Subject: [Asrg] Spammers probing for whitelisted addresses?

From: "Walter Dnes" <[email-masked]>
Date: Thu, 26 Jan 2006 23:43:14 -0500

Checking my reject logs, I've noticed a new pattern the past couple of
weeks...
  - *ONE* IP address
  - sends 15 or 50 delivery attempts, approximately 1 attempt 2 every
    seconds
  - the envelope-sender is a legitimate looking address @gmail.com or
    gmx.de or one of several .ru domains

  Another pattern I see occasionally is 3 consecutive attempts from the
same IP address with the same [email-masked] envelope
sender.  Is this an attempt to defeat greylisting?

  If my rules reject the 1st time, they end up rejecting all 3 or 15 or
50 attempts.  The rejection is usually due to rDNS that smells dynamic,
or total lack of rDNS.

-- 
Walter Dnes <[email-masked]> In linux /sbin/init is Job #1
My musings on technology and security at http://tech_sec.blog.ca

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Daniel Feenberg <[email-masked]>
Date: Fri, 27 Jan 2006 07:54:01 -0500 (EST)

> 50 attempts.  The rejection is usually due to rDNS that smells dynamic,

If I may pick up on this point and change the subject a bit ...

The spam bucket for some mailing lists we maintain here at nber.org has
accumulated uncounted messages from 6,491 unique connecting IP
addresses. This count is after filtering by Spamhaus and MAPS - we want
to learn the marginal effectiveness of further filtering. given that we
already do some easily justified filtering.  (see
http://www.nber.org/sys-admin/dnsbls-compared.html for my
justification).

Of these only 874 (13%) had an existing RDNS that did not reek of dynamic
assignment. That is, did not include the strings "dsl", "dynamic", "dial"
or "pool" and did not have any all-digit components.

So by adding that test, it looks like we could dramatically reduce the
remaining spam burden we face. But I wonder why the DNSBLs don't do that.
I have seen the suggestion that many legitimate mailservers have such
addresses. Is this really true? I never see them in my own incoming mail,
and I don't have access to a more general sample of known good mail. Can
anyone here cite specific legitimate MTAs that have such addresses?
Presumably if you reject dynamic sounding addresses, then you have a
whitelist for some MTAs. Would you care to characterize it, or post it? Is
it all individuals hosting their own mail server, or do some firms and
ISPs make this mistake? 

Every week on NANAE there seem to be several operators of such MTAs
posting queries about why they are blocked, but those people seem to be
individual hobbyists worried that their ISP is reading their mail, and I
don't know if they persist or give up.

We haven't checked for matching forward and reverse DNS, that seems to
harsh for us (although I applaud anyone else doing so).

So, how does it work for you?

Daniel Feenberg

---

From: Frank Ellermann <[email-masked]>
Date: Fri, 27 Jan 2006 14:56:42 +0100

Daniel Feenberg wrote:

> those people seem to be individual hobbyists worried that
> their ISP is reading their mail, and I don't know if they
> persist or give up.

You could offer that SPF PASS bypasses your "DUL heuristics",
or maybe couple the latter with some kind of 4xx greylisting.

                           Bye, Frank

---

From: Andreas Saurwein <[email-masked]>
Date: Fri, 27 Jan 2006 12:30:25 -0200

Brasil Telecom is one such sample of a large provider (65% of the latin
american email traffic) who does not consistently assign static IPs and
commercial broadbands.
In theory their assignments are like
201-xxx-xxx-xxx.fnscexxx.dsl.brasiltelecom.net.br for residential broadband
and like 200-xxx-xxx-xxx.bsacexxx.e.brasiltelecom.net.br for commercial
broadband.
Unfortunately this is no longer true it seems and you'll find them just
mixed up. Even for real commercial broadband connections most of the times
the rDNS entries are screwed up - either because the owner does not
know/care or BrT messed it up.
To make matters worse, they sell their DSL service through partner ISPs
which sometimes manage the rDNS entries. Go figure.

We even see frequently smaller companies which use residential DSL to run
their own outbound mailserver and of course permanently get blocked.

cheers
Andreas Saurwein

--
===========================================
     Leon Enterprise Anti-Spam Server
        http://www.uniwares.com.br
===========================================
Personal Hangout: http://spaces.msn.com/members/asdev/
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Walter Dnes" <[email-masked]>
Date: Sat, 28 Jan 2006 00:30:05 -0500

Background
==========
  I'm an end user at an ISP that uses a modified qmail to allow endusers
to admin smtp-stage filters without having to admin the MTA.  I have a
personal domain that uses zonedit, which allows me to point my MX entry
at a remote ISP.  The personal email account allows 10 email addresses.
That leaves me 7 free, after allowing for postmaster, domain admin, and
abuse @ my domain.

On Fri, Jan 27, 2006 at 07:54:01AM -0500, Daniel Feenberg wrote

> or "pool" and did not have any all-digit components.

  My rDNS filters for dynamic addresses are...
PIREJECTREGEX [0-9]+-[0-9]+-[0-9]+
PIREJECTREGEX [0-9]+\.[0-9]+\.[0-9]+
PIREJECTREGEX adsl
PIREJECTREGEX dhcp
PIREJECTREGEX dynamic
PIREJECTTAIL ipt.aol.com
PIREJECTTAIL cpe.net.cable.rogers.com

> remaining spam burden we face.

  I put DNSbls at the latest stage possible in the sequence.  If a
heuristic rule blocks an email, the DNSbls are never queried.  This is
kinder-&-gentler on the DNSbls, and speeds up processing at my (remote)
inbox.  Here's an analysis of January's rejects so far in sequential
order.  If a rule rejects an email, following rules don't see it.

Total = 2694

# Yes, spammers *ARE* stupid enough to HELO as my remote ISP or as
# waltdnes.org.  If they want to make things easy for me, I'm happy.
Badly forged HELO = 97

# The next 2 rules account for 5/6ths of all rejects.
No hostname = 648
Dynamic IP by rDNS regex = 1602

Country by rDNS = 160
Country by envelope-sender = 6
Provider by rDNS = 0
Provider by envelope-sender = 0
Blatant phish = 4

# The 419/lottery assholes have recently set up shop at Hotmail.  I'm
# not going to fall for their scams, but the spams are annoying.
Rejected Hotmail = 19

# Since this is a personal domain, I can put on draconian filters that
# ISPs could never consider
12.0.0.0/8 CIDR = 2
24.0.0.0/8 CIDR = 17
41.0.0.0/8 CIDR = 0
58.0.0.0/7 CIDR = 0
60.0.0.0/7 CIDR = 0
124.0.0.0/7 CIDR = 0
126.0.0.0/8 CIDR = 0
189.0.0.0/8 CIDR = 0
190.0.0.0/8 CIDR = 0
200.0.0.0/6 CIDR = 3
210.0.0.0/7 CIDR = 2
218.0.0.0/7 CIDR = 7
220.0.0.0/6 CIDR = 2
Various lists of dnsbl.sorbs.net = 90
list.dsbl.org = 19

# Email from [email-masked] must actually originate from AOL.  Email
# from [email-masked] must actually originate from yahoo.com, etc.
# Some domains are heavily forged but, unlike Hotmail, I don't receive
# much spam actually from them.
Commonly forged from not verified = 11

> But I wonder why the DNSBLs don't do that.  I have seen the suggestion
> that many legitimate mailservers have such addresses. Is this really
> true? I never see them in my own incoming mail, and I don't have
> access to a more general sample of known good mail.

  They do, but they're known as "DUL" lists.  DUL was the actual name of
an early "Dial Up List", and is now used generically, like "RBL".  For
legal reasons, calling *EVERY* dynamic IP a spam source is a bad idea.
But making a truthful statement of fact ("This IP address is dynamically
assigned") is more defensible in court (IANAL, talk to a real one for
legal advice).  It is up to MTA admins to decide to use the lists as a
reason for rejection.

  I've been using my dynamic IP regexes for over a year and ran into
only one case where a business (actually multiple domain hosting)
tripped the "[0-9]+-[0-9]+-[0-9]+" rule.  The admin, who ran the MTA
which served multiple small businesses, was concerned about having ended
up in a DNSbl.  I assured him that it was my homebrew rule, not a DNSbl,
explained exactly why the false positive occured, and curteously
suggested that he request his provider fix up the rDNS to not look like
an average home user dynamic IP address.  I whitelisted 209.139.212.0/24
where some addresses do have static-looking rDNS, whilst others look
like h209-139-212-nnn.gtcust.grouptelecom.net, where "nnn" is the last
of the dotted quads.