Re: [Asrg] Some data on the validity of MAIL FROM addresses
Scott Nelson <scott@spamwolf.com> Sun, 18 May 2003 22:57 UTC
Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA20174 for <asrg-archive@odin.ietf.org>; Sun, 18 May 2003 18:57:12 -0400 (EDT)
Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h4IMPq911414 for asrg-archive@odin.ietf.org; Sun, 18 May 2003 18:25:52 -0400
Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h4IMPqB11411 for <asrg-web-archive@optimus.ietf.org>; Sun, 18 May 2003 18:25:52 -0400
Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA20153; Sun, 18 May 2003 18:56:41 -0400 (EDT)
Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19HX6t-0005qQ-00; Sun, 18 May 2003 18:58:31 -0400
Received: from ietf.org ([132.151.1.19] helo=www1.ietf.org) by ietf-mx with esmtp (Exim 4.12) id 19HX6t-0005qN-00; Sun, 18 May 2003 18:58:31 -0400
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h4IMLKB11215; Sun, 18 May 2003 18:21:20 -0400
Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h4IMChB11037 for <asrg@optimus.ietf.org>; Sun, 18 May 2003 18:12:43 -0400
Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA19920 for <Asrg@ietf.org>; Sun, 18 May 2003 18:43:34 -0400 (EDT)
Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19HWuB-0005nK-00 for Asrg@ietf.org; Sun, 18 May 2003 18:45:23 -0400
Received: from adsl-66-120-64-133.dsl.snfc21.pacbell.net ([66.120.64.133] helo=magic1.org) by ietf-mx with smtp (Exim 4.12) id 19HWuA-0005nH-00 for Asrg@ietf.org; Sun, 18 May 2003 18:45:22 -0400
Message-Id: <aT5vaIe86J8qbrFen02@x>
To: Asrg@ietf.org
From: Scott Nelson <scott@spamwolf.com>
Subject: Re: [Asrg] Some data on the validity of MAIL FROM addresses
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/asrg>, <mailto:asrg-request@ietf.org?subject=unsubscribe>
List-Id: Anti-Spam Research Group - IRTF <asrg.ietf.org>
List-Post: <mailto:asrg@ietf.org>
List-Help: <mailto:asrg-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/asrg>, <mailto:asrg-request@ietf.org?subject=subscribe>
List-Archive: <https://www1.ietf.org/pipermail/asrg/>
Date: Sun, 18 May 2003 15:46:38 -0700
At 03:34 AM 5/18/03 -0400, Kee Hinckley wrote: >Vernon has regularly made the claim that a significant proportion of >spam messages have valid MAIL FROM's. That means that bounces will >go the the spammer. This has significant ramifications for C/R >systems (especially auto-respond ones) since it means that should >they have to, spammers could respond to challenges. > There's a significant difference between "address is valid" and "address belongs to spammer who could respond." It's certainly possible for the Reply-To: (or any other sender supplied addresses you test) to point to a valid address that does belong to the sender (real), valid that doesn't belong to the sender (forged), currently invalid address which belonged to the sender when they sent the message (revoked by isp) or invalid which never belonged to the sender (abandoned once the bounces started flooding in). It would be nice to know how many addresses that tested valid when the spam was received, test invalid some time later (say, after 48 hours). Of course, that data might not be much use, but at least it's collectable. > >There were 39595 entries in the log, with 34404 distinct SMTP sessions. >There were 11559 unique MAIL FROM addresses. > >+---------+-------+------------+ >| errcode | total | percentage | >+---------+-------+------------+ >| 0 | 99 | 0.86 | ??? >| 250 | 5796 | 50.14 | >| 450 | 6 | 0.05 | >| 451 | 12 | 0.10 | >| 452 | 8 | 0.07 | >| 473 | 4 | 0.03 | >| 500 | 1 | 0.01 | >| 501 | 1 | 0.01 | >| 521 | 3 | 0.03 | >| 530 | 1 | 0.01 | >| 550 | 2341 | 20.25 | >| 551 | 3 | 0.03 | >| 552 | 2 | 0.02 | >| 553 | 288 | 2.49 | >| 554 | 48 | 0.42 | >| 555 | 1 | 0.01 | >| 556 | 1 | 0.01 | >| 571 | 1 | 0.01 | >| 1001 | 1880 | 16.26 | No MX Record >| 1003 | 1055 | 9.13 | No SMTP Server >| 1007 | 8 | 0.07 | Invalid Email Format >+---------+-------+------------+ > >In aggregate. 51% of the addresses were valid. 49% were not. >Of the ones that were not valid, 52% didn't have a reachable mail server. > Minor quibble: Failing to have an MX record doesn't guarantee an address is invalid. But I'd bet that a fair number of the "No MX Record" group don't have an A record either, and of the ones that do, few if any point to a SMTP server. At any rate, somewhere between 9% - 25% not only don't have valid return addresses, the addresses given can't reasonably be considered to ever have been valid. We can at least say with some certainty that those spams aren't impersonating someone else. Scott Nelson <scott@spamwolf.com> _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg
- Re: [Asrg] Some data on the validity of MAIL FROM… Scott Nelson
- [Asrg] Some data on the validity of MAIL FROM add… Kee Hinckley
- Re: [Asrg] Some data on the validity of MAIL FROM… Jon Kyme
- Re: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- Re: [Asrg] Some data on the validity of MAIL FROM… Fred Bacon
- Re: [Asrg] Some data on the validity of MAIL FROM… Yakov Shafranovich
- Re: [Asrg] Some data on the validity of MAIL FROM… Jon Kyme
- Re: [Asrg] Some data on the validity of MAIL FROM… Yakov Shafranovich
- Re: [Asrg] Some data on the validity of MAIL FROM… Alan DeKok
- Re: [Asrg] Some data on the validity of MAIL FROM… Scott Nelson
- Re: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- Re: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- Re: [Asrg] Some data on the validity of MAIL FROM… Yakov Shafranovich
- Re: [Asrg] Some data on the validity of MAIL FROM… Kee Hinckley
- Re: [Asrg] Some data on the validity of MAIL FROM… Kee Hinckley
- Re: [Asrg] Some data on the validity of MAIL FROM… Michael Rubel
- Re: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- Re: [Asrg] Some data on the validity of MAIL FROM… Yakov Shafranovich
- Re: [Asrg] Some data on the validity of MAIL FROM… Scott Nelson
- Re: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- Re: [Asrg] Some data on the validity of MAIL FROM… Michael Rubel
- Re: [Asrg] Some data on the validity of MAIL FROM… Kee Hinckley
- Re: [Asrg] Some data on the validity of MAIL FROM… Kee Hinckley
- Re: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- Re: [Asrg] Some data on the validity of MAIL FROM… Dave Crocker
- Re: [Asrg] Some data on the validity of MAIL FROM… Jon Kyme
- Re: [Asrg] Some data on the validity of MAIL FROM… Jon Kyme
- Re: [Asrg] Some data on the validity of MAIL FROM… Alan DeKok
- Re: [Asrg] Some data on the validity of MAIL FROM… Alan DeKok
- Re: [Asrg] Some data on the validity of MAIL FROM… Alan DeKok
- Re: [Asrg] Some data on the validity of MAIL FROM… Kee Hinckley
- Re: [Asrg] Some data on the validity of MAIL FROM… Kee Hinckley
- Re: [Asrg] Some data on the validity of MAIL FROM… Kee Hinckley
- Re: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- Re: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- RE: [Asrg] Some data on the validity of MAIL FROM… Hallam-Baker, Phillip
- RE: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- RE: [Asrg] Some data on the validity of MAIL FROM… Eric Dean
- RE: [Asrg] Some data on the validity of MAIL FROM… Eric Dean
- RE: [Asrg] Some data on the validity of MAIL FROM… Barry Shein
- RE: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- RE: [Asrg] Some data on the validity of MAIL FROM… Kee Hinckley
- RE: [Asrg] Some data on the validity of MAIL FROM… Eric Dean
- Re: [Asrg] Some data on the validity of MAIL FROM… Jon Kyme
- RE: [Asrg] Some data on the validity of MAIL FROM… Eric Dean
- RE: [Asrg] Some data on the validity of MAIL FROM… Eric Dean
- Re: RE: [Asrg] Some data on the validity of MAIL … Jon Kyme
- RE: RE: [Asrg] Some data on the validity of MAIL … Eric Dean
- Re: RE: [Asrg] Some data on the validity of MAIL … Jon Kyme
- Re: [Asrg] Some data on the validity of MAIL FROM… Yakov Shafranovich
- Re: RE: [Asrg] Some data on the validity of MAIL … Kee Hinckley
- Re: [Asrg] Some data on the validity of MAIL FROM… Michael Rubel
- RE: [Asrg] Some data on the validity of MAIL FROM… Tom Thomson
- Re: RE: [Asrg] Some data on the validity of MAIL … Jon Kyme
- Re: [Asrg] Some data on the validity of MAIL FROM… Jon Kyme
- Re: [Asrg] Some data on the validity of MAIL FROM… Michael Rubel
- Re: [Asrg] Some data on the validity of MAIL FROM… Daniel Feenberg
- Re: [Asrg] Some data on the validity of MAIL FROM… Michael Rubel
- Re: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- Re: [Asrg] Some data on the validity of MAIL FROM… Yakov Shafranovich
- Re: [Asrg] Some data on the validity of MAIL FROM… Michael Rubel
- Re: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- Re: [Asrg] Some data on the validity of MAIL FROM… Kee Hinckley
- RE: [Asrg] Some data on the validity of MAIL FROM… Eric D. Williams
- RE: [Asrg] Some data on the validity of MAIL FROM… Eric D. Williams
- RE: [Asrg] Some data on the validity of MAIL FROM… Eric D. Williams
- RE: [Asrg] Some data on the validity of MAIL FROM… Eric D. Williams
- RE: [Asrg] Some data on the validity of MAIL FROM… Eric D. Williams
- Re: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- RE: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- Re: [Asrg] Some data on the validity of MAIL FROM… Jon Kyme
- Re: [Asrg] Some data on the validity of MAIL FROM… Jon Kyme
- Re: [Asrg] Some data on the validity of MAIL FROM… Richard Rognlie
- RE: [Asrg] Some data on the validity of MAIL FROM… Clayton, Nik [IT]
- Re: RE: [Asrg] Some data on the validity of MAIL … Jon Kyme
- Re: RE: [Asrg] Some data on the validity of MAIL … Jon Kyme
- RE: RE: [Asrg] Some data on the validity of MAIL … Clayton, Nik [IT]
- RE: RE: [Asrg] Some data on the validity of MAIL … Clayton, Nik [IT]
- Re: [Asrg] Some data on the validity of MAIL FROM… Kee Hinckley
- Re: RE: RE: [Asrg] Some data on the validity of M… Jon Kyme
- Re: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- Re: [Asrg] Some data on the validity of MAIL FROM… Jon Kyme
- RE: [Asrg] Some data on the validity of MAIL FROM… Tom Thomson
- RE: [Asrg] Some data on the validity of MAIL FROM… Yakov Shafranovich
- Re: [Asrg] Some data on the validity of MAIL FROM… mathew
- Re: [Asrg] Some data on the validity of MAIL FROM… Yakov Shafranovich
- RE: [Asrg] Some data on the validity of MAIL FROM… Eric D. Williams
- RE: [Asrg] Some data on the validity of MAIL FROM… Eric D. Williams
- RE: [Asrg] Some data on the validity of MAIL FROM… Barry Shein
- Re: [Asrg] Some data on the validity of MAIL FROM… Barry Shein
- Re: [Asrg] Some data on the validity of MAIL FROM… wayne
- Re: [Asrg] Some data on the validity of MAIL FROM… Vernon Schryver
- Re: [Asrg] Some data on the validity of MAIL FROM… Yakov Shafranovich
- RE: [Asrg] Some data on the validity of MAIL FROM… Kee Hinckley
- Re: [Asrg] Some data on the validity of MAIL FROM… Kee Hinckley
- Re: [Asrg] Some data on the validity of MAIL FROM… Markus Stumpf
- Re: [Asrg] Some data on the validity of MAIL FROM… Chris Lewis