Re: [Asrg] Is there anything good enough? - Spoofing stats

[Vernon Schryver <[e-mail]>]

> From: David Walker <[e-mail]>

> ...
> 1300 out of 3130 = 41% of all my denies are very high likelyhood spoofs from 
> the popular domains
> 1050 out of 3130 = 34% are guaranteed spoofs (The helo name is not remotely 
> associated with the spoofed domain) from the popular domains.
> ...

What is your definition of "spoof" besides "HELO not remotely
associated with sender domain"?  Does you definition involve the
use of a sending address that is not the property of the sender?

Many perfectly legitimate owners of netscape.com and other free
provider mailboxes uses those addresses as sender addresses in
their mail but send mail from unrelated ISPs.  Sometimes they do
this to avoid exposing their more private addresses to spam.  In
other cases port-25 filtering or other problems prevent them from
sending mail except through the unrelated ISP.

If your definition of "spoofed domain" includes the notion that
the spoofed address is not perfectly legitimately and own by the
user sending the message, what would you suggest to those innocent
people?  By turning off the mail of those innocent people, would
RMX be creating problems?

If your definition includes some notion of forgery, how do you know
whether a message with unrelated sender address and reverse DNS domains
is spoofed or forged?  Do you have some way to ask the administrators
of the "spoofed" domain about the sender address?

I've recently seen a lot of spam with sender addresses in all of the
domains in your list.  Most of the names in your list are free providers,
but some are not.  I bet that much and probably most of the spam you've
seen with free provider sending address is not forged.  I've suspected
that spam with sender addresses from earthlink.net, msn.com, and aol.com
are forged, but how can anyone outside those organizations know?
Reading between the lines of today's front page "Wall Street Journal"
article suggests that much of the Earthlink spam may not be forged
in any real sense of the word.

See http://online.wsj.com/article/0,,SB105225593382372600,00.html if
you have a subscription.  The title is "Elusive Spammer Sends EarthLink
on Long Chase."  I've been unable to find the article on Google or
Yahoo, but it might appear there later this week.


Vernon Schryver    [e-mail]
_______________________________________________
Asrg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/asrg