MX Messaging Resources

Welcome to MX Messaging Resources Sign in | Join | Help
in Search

MX Watch

SBC Global and Comcast Users Having Blacklist Issues

In the past several days, we have seen a large number of both SBC Global and Comcast users with blacklist problems. Predominately, the host IP Addresses are showing up on the Sorbs Dynamic User and Host List (DUHL) blacklist. By extension, users are seeing bounce back messages indicating that their emails are blocked because their IP Address is on a blacklist. We have every reason to believe that these particular blocks are false positives stemming from Net Blocking. Net Blocking is a shotgun approach to blacklisting, where a large range of IP Addresses are blocked, presumably because they are near a known spam IP. Unfortunately, for the people we have spoken with, they are at the mercy of their respective ISP/Email Host to get the problem resolved...which is a frustrating exercise according to most. Incidentally, we have also seen a large number of emails blocked by the blacklists that SBC uses to curb spam...probably no connection, but interesting.

The only other reportable trend is a large number of Level 1 blocks from an obscure German blacklist- UCEProtect. A UCEProtect Level 1 block blocks a single IP addresses that have "either wrong or missing or generic reverse dns (PTR), or dialups, open proxy's, open relays, or which are using abusive techniques or which assigned to well known spammers." However, most of the people on the UCEProtect list that we spoke with did not meet these conditions. This leads us into an interesting discussion topic:

False positives are a significant problem with many widely used blacklists, which is just one reason why a strong inbound/outbound email filtering solution is a superior anti-spam tool.

Published Wednesday, December 20, 2006 1:18 AM by admin

Comments

 

insight.policysup@gmail.com said:

There have been a parade of various large ISPs

who's outbound MTAs have been listed by SORBS based on single (or single

digit numbers of) spamtrap hits for weeks/months - with the measurable

effect (observed outbound rejection rate) now apparently rapidly

approaching ZERO.

SORBS' ISP "userbase" seems to approach 100% overlap with entities rejecting

at the front door (SMTP connect time) due to SPEWS L2, BLARS or five-ten-sg.com

listings: e.g.: a group that can be conveniently ignored and is not presently

part of a very wide fraction of the Internet.

SORBS is not alone with this, but sharing space in that very same

DNSBL  with:

- MAPS/RBL(QIL)

- bl.spamcannibal.org

- tqmcube.com

- Symantec/Brightmail ZBL

As far as usable DNSBLs is concerned, it's literally down to

SH SBL, CBL/XBL, the upcoming SH PBL, list.dsbl.org and NJABL at this point, plus

any derivatives based on these, like Top-Spew.

I think we can say that SORBS is fast becoming if not already there, a list that if used "by it self" will cause nothing but issues for customer and companies.

SORBS themselves say that people should use a list such as  DNSWL list that  people use on top of SORBS.

This seems kind of funny to me, when they could just as easily apply DNSWL to the SORBS listing  process, and solve the problem in one spot, instead of forcing

hundreds of others to all fix it for them.

Bottom line is SORBS should never be the end all only thing used.

January 15, 2007 3:23 PM
 

insight.policysup@gmail.com said:

Sorry Forgot to put who I was.

January 15, 2007 3:25 PM
 

insight.policysup@gmail.com said:

Still didn't get listed

Sherman R. Hand

Manager, Data and Network Security, Fraud and Abuse

Insight Communications

10200 Linn Station Road

Suite 125

Louisville, KY 40223

There have been a parade of various large ISPs

who's outbound MTAs have been listed by SORBS based on single (or single

digit numbers of) spamtrap hits for weeks/months - with the measurable

effect (observed outbound rejection rate) now apparently rapidly

approaching ZERO.

SORBS' ISP "userbase" seems to approach 100% overlap with entities rejecting

at the front door (SMTP connect time) due to SPEWS L2, BLARS or five-ten-sg.com

listings: e.g.: a group that can be conveniently ignored and is not presently

part of a very wide fraction of the Internet.

SORBS is not alone with this, but sharing space in that very same

DNSBL  with:

- MAPS/RBL(QIL)

- bl.spamcannibal.org

- tqmcube.com

- Symantec/Brightmail ZBL

As far as usable DNSBLs is concerned, it's literally down to

SH SBL, CBL/XBL, the upcoming SH PBL, list.dsbl.org and NJABL at this point, plus

any derivatives based on these, like Top-Spew.

I think we can say that SORBS is fast becoming if not already there, a list that if used "by it self" will cause nothing but issues for customer and companies.

SORBS themselves say that people should use a list such as  DNSWL list that  people use on top of SORBS.

This seems kind of funny to me, when they could just as easily apply DNSWL to the SORBS listing  process, and solve the problem in one spot, instead of forcing

hundreds of others to all fix it for them.

Bottom line is SORBS should never be the end all only thing used.

January 15, 2007 3:27 PM
Anonymous comments are disabled