Slashdot Log In
Is There Any Reason to Report Spammers to ISPs?
Posted by
Cliff
on Sun Apr 29, 2007 01:25 AM
from the does-it-do-any-good dept.
from the does-it-do-any-good dept.
marko_ramius asks: "For years I've been a good netizen and reported spam that I get to the appropriate contacts at various ISPs. In the entire time that I've done this I've gotten (maybe) 5 or 6 responses from those ISPs informing me that they have taken action against the spammer. In recent years however, I haven't gotten any responses. Are the ISP's so overwhelmed with abuse reports that they aren't able to respond to the spam reports? Do they even bother acting on said reports? Is there any real reason to report spammers?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Yes (Score:5, Informative)
Too Many Electrons (Score:4, Funny)
Parent
Re: (Score:2)
I might report, if my ISP would let me... (Score:2)
Re: (Score:3, Interesting)
Reporting helps, keep doing it (Score:5, Interesting)
Often, just counting against a mailhost for eventual blockage and upline reporting... but it helped block spam from other people (and more spam to yourself) at the least.
Re: (Score:2)
yep (Score:4, Insightful)
Re:yep (Score:4, Insightful)
I provided tier 3 abuse support to a large ISP and set up the abuse desk for the now defunct dialup offering of the ISP, my advice to the abuse desk people was to shitcan any abuse report that contained contained abusive comments added by the person reporting the spam. Adding abusive comments is not reporting abuse, it IS abuse.
Parent
Re: (Score:2)
Definitely report if you have clue (Score:4, Insightful)
Re: (Score:2)
How is this a sad thing?
As long as the reports go to someone who is smart enough to understand those things, the reports can help.
The only downside I can think of is that they may believe that AOL is actually sending out these messages, and AOL is a bad company to deal with... I can see how that's sad for AOL, but I didn't realize there were alot of AOL supported on slashdo
Re: (Score:3, Informative)
If they go to the wrong person, all that serves to do is annoy someone who has absolutely nothing to do with the spam and can't do anything to fix it. Such emails are usually the most inflammatory, so hackles are already up before you waste time verifying that the original spam was indeed nothing to do with us. Plus, like the boy who cried wolf, every one of these makes you that little bit less inclin
Re: (Score:2)
When I ran the abuse desk at Alabanza (google it, I did my job, and the community loves me to this day for it), abusive complaints ("Why the fuck won't you do anything about your fucking spammers?!") were automatically round-filed. POLITE complaints received action.
I very rarely personally replied to a complainant. Usually the ones I -did- reply to were people I either knew, or who were common complainants that I saw a couple from a day. Everyone got my auto-responder. I also posted in NANAE, and pa
Re: (Score:2)
SPF is part of Microsoft's SenderID patent and its license is incompatible with the GPL [imc.org], therefore I will personally never republish an SPF record again.
Please continue! (Score:5, Informative)
We frequently receive notifications of spam email as well as virus-laden email that has originated from our network. We only respond to the sender if they request that we do (and even then, if it's not necessary and the request isn't polite, we may not).
That means we almost never send a reply to the person who notified us. However, we DO take care of every single notification we receive. If we aren't able to immediately contact the customer and fix the issue (generally a home user with a virus doing the spamming), then we either shut off their service or, more frequently, block outgoing connections from their IP to port 25 anywhere.
Please don't let the silence discourage you. We're hard at work and appreciate the notices that help us keep our networks and services running smoothly for our customers.
Re:Please continue! (Score:3, Insightful)
Here's a thought: Might giving some sort of reply, even a thank-you form letter, not keep people like Mr. marko_ramius from being discouraged? Maybe that's something you and your ilk should consider.
(P.S. there was no hostility in the above)
It may be a policy matter (Score:2)
Not at all! (Score:5, Interesting)
Provided that there is a clear proof (and not just someone's report) that a customer is a spammer, they would have two options:
1. filter out their outgoing SMTP traffic or
2. shutting down the link
Spammers then would probably change ISP in a snap.
The real (technical) point should be: why spammers do exist? One answer could be "because SMTP has not been designed to cope with authentication and authorisation."
Maybe it's important to look at problems from the correct perspective.
Re: (Score:2)
Well, it might be part of a solution but it's nowhere near it. Even if I had perfect verification that this was sent from $foo LLC., Pacific Islands somewhere, what good would it do? Taking them to the local court would do exactly nothing, whereas any loser with a credit card
Re: (Score:2)
That is true, which is why back in 1998 ago they came up with the MSA port (RFC 2476.) There is no need for ANY MUA to use port 25 anymore. ISP's should be blocking port 25 for everyone except mail servers or others that have used the ISP's tool to request that port 25 be open for outbound.
Re: (Score:3, Interesting)
There is no need for ANY MUA to use port 25 anymore. ISP's should be blocking port 25 for everyone except mail servers or others that have used the ISP's tool to request that port 25 be open for outbound.
So what should a residential user do if the only ISP in town that offers anywhere the bandwidth he wants (that is, it's this or dial-up) has an unreliable MSA? Should all customers in that town have to subscribe both to Internet access (with a bundled unreliable MSA) and a third-party smarthost?
Yes (Score:2)
When their access is restored, if it continues to happen they get longer and longer blocks. He told me a story about a woman who called in who just didn't seem to understand this concept and her access was currently b
Keep reporting (Score:2, Informative)
Please keep reporting. I handle the abuse complaints for a regional ISP. We have never had an actual spammer on our network, but the reports have helped us clean up some very badly infested machines of our users. Since I receive about 50 of these complaints a week, with maybe 1 in 1000 being from our IP space, I have to agree that it is frustrating when people report to me, but the only mention of my IP or domain space is an obviously forged header. At least it is obvious to any
Please Report Spam (Score:3, Informative)
Spammers from The Planet (Score:3, Interesting)
Only after doing an end-run around the abuse department did I see some *real* action taken on behalf of The Planet. Previously all they seem to have done was moved the customer to a different IP address, which would have been very counter-productive had I just kept blocking the original IP address.
Stength in numbers (Score:2)
If enough people complain, they will take action. The "legitimate" ISPs at least (as opposed to the "bulletproof" ISP).
Include the ip address / spamvertized URL on the subject. Makes it easier for the poor lackey they have tasked with reading the abuse mail and opening tickets/reports/whatever.
Or use a service like spamcop or mynetwatchman (for portscanning attacks). Usually, the postmaster and abuse accounts are not filtered in any way so they get a HUGE amount of spam
What about spam@uce.gov ? (Score:3, Interesting)
Re: (Score:2)
A few may actually behave like this, but I'd be willing to bet that the majority aren't.
I've worked for a large ISP, and we worked with others to fight this stuff. Spam represented a great waste of our resources, and a great distraction to actually providing an actual product for our customers.
Re:Dont bother - they're in on the racket (Score:5, Interesting)
ISPs could also install sniffers to watch the rate of outbound off-network port 25 SYN packets, and investigate unusual activity. Oh and don't go saying that this is difficult - just talk to AT&T and the government - they have been sniffing ALL traffic.
But it's VERY VERY rare to find an ISP that does ANYTHING AT ALL to stop outbound spam. Oh sure, they are perfectly willing to install blacklists and filters on inbound, but outbound? Nothing. They don't care. The only way to fix this is to make habitual offenders be financially liable. ISPs also need to make end users liable and start enforcing their TOS, disconnecting grannie and her POS windows box that has no firewall, anti-virus, and is running spambot software.
Parent
Re: (Score:3, Interesting)
The problem with your situation is that the same customers that complain about the spam that come in rely on Port 25 to allow their users access to company se
Re: (Score:2)
Re: (Score:2)
While I'm not in the middle of the US IT situation, I don't think it's used as much as it should be.
Re: (Score:2)
Re: (Score:2, Interesting)
and Believe me they took spam seriosuly...
not just for reasons of stopping spam, and credibility, but for profit..
See, we'd give them 2 chances - they got reported for spamming we'd give them a call and tell them
what going on and ask them nicely to please fix it. if its a suspected botnet, get a pc tech - if its spammer (its happened)
then stop your freakin' spam.
if they got reported again, accounts get suspended. give them another call explain the situation again, and ad
No, I strongly disagree... (Score:4, Interesting)
What ISPs should do is to identify nodes which have actually been infected by a botnet (or are otherwise sending spam/malware) and nuke them in accord with every ISP TOS out there. But, that would be more work, and cut into their revenues, so they don't want to do that.
I run a firewall (iptables), run up-to-date malware scanners, and take responsibilty for what leaves my network. If my security is ineffective, and one of my machines starts spewing spam, I should be cut off and held responsible. But, I should not be penalized or limited because of the actions of others.
Finally, it should be obvious that port blocking, refusing acceptance of smtp connections originating from dynamic IPs, etc. simply hasn't been effective against spam. Spam continues to increase, and will continue to do so until action is taken closer to the root causes - networks start going after originating machines, law enforcement start going after businesses using spam (and, of course, instituting a death penalty for anyone caught purchasing any product from a spammer).
Parent
Re: (Score:3, Insightful)
As for you assertion that blocking inbound from dynamics is not effective, I, and MANY other ISP's disagree with you. The mail server logs don't lie. Blocked mail from dynamic space (which is ALL spam) is 75% of ALL connections to our mail servers, with other blacklists cutti
Re: (Score:2)
Re: (Score:3, Informative)
Yeah, if the block MS file sharing ports and leave open relays in place, they're not really ISPs.
Give me
Yeah... (Score:2)
I have little sympathy for lazy ISPs, who've created the bed they are now forced to lie in.
ISPs allow spam because they make more money putting up with it than by dealing with it properly.
Re: (Score:3, Insightful)
I have this feeling that you don't know a lot about spam and how it is propa
Re: (Score:2)
Now I will blame ISP's and other mail server operators for not taking a very strong stance and mandate that mail servers behave correctly, such as working forward and reverse DNS, correct HELO/EHLO arguments, etc. Hell, just rejecting mail from poorly setup mail servers alone would go a LONG way towards cutting spam down with ZERO impact on server load, and legit mail.
Re: (Score:3, Interesting)
We absolutely did shut down the users sending the spam, but the largest offenders didn't care, because they weren't legitimate customers; they were large-scale spammers creating literally dozens of spam accounts daily, using stolen credit cards. Surely you've heard the expression "whack-a-mole"? That's what we were playing and the deck is stacked against us in a situation like this. These particular spammers were almost exclusiv
Re: (Score:2)
You just say they don't do the blocking... you don't assert in any fashion how they benefit from it.
There's a vast difference between an ISP who can't be bothered to block traffic, and one who is in collusion with the spammers.
I personally hate that my ISP blocks port 25 outbound. I wish they did something more intelligent like tracking spam complaints back to the subscriber and blocking port 25 for those
Re: (Score:2)
Re: (Score:2)
ISPs have terms of service. Many will take your site down if you host MP3s, warez, or porn (obviously, others are quite happy for you to do so). Many have broad language saying you're basically not allowed to be a "server". Which if strictly enforced, would stop you doing almost everything.
Re: (Score:3, Informative)
Re: (Score:2)
Interesting.. not that many comments, and three responses saying "I'm a decent sized ISP employee, and while we don't respond, we at least look into each complaint." I can only hope so.
While reading over this article and thinking, I came up with another interesting idea. I have recently registered a domain which I'm sure is ripe for joe jobs [wikipedia.org]. It is basically a private image hosting service. Flickr-esque in nature, but... just for my friends to upload, world to see.
Because of this privilege, and other
Re: (Score:2)
Re: (Score:2)
Sure they would - at least it's an acknowledgment. Send the auto reply.
Personally, I use a whitelisted acct for people I really want to hear from. The rest I let yahoo or hotmail filter out the spam and change the address if it starts to get spammy.