ietf-asrg
[Top] [All Lists]

Re: [Asrg] Lets Fix Mailing Lists

2003-03-09 12:11:12
At 8:22 PM -0700 3/8/03, Vernon Schryver wrote:
If you believe as I do that the reason genuine mail forgery (as opposed
to using a legitimately owned Hotmail dropbox) fell off dramatically
a year or three ago is related to the laws criminalizing header forger,
then you don't need any crypto.  Simply have the MTU or MTU choose
and record a suitable RFC 2369 List-whatever header from the confirmation
message.

I don't see that forgery itself has fallen off. We detect most of our spam using forgery detection. However it does seem that forgery of random commercial domains has fallen off. I think they tend to use ISP addresses more, but I haven't done a really good analysis. A quick scan of my 20,000 or so spams shows 4000 unique domains in the from lines. The top ones are:

+---------------------------------+------+
| domain                          | cnt  |
+---------------------------------+------+
| yahoo.com                       | 1740 |
| hotmail.com                     | 1496 |
| aol.com                         |  973 |
| msn.com                         |  448 |
| Mail.com                        |  214 |
| recessionspecials.com           |  209 |
| lycos.com                       |  180 |
|                                 |  178 |
| excite.com                      |  170 |
| free-gift-offers.com            |  168 |
| juno.com                        |  148 |
| bluelightoffers.COM             |  145 |
| email.com                       |  125 |
| clickformail.com                |  122 |
| helpfuloffers.com               |  121 |
| 163.com                         |  118 |
| GreatDealsDepot.net             |  117 |
| earthlink.net                   |  108 |

That's all either ISPs or known spam domains.

On a personal note, I know that spam using @somewhere.com used to be a major problem (weekly blowbacks), but has now dropped off to almost nothing. On the other hand, that may be because people started blocking the domain.

Then too. There were a couple successful lawsuits against spammers by companies whose reputation had been damaged. They may have decided to keep the forgeries to domains where that argument wouldn't result in huge monetary claims.

At 8:43 PM -0700 3/8/03, Vernon Schryver wrote:
often using addresses from the target list.  However, they're still
not doing blatent forging as they were a few years ago.

The forging is there. It's more subtle. At least 90% of the spam we are filtering has something forged in the header, and I don't mean From doesn't match sending IP--we don't count that--that's legit. I don't really want to go into the details on-list. But it is there.
--
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg