 PM 6/10/2004, John Andersen wrote:
>
>> > It's hard to understand why this could be confusing to anyone.
>>
>> After stateing that so well, you ratteled on for another dozen paragraphs
>> based on the premis that the OP suggested to use blackholes.us.
>
>
> No. I rattled on under the premise that Greg Kopp, who is not the OP,
> but the person I replied to, was under the misunderstanding that by
> using blackholes.us, you'd wind up blocking whole ISPs at the whim of
> the blackholes.us maintainer.
>
>
>> He suggested china.blackholes.us.
>> It's hard to understand why this could be confusing to anyone.
>
>
> I'm aware that's what the OP suggested, but that was not the context of
> the message I replied to. I suppose it was confusing to you because you
> didn't read the bits I was quoting from Greg closely enough, such as
> this piece
>
> ">The maintainer has been known to arbitrarily list every single IP
> address belonging to some major ISPs because of past abuses."
>
> Which is the primary point raised by Greg I was responding to.
>
>
>
>
>
>
Re: Blocking all of China
Posted by Matt Kettler <mk...@evi-inc.com>.
At 03:38 PM 6/10/2004, John Andersen wrote:
> > It's hard to understand why this could be confusing to anyone.
>
>After stateing that so well, you ratteled on for another dozen paragraphs
>based on the premis that the OP suggested to use blackholes.us.
No. I rattled on under the premise that Greg Kopp, who is not the OP, but
the person I replied to, was under the misunderstanding that by using
blackholes.us, you'd wind up blocking whole ISPs at the whim of the
blackholes.us maintainer.
>He suggested china.blackholes.us.
>It's hard to understand why this could be confusing to anyone.
I'm aware that's what the OP suggested, but that was not the context of the
message I replied to. I suppose it was confusing to you because you didn't
read the bits I was quoting from Greg closely enough, such as this piece
">The maintainer has been known to arbitrarily list every single IP address
belonging to some major ISPs because of past abuses."
Which is the primary point raised by Greg I was responding to.
Re: Blocking all of China
Posted by John Andersen <js...@pen.homeip.net>.
On Thursday 10 June 2004 07:26, Matt Kettler wrote:
> It's not like there's one "blackholes.us" query that you use and it just
> lists every IP. You query "verio.blackholes.us" and it tells you if the IP
> belongs to verio.
>
> It's hard to understand why this could be confusing to anyone.
After stateing that so well, you ratteled on for another dozen paragraphs
based on the premis that the OP suggested to use blackholes.us.
He suggested china.blackholes.us.
It's hard to understand why this could be confusing to anyone.
--
_____________________________________
John Andersen
Re: Blocking all of China
Posted by Matt Kettler <mk...@comcast.net>.
At 09:23 AM 6/10/04 -0400, Greg Kopp wrote:
>IMHO, I would not use blackholes.us in a business environment. If it's for
>your own use and you don't mind people you know getting rejected mail,
>then fine.
>
>But if it is your intention to actually do business with people, and to
>have them send you e-mail, I would stay away from it.
Hmm, I use it in a business environment every day. However, I use it with
SpamAssassin rules to add small amounts of points. I'm also intelligent
about which of his lists I choose to use.
I tend to agree with you in that arbitrary use of blackholes.us is unwise,
however if you truly understand what it is, and how it works, you can use
it properly.
>The maintainer has been known to arbitrarily list every single IP address
>belonging to some major ISPs because of past abuses.
True, but he also lists them in their own separate blacklists. And it's
also the purpose of those lists to have the IPs of those ISPs in them.
It's not like there's one "blackholes.us" query that you use and it just
lists every IP. You query "verio.blackholes.us" and it tells you if the IP
belongs to verio.
It's hard to understand why this could be confusing to anyone.
Blackholes.us isn't a "abusers" list per se.. It's a factual information
listing. This IP routes to country xxx or to ISP yyy. Yes, most of the ISP
and country lists are created because of spam problems, but the nature of
the list itself is to be a blanket.
>This is not an entirely bad practice. However, personaly experience has
>shown me that small businesses and even some larger businesses are not
>going to switch ISPs because they can't send YOU mail or because thier IP
>address is listed in blackholes.us because 100 years ago a few of those
>IPs were open relays.
True, which is why I wouldn't advise using any of these lists as block
critera.
However, that ISP's tendency to have open relays 100 years ago resulted in
the creation of a list for that ISP, true.
However, the IPs that ISP uses are still the IPs that the ISP uses. That
fact doesn't change (although the exact IP blocks might). And the fact that
the IP belongs to a given ISP is the criteria for why it's in the list.
For example, I don't see why verio hosted IP addresses should be removed
from verio.blackholes.us. To do so would be a contradiction in fact.
However, I will agree that anyone who just arbitrarily grabs all the
blackholes.us lists and uses them as bounce criteria on their MTA is quite
frankly STUPID. Blackoles.us DOES blacklist entire ISPs and countries,
because that's it' purpose, and you definitely need to understand that
before applying their lists to your systems.
My own usage consists of giving 1.0-2.5 points for being listed in the IP
ranges of certain countries my company has no business with and is unlikely
to ever have business with.
This is a relatively sensible judicious use of blackholes.us in a business
environment. I'm not using it as rejection system, nor are any of them
sufficient to cause a message to be tagged as spam, but they are sufficient
for my copy of SA to effectively have a lower spam threshold for emails
coming from those countries.
And I do get some nonspam hits on the blackholes lists I'm using.
Occasionaly someone from one of the countries posts a message to one of the
mailing lists I subscribe to. However, I have yet to have them cause a
false positive. They've contributed to a FP or two on this list, but the
messages always had spam quotes which also contributed more points than any
normal message would have.
However, they've saved me from quite a handful of emails that would have
been FN.
>The maintainer has also been rumored to block major ISPs simply because he
>doesn't like them.
Well, he creates lists because he doesn't like them, or there's a community
outcry towards them. But he continues to list them because time does not
change the fact that ISP X is still ISP X.
Re: Blocking all of China
Posted by Jeff Chan <je...@surbl.org>.
On Thursday, June 10, 2004, 12:34:24 PM, John Andersen wrote:
> On Thursday 10 June 2004 05:23, Greg Kopp wrote:
>> IMHO, I would not use blackholes.us in a business environment. If it's
>> for your own use and you don't mind people you know getting rejected
>> mail, then fine.
>>
>> But if it is your intention to actually do business with people, and to
>> have them send you e-mail, I would stay away from it.
> The suggestion was (and I quote):
> You could use an RBL like china.blackholes.us in SpamAssassin
> or your MTA (Exim)."
To throw some saurkraut on the fire, that suggestion was mine,
not the original poster's...
Jeff C. the attributee... LOL!
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Blocking all of China
Posted by Bob Apthorpe <ap...@cynistar.net>.
Hi,
On Thu, 10 Jun 2004 11:34:24 -0800 John Andersen <js...@pen.homeip.net> wrote:
> On Thursday 10 June 2004 05:23, Greg Kopp wrote:
> > IMHO, I would not use blackholes.us in a business environment. If it's
> > for your own use and you don't mind people you know getting rejected
> > mail, then fine.
> >
> > But if it is your intention to actually do business with people, and to
> > have them send you e-mail, I would stay away from it.
>
> The suggestion was (and I quote):
> You could use an RBL like china.blackholes.us in SpamAssassin
> or your MTA (Exim)."
>
> Presumably the china list does not contain comcast, and vise-versa.
Maybe. You'd have to sort out how blackholes.us determines what's meant
by 'chinese' or 'comcast' (e.g. are the Chinese IP addresses allocated
to CNNIC or are they physically in China? Does the comcast list include
only ARIN allocations to Comcast? Are there addresses allocated by CNNIC
to Comcast?) This can get very confusing fast. The point is, you need to
understand the listing policy before you use them.
> How, then, would sould someone running a Tax Accountancy in East
> Midlands Texax suffer from blocking all of China?
Practically (and this is where people get offended) it might not. If
you're responsible for that mail system, and the users understand and
agree with that policy, it's nobody's business but your own what systems
you accept mail from, provided you accept mail for abuse, postmaster,
etc. per RFC2142 (see http://www.faqs.org/rfcs/rfc2142.html)
> I have most of Korea blocked. I can't read a word of Korean.
Conversely, I've received unsolicited but professionally useful (and
welcome) personal mail from an engineer in Poland based on a paper on
risk assessment I wrote a few years ago. I know about 12 words in
Polish, all of them related to food, courtesy of my grandmother (may she
rest in peace.) Life may surprise you.
As usual, your system, your rules. :)
-- Bob
RE: Blocking all of China
Posted by "Colin A. Bartlett" <sp...@colinabartlett.com>.
David B Funk Sent: Thursday, June 10, 2004 4:09 PM
> Not everything comming out of China/Korea is in Chinese/Korean.
>
> I've seen a fair amount of spam (in English) which had domain names (both
in
> the mail headers and in URLs in the body) that are registered to US
companies
> but are being sent from Chinese ISPs.
Isn't that the point!? Since he has no legitimate business in China, he
could block all Chinese ISPs, thereby cutting back on spam. If the guy wants
to block China I say go for it. He's the only one who will take the heat for
it if some legit mail is dropped.
I would never do that here because we are a service proider and I have no
idea what business dealings my clients have. Actually, to the contrary, I
know that one of my clients does indeed use manufacturers in China.
cheers,
Colin
Colin A. Bartlett
Kinetic Web Solutions
www.kineticweb.biz
Re: Blocking all of China
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Thu, 10 Jun 2004, John Andersen wrote:
> How, then, would sould someone running a Tax Accountancy in East
> Midlands Texax suffer from blocking all of China?
>
> I have most of Korea blocked. I can't read a word of Korean.
Not everything comming out of China/Korea is in Chinese/Korean.
In this globalized economy rife with outsourcing, it's not at all
impossible that the ISP that your Texas Taxman contracts to provide
him website/mailing lists hosting may actually be located in China.
I've seen a fair amount of spam (in English) which had domain names
(both in the mail headers and in URLs in the body) that are registered
to US companies but are being sent from Chinese ISPs.
Bulk hosting is now international business. I've seen Russian spam
being sent from Chinese ISPs, English spam hosted from Russia, etc.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Blocking all of China
Posted by John Andersen <js...@pen.homeip.net>.
On Thursday 10 June 2004 05:23, Greg Kopp wrote:
> IMHO, I would not use blackholes.us in a business environment. If it's
> for your own use and you don't mind people you know getting rejected
> mail, then fine.
>
> But if it is your intention to actually do business with people, and to
> have them send you e-mail, I would stay away from it.
The suggestion was (and I quote):
You could use an RBL like china.blackholes.us in SpamAssassin
or your MTA (Exim)."
Presumably the china list does not contain comcast, and vise-versa.
How, then, would sould someone running a Tax Accountancy in East
Midlands Texax suffer from blocking all of China?
I have most of Korea blocked. I can't read a word of Korean.
--
_____________________________________
John Andersen
Re: Blocking all of China
Posted by Jeff Chan <je...@surbl.org>.
On Thursday, June 10, 2004, 6:23:18 AM, Greg Kopp wrote:
> IMHO, I would not use blackholes.us in a business environment. If it's
> for your own use and you don't mind people you know getting rejected
> mail, then fine.
> But if it is your intention to actually do business with people, and to
> have them send you e-mail, I would stay away from it.
FWIW I feel the same way. blackholes.us may be ok for personal
use, but almost never for business use.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Blocking all of China
Posted by Dimitrios <se...@altered.com>.
On Thu, 10 Jun 2004 11:10:59 -0400 "Greg Kopp" <gk...@gregkopp.com> wrote:
> I'm not saying he is doing anything wrong and to a certain degree
> applaud his efforts. I just wanted the original poster to be aware.
well, this guy definetly has some attitute ;)
i haven't used his lists, but now you've raised my curiosity so i'll take a look.
Re: Blocking all of China
Posted by Greg Kopp <gk...@gregkopp.com>.
Bob,
Very will put. The problem comes with stated policies and the like. Here
is an excerpt:
"If you are listed, you will not be removed from these lists. If your
mail is being rejected, contact your ISP. If you don't understand what
this site is or why you are listed, please contact your ISP before
sending mail to the administrator of this site.
Legal threats will be made public. In fact, no email sent to this domain
is confidential without prior arrangement and may be published as I see fit.
Please delete any "legaleeze" or copyright footers from your mail before
sending it. You may not send any material to blackholes.us for which
there is a copyright claim.
Depending on how much time I have to spare, I may not reply to you."
And
"Blackholes.us does not list spammers, spam supporters or vulnerable
hosts at the present time. These lists are meant to contain all known
networks assigned or allocated to the respective provider or
organizations within the respective country. Lists are created for
research purposes, primarily, and are made public for any use others see
fit."
He does make good on his claim that he will make e-mails sent to him
public. There are several on the site.
My point is, he has no real policies other than - "If you're listed, too
bad, call your ISP." And if you read between the lines: "Change ISPs." I
am assuming he does this on his own and there is no "organization"
behind it. Services like MAPS and SpamCop at least go through a
procedure BEFORE listing someone and have stated procedures to be
removed. I personally don't agree with throwing the baby out with the
bathwater, so to speak. If it wasn;t for the fact that we have a couple
clients that do business in China, I would be using china.blackholes.us. :-)
I'm not saying he is doing anything wrong and to a certain degree
applaud his efforts. I just wanted the original poster to be aware.
Bob Apthorpe wrote:
> Hi,
>
> On Thu, 10 Jun 2004 09:23:18 -0400 Greg Kopp <gk...@gregkopp.com> wrote:
>
>
>>IMHO, I would not use blackholes.us in a business environment. If it's
>>for your own use and you don't mind people you know getting rejected
>>mail, then fine.
>
>
> The .blackholes.us zones list large swaths of network space which is
> what you'd expect of a zone that listed all of, say, China.
>
>
>>But if it is your intention to actually do business with people, and to
>>have them send you e-mail, I would stay away from it.
>
>
> At least know what you're getting into. One might be able to whitelist
> specific contacts and blackhole the rest, depending on who one intends
> to correspond with.
>
>
>>The maintainer has been known to arbitrarily list every single IP
>>address belonging to some major ISPs because of past abuses.
>
>
> I don't believe it's arbitrary and it may have nothing to do with abuse.
> If the intent is to list all known network space of Comcast or Cogentco
> for example, it makes perfect sense. Now, why he chooses to create a
> zonefile for Comcast vs XS4ALL or Chello may be due to abuse; I don't
> know. What's more important is that the listings are accurate.
>
>
>>This is not an entirely bad practice. However, personaly experience has
>>shown me that small businesses and even some larger businesses are not
>>going to switch ISPs because they can't send YOU mail or because thier
>>IP address is listed in blackholes.us because 100 years ago a few of
>>those IPs were open relays.
>
>
> If you're trying to change people's behavior, using a DNSBL is probably
> not the way to do it. However, if enough people reject traffic such that
> a particular organization (country, ISP, etc.) finds itself isolated
> into a virtual intranet, there's a possibility they'll change, if the
> value of connecting to those that block them exceeds the cost of
> change. From a network operator's viewpoint, one has to determine if the
> benefit of accepting traffic from Cogentco, Chinanet, or Comcast (for
> example) is worth the cost (in terms of abuse and security incidents,
> etc.) That is, one should block to preserve the limited resources you're
> responsible for providing with no expecatation that anyone's behavior
> will change as a result.
>
>
>>The maintainer has also been rumored to block major ISPs simply because
>>he doesn't like them.
>
>
> What mail he accepts or rejects is his business. Our only concern should
> be the accuracy of the zone files he publishes.
>
> In order to use DNSBLs effectively, you need to clearly understand the
> blacklist operator's listing policy as well as your own policy, and have
> a reasonable belief that the blacklist operator will follow their stated
> policy.
>
> I haven't heard of blackholes.us deviating from their stated policies;
> then again, I don't use their blacklists. If I did, I'd probably use
> them within SA rather than to block at the MTA or firewall level.
>
> Caveat utilitor,
>
> -- Bob
Re: sa-stats.pl and amavisd-new
Posted by Andy <an...@stronzo.d2g.com>.
Hello Matt,
I am using amavis-stats, which gives me some very nice graphs of spam,
non-spam, viruses, blocked etc. mails.
If you want to look:
https://stronzo.d2g.com/amavis-stats
--
Andy
Hi, I am looking for a script that will tell me the number of hams/spams and
their average scores. When I run sa-stats.pl it reports that no messages
have been scanned. It looks like the script is expecting to find "clean
message" or "identified spam" in the the maillog...
Is there a version of sa-stats.pl that works with the maillog generated by
amavisd-new/postfix?
Thanks,
-- Matt
Re: Blocking all of China
Posted by Bob Apthorpe <ap...@cynistar.net>.
Hi,
On Thu, 10 Jun 2004 09:23:18 -0400 Greg Kopp <gk...@gregkopp.com> wrote:
> IMHO, I would not use blackholes.us in a business environment. If it's
> for your own use and you don't mind people you know getting rejected
> mail, then fine.
The .blackholes.us zones list large swaths of network space which is
what you'd expect of a zone that listed all of, say, China.
> But if it is your intention to actually do business with people, and to
> have them send you e-mail, I would stay away from it.
At least know what you're getting into. One might be able to whitelist
specific contacts and blackhole the rest, depending on who one intends
to correspond with.
> The maintainer has been known to arbitrarily list every single IP
> address belonging to some major ISPs because of past abuses.
I don't believe it's arbitrary and it may have nothing to do with abuse.
If the intent is to list all known network space of Comcast or Cogentco
for example, it makes perfect sense. Now, why he chooses to create a
zonefile for Comcast vs XS4ALL or Chello may be due to abuse; I don't
know. What's more important is that the listings are accurate.
> This is not an entirely bad practice. However, personaly experience has
> shown me that small businesses and even some larger businesses are not
> going to switch ISPs because they can't send YOU mail or because thier
> IP address is listed in blackholes.us because 100 years ago a few of
> those IPs were open relays.
If you're trying to change people's behavior, using a DNSBL is probably
not the way to do it. However, if enough people reject traffic such that
a particular organization (country, ISP, etc.) finds itself isolated
into a virtual intranet, there's a possibility they'll change, if the
value of connecting to those that block them exceeds the cost of
change. From a network operator's viewpoint, one has to determine if the
benefit of accepting traffic from Cogentco, Chinanet, or Comcast (for
example) is worth the cost (in terms of abuse and security incidents,
etc.) That is, one should block to preserve the limited resources you're
responsible for providing with no expecatation that anyone's behavior
will change as a result.
> The maintainer has also been rumored to block major ISPs simply because
> he doesn't like them.
What mail he accepts or rejects is his business. Our only concern should
be the accuracy of the zone files he publishes.
In order to use DNSBLs effectively, you need to clearly understand the
blacklist operator's listing policy as well as your own policy, and have
a reasonable belief that the blacklist operator will follow their stated
policy.
I haven't heard of blackholes.us deviating from their stated policies;
then again, I don't use their blacklists. If I did, I'd probably use
them within SA rather than to block at the MTA or firewall level.
Caveat utilitor,
-- Bob
Re: Blocking all of China
Posted by Greg Kopp <gk...@gregkopp.com>.
IMHO, I would not use blackholes.us in a business environment. If it's
for your own use and you don't mind people you know getting rejected
mail, then fine.
But if it is your intention to actually do business with people, and to
have them send you e-mail, I would stay away from it.
The maintainer has been known to arbitrarily list every single IP
address belonging to some major ISPs because of past abuses.
This is not an entirely bad practice. However, personaly experience has
shown me that small businesses and even some larger businesses are not
going to switch ISPs because they can't send YOU mail or because thier
IP address is listed in blackholes.us because 100 years ago a few of
those IPs were open relays.
The maintainer has also been rumored to block major ISPs simply because
he doesn't like them.
Greg
Jeff Chan wrote:
> On Thursday, June 10, 2004, 5:38:25 AM, Hirotaka Fox wrote:
>
>>/Also, apparently 70 percent of spam is sent from China by American spam
>>outfits who in turn have hosting arrangements with Chinese ISPs."/
>
>
>>Does anyone have a SpamAssassin related way to block all of China? I
>>read things like this on SpamHaus and just want to block all of China
>>from sending my company mail. We don't have any business dealings in China.
>
>
> You could use an RBL like china.blackholes.us in SpamAssassin
> or your MTA (Exim).
>
> http://www.blackholes.us/
>
> If you truly want to drop them on the floor and never see them,
> doing it in the MTA is far more efficient than doing it in SA.
> However doing it in SA lets you score it rather than instantly
> discarding which the MTA does.
>
> Jeff C.
Re: Blocking all of China
Posted by Jeff Chan <je...@surbl.org>.
On Thursday, June 10, 2004, 5:38:25 AM, Hirotaka Fox wrote:
> /Also, apparently 70 percent of spam is sent from China by American spam
> outfits who in turn have hosting arrangements with Chinese ISPs."/
> Does anyone have a SpamAssassin related way to block all of China? I
> read things like this on SpamHaus and just want to block all of China
> from sending my company mail. We don't have any business dealings in China.
You could use an RBL like china.blackholes.us in SpamAssassin
or your MTA (Exim).
http://www.blackholes.us/
If you truly want to drop them on the floor and never see them,
doing it in the MTA is far more efficient than doing it in SA.
However doing it in SA lets you score it rather than instantly
discarding which the MTA does.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/