BGP blackholing spam [was Spammer Bust]

Jim Carroll jim at carroll.com
Sat Sep 6 15:55:11 UTC 1997


On Fri, 5 Sep 1997, Randy Bush wrote:

> Date: Fri, 5 Sep 97 23:08 PDT
> From: Randy Bush <randy at psg.com>
> To: nanog at merit.edu
> Subject: BGP blackholing spam [was Spammer Bust]
> 
> Please excuse me, but I would like to turn this traditional spam topic
> (often in form as well as content) into something operational.
> 
> Paul Vixie is doing something about spam which is technical, operational,
> and which can be put into your router, a BGP feed to blackhole spam sites.
 
 Is  it  possible to get the list of sites included in this feed. Paul Vixie
 used to publish these site on his web site, but the "Rogue" sites area  has
 been  taken  down.  Apparently  a  large number of list "memebers" threaten
 legal action. They alleged some used this list as a  list  of  targets  for
 retaliation.

 We  were  freuquent reviewers of the list. We used the information there to
 update our sendmail filters. We were very dissapointed to see it go.
  
 The  only  trouble  I have with Paul's list was it occasionally needed fine
 tuning by hand. Some sites had to be permitted, even though they  may  have
 been  guilty  of  UCE. On one occasion, they had an ISP on their list. This
 ISP was close enough to us in geographic region that it was  reasonable  to
 expect  some of our users were emailing users on their system. We could not
 therefore black hole them.
 
 It  would  seem  to  me  that  this  would  be more serious if this were an
 automatic feed, sent directly to our routers. There  would  be  no  way  to
 review the sites on the list before they were blocked.
 
 Perhaps  Paul  would create a mailing list for network operators interested
 in receiving his blackhole list. As new updates to  the  group  were  made,
 they  could  be  sent  to  the  list.  So as not to appear as though we are
 looking for something for nothing, we would be willing to donate  resources
 to run the list.
 
---
Jim C., President       | C A R R O L L - N E T, Inc.
201-488-1332 voice      | New Jersey's Premier Internet Service Provider
201-487-5717 dialup     |
http://www.carroll.com  | Ask about our Business Messaging Services



More information about the NANOG mailing list