Post by: RHPConsult on July 08, 2003, 02:01:21 PM
Beginning yesterday, and this morning, in messages to a fairly near neighbor, and to Sir Pendragon (who resides far, far across the fruited plain), AOL began dumping/bouncing e-messages from my SBC/DSL connection.
Back came complex bureaucratic "e-descriptions" which, not at all incidentally, failed uttterly as an "explanation" for why they/it are/is doing so.
In a subsequent conversation with SBC's tech folks, I learned that AOL began doing this to the entire SBC domain sometime last week, when I was offline much of the time. I know of no way, short of writing to the Chairman of the Board (which I most certainly will do), of effectively protesting this larceny.
So here I am again, lumped indiscriminately with what AOL terms "notorious spammers". Well, that certainly makes sense! Back to the hoary principle, 'Tis far, far better that 10,000 innocents suffer than one guilty man go free. Ah, bureaucrats.
I've asked my neighbor-e-correspondent, and Harv when he's free, to inquire of the nitwits presumably in charge at AOL to determine when they will/may begin to show some minimal discernment and have a filter that differentiates between someone who sends 5-8 messages a day to their hallowed ISP, in contrast to 5,000,000.
SBC has one. AOL doesn't care, I assume.
Does anyone know of any web sites now established where it might be possible to declare one's feelings - - for the world to see - - about an enterprise that collects monies for services not rendered?
Of course, that's nothing new to AOL. Several years ago I had to write a number of highly enraged letters to get them to stop billing me . . . it was around 90-120 days later, as I recall . . . after, in wiritng, I had canceled their execrable "service".
Post by: sandbox on July 09, 2003, 03:07:28 AM
they make good coasters, and the little tin boxes almost had a useful life in the tools shed!
http://www.aolsucks.org/
which turns into
http://www.aolwatch.org/aolwatch9b.htm
this is funny
http://www.megacity.org/blog/archives/000201.php
Post by: RHPConsult on July 09, 2003, 04:36:42 PM
How'd you find these?
THE GOOD NEWS: AOL, apparently, tweaked its filters today. For however long, who knows. We, the innocent bystanders, are grateful for whatever.
Post by: Bill on July 09, 2003, 04:58:02 PM
Post by: jepinto on July 09, 2003, 10:17:08 PM
SB
Post by: Paddy on July 09, 2003, 11:10:02 PM
And another one:
http://www.rachellucas.com/archives/000634.html#000634
http://www.jokesandhumor.com/jokes/268.htmlAOL Subscriber Defections... - not a funny one, but interesting. Just hope this won't result in yet another flood of free AOL disks though...
Post by: sandbox on July 10, 2003, 12:08:17 AM
These guys have money to burn, I haven’t had AOL since Sept. 1998 and whenever they do a mailout I get 3, 1 for the business, for Jane, and for me. I flip the CD’s over and use them for coasters so it’s not a total loss, and if I hang around on this planet long enough I may find another use for them!
Dick, I know the the word “sucks” is sort-of a crude word, but, whenever you find something that you don’t like type it into google adding “sucks” to it, more than likely you’ll find a webpage dedicated to the abolishment of the product, service, or official.
Post by: pendragon on July 10, 2003, 04:58:10 AM
Like other (but certainly not all) ISPs, AOL blocks spam partly by identifying mail servers that are sending and/or (even) relaying spam; and then blocks their IP addresses. Every now and then, the blocked server ends up belonging to someone legit. Maybe SBC left a server open (a common practice, but one all deny for obvious reasons) and was victimized by a spammer. Or, maybe AOL just misidentified the offending server.
If SBC left a server open and thus were the genesis of or accomodated the sending of spam, then I have no problem with AOL blocking them. If AOL wrongfully accused SBC, then shame on them.
Harv
Post by: RHPConsult on July 10, 2003, 11:49:33 AM
The site found by Paddy . . .
Here
is just too, too characteristic of others I have read over the years (and years, and years) not to evidence that it is a corporate policy to lie, in furtherance of stealing, as long as they can get away with it.
For shame, jerks.
Either that, or they have contracted with groups providing "member services" (Ho, Ho, Ho!) who are 1) either being rewarded for bad behavior, or 2) not managed by corporate, or most likely 3) both
WARNING: Don't even try to defend AOL to this injured party (who is also known to carry some kinds of grudges, as does Rachell., above), excepting you, Harv, since you're a really good guy!
B) 
Post by: sandbox on July 10, 2003, 12:32:56 PM
QUOTE
“Their crappiness is immutable and eternal. Plus it's fun to bitch so don't rain on my bitchy parade.”
Post by: taliesin on July 10, 2003, 02:35:53 PM
Post by: MrsLop on July 10, 2003, 03:56:18 PM
I thought that you might want to know that earthlink will be/is doing something similar in an effort to reduce "spam".
It is becoming an epidemic among ISP's.
My husband sent me an email concerning a list he is on, with the new policy.
I'll send it to you.
Myrna
Post by: tacit on July 10, 2003, 05:34:13 PM
You're a "mushroom"--an innocent bystander caught in the crossfire of a war that does not involve you.
To understand what happened, and why you ended up getting blocked by AOL (and by other ISPs--you just didn't know it), you have to know the background of the war.
SBC (and its affiliates and subsidiaries--PacBell, prodigy, Cingular, and so on) hasn't had a terribly good couple of years. SBC's gross income for 2002 fell by about 5% over 2001, in spite of the fact that Cingular's revenue is up. This has caused many analysts to get a bit gloomy on SBC.
Typically, when most ISPs begin to show slipping revenue, one of the first things they do is trim (or eliminate altogether) their abuse team--the people they pay to read spam reports and cancel spammers' accounts. often, these companies will begin covertly supplying services to spammers as well, because spammers are willing to pay a very high premium to ISPs which will permit them to spam.
SBC has done both.
Starting early this year, SBC began a very quiet policy of permitting large-scale spammers to use SBC mail servers in exchange for service premiums. This has been documented on a number of Web sites here, here, and here (an updated, real-time list of known spammers working from SBC domains).
In fact, SBC has actually hired known spammers to advertise their services (one such sample spam is here, with the trace showing its source to be a notorious spam organization here.
If you read the UseNet newsgroup news.admin.net-abuse, you'll see so many people complaining about floods of UseNet spam originating from SBC sources, and so many reports of abuse complaints by system administrators and ISPs being ignored by SBC, that there is a very real possibility SBC may face what's called a "UseNet Death Penalty." A Usenet Death penalty is an extreme action taken against an ISP that is so lenient on spammers, the entire UseNet backbone refuses to accept any UseNet message from that ISP whatsoever--effectively cutting off all newsgroup access for every subscriber who uses that ISP.
So it isn't just AOL. SBC has a very, very serious problem on its hands--it deliberately and knowingly harbors so many aggressive spammers that much of the Internet community is beginning to rise up against it.
I sincerely hope that SBC realizes that the short-term gains of taking a spammer's money are not worth the long-term losses of a backlash against the entire ISP. But until they do, I think you can expect to continue having problems.
Post by: RHPConsult on July 10, 2003, 08:23:51 PM
I do appreciate it. You do that so well, and fortunately, often for TS. Thank you very much.
Now, if someone would start a website on SBC's outrageous practices, maybe they could be shamed into treading the straight and narrow . . . as I thought they had been doing.
There's more than a small body of opinion that the discredited editors of the NY Times would not have resigned following the recent debacle (on their watch!, as they say) had there not been several web sites spontaneously established that told the truth of the staff's towering unhappiness. Finally, even the publisher couldn't ignore them.
I wonder if an outcry about SBC's policies/practices might enhance at least the possibility of change?
Oh, for the good old days, when Pacific Bell was a jewel of a phone company.
BTW, this certainly doesn't encourage me to think AOL is a well governed/managed enterprize.
A pox on both their houses.
Yers truly,
The Mushroom (Innocent Variety)
Post by: Bill on July 10, 2003, 08:38:21 PM
Well written!
Post by: ljocampo on July 27, 2003, 11:05:58 PM
I have had all these adventures with AOL back when they were in their infancy. I guess they never grew up.
Thank the Gods, AOL now doesn't know I exist. And I love it that way! 
Post by: kimmer on July 28, 2003, 10:59:40 AM
However -- the majority of the filthy spam that I receive comes from AOL! So take that mr. corporate giant.
When we were with earthlink, it was worse. Even with the spam filter thing on, I was downloading over 150 spam mails per day with each email address! When you are on dial-up, that's a long time spent download stuff to trash.
My nickels worth is that all of them are guilty, and the big boys are all out to take over the other big boys so that there is only one game left for the consumer to choose from - not that I'm cynical or anything. :-/
kimmer
Post by: krissel on July 28, 2003, 10:42:36 PM
One apparently successful spam filtering system is the one used by Yahoo mail. I used to get maybe 20-30 junk emails a day at my account there, but their SpamGuard has reduced it to perhaps 3 or 4 a day at most. I wish ATT would use it cause I get about 20 a day from them as well. Using PopMonitor does help. At least I don't have to download the garbage, just what I want.
Post by: Gregg on July 29, 2003, 08:32:12 AM
Post by: RHPConsult on July 29, 2003, 09:18:05 AM
QUOTE
As an sbc customer, I find myself blocked hither and thither on a reg. basis. That's why I paid for my mac.com address - it gets through when nothing else can
"Hither and thither" certainly describes my experience too, insofar as blocking is concerned . . . this week. I guess I should be grateful for small favors, i.e. it doesn't happen consistently
But I find myself confused (a not infrequent event). Even though you are using your Mac.com address (one of which I also have) aren't you still using SBC as your outgoing mail server? Or does opening Mac.com somehow overlay, so to speak, a different identity onto your message, not recognizable as a communication actually "initiated" through SBC?
You are reaching Mac.com via SBC are you not? I guess I thought the "blockers" could figure out the "sending mac" irrespective of the particular address? Hmmmm?
With respect to Earthlink's fabled Spaninator, or whatever, it's never shown me anything especially effective. I rely on Netscape/Mozilla's little learning engine to zap the pesky things out of the way when they arrive at my In-Box. It's seems to work quite nicely.
Post by: tacit on July 29, 2003, 03:58:50 PM
QUOTE(kimmer @ Jul 28 2003, 3:59 PM)
However -- the majority of the filthy spam that I receive comes from AOL! So take that mr. corporate giant.
No, it doesn't.
Let's say you get a piece of spam from "g1antpen1s@aol.com". Does that mean the spam came from AOL?
No. The From: address is forged. It is so easy to do, anyone can do it in under two minutes. If you like, i can send you an email that comes from; god@heaven.com or From: kimmer@techsurvivors.com or From: billg@microsoft.com or From: anything else I want. It's called "spoofing." All spammers do it.
Never, ever trust the From: address you see in any email! Just because it says From: someone@aol.com, that does not mean it came from AOL. AOL has very strict mail server control software that does an excellent job at stopping spammers.
The only way to tell where a message really came from is to look at the full headers. You will see a bunch of lines that start with "Received: from". After the "Received: from" will be information about the IP address and mail server the message came from.
Here is an example of a piece of spam I got that supposedly came from AOL. The headers say:
Received: from rly-xk04.mx.aol.com (rly-xk04.mail.aol.com [172.20.83.41]) by air-xk01.mail.aol.com (v95.1) with ESMTP id MAILINXK14-5953f26dcbf11f; Tue, 29 Jul 2003 16:45:44 -0400
Received: from compuserve.com (209-130-218-13.nas1.roc.ny.frontiernet.net [209.130.218.13]) by rly-xk04.mx.aol.com (v95.1) with ESMTP id MAILRELAYINXK49-5953f26dcbf11f; Tue, 29 Jul 2003 16:45:15 -0400
Date: Tue, 29 Jul 2003 19:47:35 +0000
From: 46IHEI0E63K3438E@aol.com
Subject: tT0Íîâèíêè è êëàññèêà ìèdîâîãî êèíî íà DVD!Tacitr21UfnGO
To: Tacitr <tacitr@aol.com>
References: <46IHEI0E63K3438E@aol.com>
In-Reply-To: <46IHEI0E63K3438E@aol.com>
You look at the LAST Received: from line. In this case it says:
Received: from compuserve.com (209-130-218-13.nas1.roc.ny.frontiernet.net [209.130.218.13]) by rly-xk04.mx.aol.com (v95.1) with ESMTP id MAILRELAYINXK49-5953f26dcbf11f
In this case, what it is telling you is that the computer the message came from had IP address 209.130.218.13.
IP address 209.130.218.13 is owned by an ISP called frontiernet.net, who in turn gets their service from Global Crossing. So even though the message says it was from 46IHEI0E63K3438E@aol.com, it was not. It actually came from a spammer who was using Global Crossing, not AOL.
Post by: kimmer on July 30, 2003, 03:00:00 PM
QUOTE(RHPConsult @ Jul 29 2003, 7:18 AM)
But I find myself confused (a not infrequent event). Even though you are using your Mac.com address (one of which I also have) aren't you still using SBC as your outgoing mail server? Or does opening Mac.com somehow overlay, so to speak, a different identity onto your message, not recognizable as a communication actually "initiated" through SBC?
You are reaching Mac.com via SBC are you not? I guess I thought the "blockers" could figure out the "sending mac" irrespective of the particular address? Hmmmm?
You are reaching Mac.com via SBC are you not? I guess I thought the "blockers" could figure out the "sending mac" irrespective of the particular address? Hmmmm?
This is the configuration I have set up in Eudora:
mail server: mail.mac.com
SMTP: mail.sbcglobal.net
I just sent myelf a note from and to my mac.com addy. Looking at the full headers, it clearly shows it was sent from sbc.
QUOTE
Received: from mac.com (smtpin11-en2 [10.13.10.81])
by ms11.mac.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003))
with ESMTP id <0HIU003WASJOBA@ms11.mac.com> for ***@mac.com; Wed,
30 Jul 2003 12:52:36 -0700 (PDT)
Received: from mta7.pltn13.pbi.net (mta7.pltn13.pbi.net [64.164.98.8])
by mac.com (Xserve/8.12.9/MantshX 2.0) with ESMTP id h6UJqYVp006444 for
<***@mac.com>; Wed, 30 Jul 2003 12:52:35 -0700 (PDT)
Received: from [192.168.123.167]
(adsl-66-122-61-89.dsl.sntc01.pacbell.net [66.122.61.89])
by mta7.pltn13.pbi.net (8.12.9/8.12.3) with ESMTP id h6UJqX94029810 for
<***@mac.com>; Wed, 30 Jul 2003 12:52:33 -0700 (PDT)
by ms11.mac.com (iPlanet Messaging Server 5.2 HotFix 1.17 (built Jun 23 2003))
with ESMTP id <0HIU003WASJOBA@ms11.mac.com> for ***@mac.com; Wed,
30 Jul 2003 12:52:36 -0700 (PDT)
Received: from mta7.pltn13.pbi.net (mta7.pltn13.pbi.net [64.164.98.8])
by mac.com (Xserve/8.12.9/MantshX 2.0) with ESMTP id h6UJqYVp006444 for
<***@mac.com>; Wed, 30 Jul 2003 12:52:35 -0700 (PDT)
Received: from [192.168.123.167]
(adsl-66-122-61-89.dsl.sntc01.pacbell.net [66.122.61.89])
by mta7.pltn13.pbi.net (8.12.9/8.12.3) with ESMTP id h6UJqX94029810 for
<***@mac.com>; Wed, 30 Jul 2003 12:52:33 -0700 (PDT)
Sending to and from my sbc address gave me this:
QUOTE
X-Originating-IP: [64.164.98.52]
Received: from mtaw4.prodigy.net (mtaw4.prodigy.net [64.164.98.52])
by vmg.prodigy.net (8.12.9/8.12.3) with ESMTP id h6UJt4Rf546864
for <***@sbcglobal.net>; Wed, 30 Jul 2003 15:55:05 -0400
Received: from [192.168.123.167] (adsl-66-122-61-89.dsl.sntc01.pacbell.net [66.122.61.89])
by mtaw4.prodigy.net (8.12.9/8.12.3) with ESMTP id h6UJt21f024461
for <***@sbcglobal.net>; Wed, 30 Jul 2003 12:55:03 -0700 (PDT)
Received: from mtaw4.prodigy.net (mtaw4.prodigy.net [64.164.98.52])
by vmg.prodigy.net (8.12.9/8.12.3) with ESMTP id h6UJt4Rf546864
for <***@sbcglobal.net>; Wed, 30 Jul 2003 15:55:05 -0400
Received: from [192.168.123.167] (adsl-66-122-61-89.dsl.sntc01.pacbell.net [66.122.61.89])
by mtaw4.prodigy.net (8.12.9/8.12.3) with ESMTP id h6UJt21f024461
for <***@sbcglobal.net>; Wed, 30 Jul 2003 12:55:03 -0700 (PDT)
*** are my editing to remove my email address
I don't know if that helps you or not.
QUOTE(tacit @ Jul 29 2003, 1:58 PM)
No, it doesn't.
Let's say you get a piece of spam from "g1antpen1s@aol.com". Does that mean the spam came from AOL?
No. The From: address is forged. It is so easy to do, anyone can do it in under two minutes. [snippage of good stuff]
Let's say you get a piece of spam from "g1antpen1s@aol.com". Does that mean the spam came from AOL?
No. The From: address is forged. It is so easy to do, anyone can do it in under two minutes. [snippage of good stuff]
I try not to make blanket statements that I can't back up.
I check any junk mail that gets through at a reverse isp lookup. I'm fully aware of faked email address, and checking the full headers and all the info they contain.
kimmer
Post by: tacit on July 31, 2003, 08:03:35 PM
I get a significant amount of spam, about 25% of it with forged AOL headers--but I haven't gotten any spam that actually came from an AOL email server in over a year.
Post by: sandbox on July 31, 2003, 10:24:14 PM
QUOTE
Received: from [192.168.123.167] (adsl-66-122-61-89.dsl.sntc01.pacbell.net [66.122.61.89])
is the same in both examples, is it not? Maybe I missed something?
Post by: jepinto on August 01, 2003, 07:06:44 AM
From - Fri Aug 1 07:35:31 2003
X-UIDL: <Ozmu4.S@49JEx9diK>
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <freddieacex@firstfinance1.org>
Received: from ns1.crestcommunication.com ([209.208.81.157])
by imf13aec.mail.bellsouth.net
(InterMail vM.5.01.05.27 201-253-122-126-127-20021220) with ESMTP
id <20030731172136.YOQC20633.imf13aec.mail.bellsouth.net@ns1.crestcommunication.c
m>;
Thu, 31 Jul 2003 13:21:36 -0400
Received: from 172.182.198.224 (ACB6C6E0.ipt.aol.com [172.182.198.224])
by ns1.crestcommunication.com (8.9.3p2/8.9.3) with SMTP id NAA09230;
Thu, 31 Jul 2003 13:20:40 -0400
To: "Bob"@ns1.crestcommunication.com
From: "James" <freddieacex@firstfinance1.org>
Subject: Americans can claim up to $2.5 million in grants this year! ZOZ
X-Priority: 3
Reply-To: freddieacex@firstfinance1.org
X-Mailer: Microsoft MimeOLE V6.00.2800.1106
Message-Id: <Ozmu4.S@49JEx9diK>
Date: Thu, 31 Jul 2003 13:20:23 +0700
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-MSMail-Priority: High
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_003_0035_YRMIKBBC.XUZARUDR"
------=_NextPart_003_0035_YRMIKBBC.XUZARUDR
Content-Type: text/plain;
charset="ISO-8859-1"
Content-Transfer-Encoding: 8 bit
------=_NextPart_003_0035_YRMIKBBC.XUZARUDR
Content-Type: text/html;
charset="ISO-8859-1"
Content-Transfer-Encoding: 8 bit
Post by: kimmer on August 01, 2003, 03:22:23 PM
QUOTE(sandbox @ Jul 31 2003, 8:24 PM)
Kimmer, this
is the same in both examples, is it not? Maybe I missed something?
is the same in both examples, is it not? Maybe I missed something?
Yes, it's the same. RHP had asked me if the emails clearly showed they were from sbc, and I was trying to show him that in the full headers they do -- BUT they get past the sbc spam blocks. That I do NOT understand.
I also don't understand why this morning MSN/webtv blocked me due to spam, then filled my hotmail box with 25 filthy porn things.
This afternoon, I could once again write to my friend at webtv. None of it makes much sense to me.kimmer
Post by: tacit on August 01, 2003, 06:35:32 PM
QUOTE(jepinto @ Aug 1 2003, 12:06 PM)
Tacit-Here you go. Received this morning 8-1-03:
Interesting. 209.208.81.157 is a mail exchange for Crest Communications, a small ISP in Archer, Florida. Crest Communications, not AOL, is the source of the email.
The email is being relayed through an open relay server at IP 209.208.81.157 that's being hosted by Crest Communications.
Spamcop turns up AOL as the responsible party, most likely because the spammer is using AOL for Broadband. He's relaying the spam through an open relay hosted by Crest Communications; the email is not actually originating from an AOL server, but rather from a Crest Communications server.
I'd say it's probably more likely to do some good if you report the problem to Crest Communications than if you report the problem to AOL.
Post by: jepinto on August 01, 2003, 08:40:14 PM
Crest is the host for our business account and relays the mail sent to that address to my personal account.
Post by: Diana on August 01, 2003, 10:04:36 PM
My server isn't an open relay.
Wanna test it for me Tacit? But, I am sorta surprised that anything sent to ns1.crestcommunication.com was forwarded to your TS account. I'm gonna have to do some looking into that since anything improperly addressed should either come to me, or postmaster, or admin@I'm gonna go look, but did someone add the "admin" alias to one of the user profiles? If so, it will need to be removed because the system reserves admin for only one user. It shouldn't even allow it to be added to a general user profile as an alias, but maybe that got through somehow. I do know that admin is a reserved userID and if you try to create another admin user, the form will not allow it..time delay here
OK...I went and checked..and yup Jennie..
, you added the admin alias to your profile. but no foul, I've removed it. I will look into setting up a special admin alias just for techsurvivors.I bet you were getting some weird things via e-mail...server messages or similar stuff. I would be curious if you noticed such.
see ya,
Post by: Bill on August 01, 2003, 10:46:11 PM
Diana, does the last post have anything to do with this topic?
Post by: Diana on August 01, 2003, 10:59:38 PM
Only valid users on this system are allowed to use the server as an SMTP server. SMTP servers send mail. Since there is no way to login to this system such as by modem the way a dial-up ISP would work, the best option for validation and the right to send mail through is with a process called POP-before-SMTP. This system requires that a valid system user check their mail here before they will then be allowed to send any out. The server logs the requesting user's IP number for a very limited time when they POP for their personal mail. When that time limit is up, they must POP again before they can send any more mail. Given all this, I usually tell new users to use the SMTP server that their dial-up/broadband ISP provides. Those servers validate user rights through the direct connection to the user.
In some cases, a dial-up/broadband ISP user MUST use the ISP provided SMTP server. I face this very requirement from Earthlink, my ISP. Earthlink requires their users to use earthlink SMTP servers and they block access to external SMTP servers. (I could get around this with tunneling/port forwarding tricks, but there is no reason to since I don't SPAM, nor do I need to hide where I'm from) As long as Earthlink continues to allow me to put my own domain name in the Reply To header, I don't mind using their SMTP server. Some ISPs (Verizon for example) even require that all their users use their verizon addresses in the reply to header. This policy can really hurt a business that wants to promote their own domain name so many businesses fled verizon when they implemented this policy. As far as I know, they still do this, but maybe they've wised up.
If you're not bored yet, please read on.
This server also blocks e-mails based on an access file that I maintain. If I get loads of spam from one domain or IP, I can add this bad stuff to the access file with a reject message and that mail will be refused. Recently, rogue machines on broadband have been attempting to send mail to/through this server. The server rejects all mail from domains that don't resolve. Meaning, if the domain isn't valid or doesn't answer when called, the mail is refused. Spammers often use made up domains in their headers.
The problem is, the machine that is asking mine to allow mail in/through is the only one I can block. If a bad/previously blocked spammer can get another machine that isn't on my block list to send the mail, my/this machine will still accept it. Mail is blocked based on the machine my server talks to...the last hop in effect.
Recently, (past six months of so) there has been a huge increase in mail coming from rogue SMTP servers on broadband IPs. I haven't found a list of all the broadband dynamically assigned IPs, or I would just add them all to my block file. No one should be sending e-mail with their own personal SMTP servers. Everyone should be using their ISPs SMTP server. These rogue machines on broadband are often, though not always, a machine that a spammer has hacked. Spammers plant these SMTP servers on hackable machines then run the spam through as fast as possible. The person who's broadband account is misused like that becomes the one accountable to the ISP..and they may not even know what is going on. Blocking these dynamic IPs wouldn't hurt legitiment users since they are using valid SMTP servers. Open wireless networks are also vulnerable to spammers. "War-spamming" is a new problem whereby spammers drive around looking for open wireless networks. WHen the find one, they park and use a laptop to send hundred/thousands of messages through these misconfigured wireless networks. Again, the wireless network owner is the one held responsible. If you have a wireless network, make sure you're not leaking access outside of your controllable area. Strange car parked out front? Your router going nuts?...check it out!
If an IP is particulary pushy and persistent, I'll just "de-route" them so that the server becomes completely invisible to that IP.
Remember the "finger" episodes? Those in that club were de-routed. They knew what it was like when TS became invisible to them. So in the example Jennie posted showing the spam from AOL, that was a broadband user who's machine probably has a rogue SMTP server installed. It bypassed AOL's strict SMTP servers, but the route through the AOL system was still logged since they were logged into AOL. My machine excepted that piece of spam because all the headers appeared to be valid and that broadband IP wasn't in the block file. VILE SPAMMERS!
(NOTE: unlike Earthlink, AOL does _not_ block access to other SMTP servers. If they did, the spam Jennie got would have been trapped by AOL's outbound spam filters)I also keep an eye out for user installed webmail scripts with known vulnerabilities that allow spammers to abuse this server. So far, no one has installed one, but if I found one, it would be removed. I keep upto date with newly found Sendmail vulnerabilities, and I've also disabled system banners that would tell a prober what version of Sendmail I'm running.
oh what I would give to have a server system that the whole world could agree to use and maintain in such a way as to deny ALL spammers...but as long as there is money to be made, either by the spammers or the system admins that allow them to use or pass through their machines, I don't see it happening. I also despair of any law that will be effective. If anyone has questions or I've made a mess of this attempt to explain, please let me know and I'll try to clarify.
see ya
Post by: Diana on August 01, 2003, 11:05:18 PM
My previous two posts only relate to this topic in the sense that I'm replying to Jennie's and Tacit's posts that showed my server's address in an example of SPAM.
Tacit thought I had an open relay, and I found a misconfiguration on my server that needed clearing up. I was defending my server and explaining to Jennie why she got that mail in the first place, since she shouldn't have.
Hopefully I wasn't too off topic with that and the long entry I just made above.
see ya,
Post by: sandbox on August 02, 2003, 03:02:20 AM
I’m reconfiguring my web space and new email address in addition to Postmaster and Admin. which I discovered recently were not forwarding...... 10 address with different rules is getting a bit complicated. I was considering looking into Verizon’s services just to see if they would be more reasonable than Earthlink since they just increase the cost on one account to $72.50, but the lost option of not displaying the @BusinessName.com in the header using their SMTP server would be a deterrent. I wouldn’t have even asked the question, I would have just assumed that I could, then discovering it later I would probably start looking elsewhere.