DOCSLIB.ORG

QUICK LOOK • Blacklists, Also Called 'Blocklists', Are Lists of Mail Servers Or Domains That Have Been Identified by a Blacklist Provider As Being a Source of Spam

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
QUICK LOOK • Blacklists, Also Called 'Blocklists', Are Lists of Mail Servers Or Domains That Have Been Identified by a Blacklist Provider As Being a Source of Spam QUICK LOOK • Blacklists, also called 'blocklists', are lists of mail servers or domains that have been identified by a blacklist provider as being a source of spam. • There are dozens of blacklists across the Internet; however, only a handful are considered reliable enough for widespread usage. • The criteria for appearing on blacklists are different for each list, and may be factbased or completely arbitrary, making it sometimes challenging to get removed from blacklists. • Given the unique nature of each blacklist, appearance on a blacklist may or may not present meaningful deliverability challenges. OVERVIEW A blacklist is a list of mail servers (or domains) that have been identified by an individual or group as senders of spam. Some lists are compiled automatically, while others are manually compiled by individuals. Blacklist services range from respected and formalized groups to one-man operations, sometimes self-appointed vigilantes of the email world. Both methods can be extremely arbitrary and often result in "false positives" (e.g. email desired by the recipient that does not get delivered due to filtering or blocking). There is no single reason a sender may get listed on a blacklist. In general, blacklisting services target companies perceived to be sending spam. Typically, this is because the group or individual maintaining the blacklist has received unsolicited email from the listed server. Some public groups, such as SpamCop, base their listings on the number of complaints issued from consumers. Even one complaint can cause a block to be issued. There also is no one single source for blacklists, making it difficult if not impossible to identify every blacklist currently active. Some public blacklists are utilized by a significant number of ISPs and corporations but most do not seriously impact overall deliverability. The important thing to remember is that a public blacklist can only affect an email marketer if that mailer delivers to a domain that uses the blacklist to filter incoming email. A blacklisting service does not have the ability to block your email without the full cooperation of the administrator that manages incoming email for those recipients. Senders should keep this in mind if they find they are listed on a smaller blacklist, in particular. In these instances, it is most likely that only very few (or zero) members of a contacts list will be impacted by the blacklisting. Many less recognized blacklisting services do not have a mechanism for resolving email block disputes. Even services that are more widely recognized and used by large companies have limited resources to respond to challenges from legitimate email marketers. This makes getting removed from a blacklist a slow and resource-intensive process for everyone concerned. Disclaimer: This document is for informational purposes. It is not a commitment to deliver any material, code, or functionality, and should not be relied upo in making purchasing decisions. The development, release, timing, and pricing of any features or functionality described in this document may change and remains at the sole discretion of Oracle Corporation. 1 BRIEF / Blacklists Deliverability Intelligence PRIVATE AND PUBLIC BLACKLISTS There are over 200 publicly available lists currently being used by smaller ISPs and corporations to protect their systems and their users from unsolicited bulk email (spam). Being listed in one of these lists will prevent email from being delivered from any listed servers to the users of these blacklists. Private email blocking systems are those developed and maintained internally by corporations or ISPs such as AOL, RoadRunner and CriticalPath, whereby they create their own rule set or list of IP addresses or servers they choose to block. ISPs such as Hotmail and Earthlink/Mindspring use both their own home- grown blacklists/filtering methods and a 3rd party email filtering company for their customers. SPAMHAUS Spamhaus The Spamhaus Project operates lists which have the biggest deliverability impact on most senders. It runs the Spamhaus Block List (SBL) and the Exploits Block List (XBL), and maintains the Register of Known Spamming Operations (ROKSO). A team of volunteers located all over the world maintains the Spamhaus Project. The SBL is widely used and protects as many as 40 million mailboxes. SBL The SBL is a real-time database of IP addresses of verified spam sources (including spammers, spam gangs and spam support services), maintained by the Spamhaus Project team and supplied as a free service to help email administrators better manage incoming email streams. This is one of the more respected blacklists and a listing on the SBL can significantly impact deliverability. XBL The XBL is a database of IP addresses of exploited machines. It is currently a mirror of the data from another blacklist (the Composite Block List (CBL) from http://cbl.abuseat.org). This list is a technical list designed to catch and stop infected or compromised servers from sending spam. ROKSO The Register of Known Spamming Operations lists hard-core spammers who have been kicked off 3 or more Internet Service Providers. MINOR BLACKLISTS Many blacklists are privately run, and are much smaller in scope than Spamhaus. As a result, they will have little to no impact on overall deliverability, but are essential to providing senders with warning signs for their mailing practices. Often, this type of listing is a precursor to more problems to come. SpamCop SpamCop lists spam sources based on reports from users of the SpamCop reporting system. SpamCop attempts to estimate the level of spam/legitimate traffic from each address reported. SpamCop is highly aggressive, and their processes result in numerous false positives, typically legitimate list traffic running COI (confirmed opt-in). Because of this, SpamCop is not widely used at major ISPs, and a listing does not have a large impact on the average mailing list. SORBS The Spam and Open Relay Blocking System (SORBS) was started in 2002 and lists servers that have been compromised. Over the years SORBS has expanded over time to include hacked and hijacked servers, formmail scripts, trojan infestations (particularly those with backdoors), and has more recently made the move to preemptively list blocks of dynamically allocated IP address space. More information is available at http://www.us.sorbs.net/faq/ Copyright © 2020, Oracle and/or its affiliates. All rights reserved. 2 BRIEF / Blacklists Deliverability Intelligence ORACLE IMPACT Oracle is a devoted practitioner of permission-based marketing, utilizing industry best practices for all clients. With false positives and the arbitrary nature of some small, independent blacklisting services, keeping off 100% of all available blacklists may not be possible. Our goal is to minimize email blocking for all our clients, and our entire staff is dedicated to that goal. Oracle has developed a blacklist monitoring tool that regularly checks each client’s IP address and then sends out an email alert to our deliverability monitoring team with the status. The lists that Oracle monitors can be changed or adjusted at any time. We developed the current list by determining which blacklists have the most market share and are mostly widely used. It is typically only these blacklists that could have a significant impact on a client’s overall email deliverability. We take blacklisting very seriously and work with our clients to ensure that they stay off blacklists. Oracle has an internal team devoted to deliverability and ISP relations, which includes relationships with the better-recognized email blocking groups and blacklists. We also utilize external resources, including email industry associations such as the ESPC and other professionals, to resolve blacklist-related issues. Although Oracle can help clients improve email deliverability, eliminating false positives is an ongoing challenge for all email including legitimate email marketers and ESPs. Copyright © 2020, Oracle and/or its affiliates. All rights reserved. 3 BRIEF / Blacklists Deliverability Intelligence .
Load more

Recommended publications
  • Trendmicro™ Hosted Email Security
    TrendMicro™ Hosted Email Security Best Practice Guide Trend Micro Incorporated reserves the right to make changes to this document and to the products described herein without notice. The names of companies, products, people, characters, and/or data mentioned herein are fictitious and are in no way intended to represent any real individual, company, product, or event, unless otherwise noted. Complying with all applicable copyright laws is the responsibility of the user. Copyright © 2016 Trend Micro Incorporated. All rights reserved. Trend Micro, the Trend Micro t-ball logo, and TrendLabs are trademarks or registered trademarks of Trend Micro, Incorporated. All other brand and product names may be trademarks or registered trademarks of their respective companies or organizations. No part of this publication may be reproduced, photocopied, stored in a retrieval system, or transmitted without the express prior written consent of Trend Micro Incorporated. Authors : Michael Mortiz, Jefferson Gonzaga Editorial : Jason Zhang Released : June 2016 Table of Contents 1 Best Practice Configurations ................................................................................................................................. 8 1.1 Activating a domain ....................................................................................................................................... 8 1.2 Adding Approved/Blocked Sender ................................................................................................................ 8 1.3 HES order
    [Show full text]
  • Show Me the Money: Characterizing Spam-Advertised Revenue
    Show Me the Money: Characterizing Spam-advertised Revenue Chris Kanich∗ Nicholas Weavery Damon McCoy∗ Tristan Halvorson∗ Christian Kreibichy Kirill Levchenko∗ Vern Paxsonyz Geoffrey M. Voelker∗ Stefan Savage∗ ∗ y Department of Computer Science and Engineering International Computer Science Institute University of California, San Diego Berkeley, CA z Computer Science Division University of California, Berkeley Abstract money at all [6]. This situation has the potential to distort Modern spam is ultimately driven by product sales: policy and investment decisions that are otherwise driven goods purchased by customers online. However, while by intuition rather than evidence. this model is easy to state in the abstract, our under- In this paper we make two contributions to improving standing of the concrete business environment—how this state of affairs using measurement-based methods to many orders, of what kind, from which customers, for estimate: how much—is poor at best. This situation is unsurpris- ing since such sellers typically operate under question- • Order volume. We describe a general technique— able legal footing, with “ground truth” data rarely avail- purchase pair—for estimating the number of orders able to the public. However, absent quantifiable empiri- received (and hence revenue) via on-line store order cal data, “guesstimates” operate unchecked and can dis- numbering. We use this approach to establish rough, tort both policy making and our choice of appropri- but well-founded, monthly order volume estimates ate interventions. In this paper, we describe two infer- for many of the leading “affiliate programs” selling ence techniques for peering inside the business opera- counterfeit pharmaceuticals and software. tions of spam-advertised enterprises: purchase pair and • Purchasing behavior.
    [Show full text]
  • Zambia and Spam
    ZAMNET COMMUNICATION SYSTEMS LTD (ZAMBIA) Spam – The Zambian Experience Submission to ITU WSIS Thematic meeting on countering Spam By: Annabel S Kangombe – Maseko June 2004 Table of Contents 1.0 Introduction 1 1.1 What is spam? 1 1.2 The nature of Spam 1 1.3 Statistics 2 2.0 Technical view 4 2.1 Main Sources of Spam 4 2.1.1 Harvesting 4 2.1.2 Dictionary Attacks 4 2.1.3 Open Relays 4 2.1.4 Email databases 4 2.1.5 Inadequacies in the SMTP protocol 4 2.2 Effects of Spam 5 2.3 The fight against spam 5 2.3.1 Blacklists 6 2.3.2 White lists 6 2.3.3 Dial‐up Lists (DUL) 6 2.3.4 Spam filtering programs 6 2.4 Challenges of fighting spam 7 3.0 Legal Framework 9 3.1 Laws against spam in Zambia 9 3.2 International Regulations or Laws 9 3.2.1 US State Laws 9 3.2.2 The USA’s CAN‐SPAM Act 10 4.0 The Way forward 11 4.1 A global effort 11 4.2 Collaboration between ISPs 11 4.3 Strengthening Anti‐spam regulation 11 4.4 User education 11 4.5 Source authentication 12 4.6 Rewriting the Internet Mail Exchange protocol 12 1.0 Introduction I get to the office in the morning, walk to my desk and switch on the computer. One of the first things I do after checking the status of the network devices is to check my email.
    [Show full text]
  • Email Phishing for IT Providers How Phishing Emails Have Changed and How to Protect Your IT Clients
    Email Phishing for IT Providers How phishing emails have changed and how to protect your IT clients 1 © 2016 Calyptix Security Corporation. All rights reserved. I [email protected] I (800) 650 – 8930 (800) 650-8930 I [email protected] Contents Introduction ............................................................................................ 2 Phishing overview .................................................................................. 3 Trends in phishing emails ...................................................................... 6 Email phishing tactics .......................................................................... 11 Steps for MSP & VARS .......................................................................... 24 Advice for your clients .......................................................................... 29 Sources .................................................................................................. 35 1 © 2016 Calyptix Security Corporation. All rights reserved. I [email protected] I (800) 650 – 8930 Introduction There are only so many ways to break into a bank. You can march through the door. You can climb through a window. You can tunnel through the floor. There is the service entrance, the employee entrance, and access on the roof. Criminals who want to rob a bank will probably use an open route – such as a side door. It’s easier than breaking down a wall. Criminals who want to break into your network face a similar challenge. They need to enter. They can look for a weakness in your
    [Show full text]
  • CUB Guide to Fighting Robocalls
    CitizensUtilityBoard.org 1-800-669-5556 Guide to Fighting Robocalls February 2021 The latest news on the robocall fi ght Robocalls are prerecorded messages from computer-generat- ed dialers, and Illinois is one of the nation’s hardest hit states. In early 2021, for example, the state received more than 153 million robocalls (about 57 per second) in the span of just one month. That ranked Illinois eighth in the country for these calls, according to the robocall-blocking fi rm YouMail. While there are helpful robocalls (alerting you to school closings or when a prescription is ready), YouMail estimates about 42 percent of the calls in Illinois were scams and another 22 percent were simply marketing pitches. Unwanted robocalls are annoying, and costly. The Federal Com- munications Commission (FCC) put the price tag at $3 billion a year just from lost time, not even counting any fraud. TechRe- One in 10 Americans public put the total annual loss for consumers at $9.5 billion. are scammed each year, While policymakers are fi nally starting to act against illegal robo- calls, don’t wait for federal law to catch up. Use the simple tips in resulting in an annual loss of this guide to protect yourself from unwanted calls. The law The Telephone Robocall Abuse Criminal Enforcement and $9.5 billion Deterrence (TRACED) Act became federal law in 2019. The act increases penalties and requires phone companies to validate Source: TechRepublic, calls before they reach you. This is to combat “spoofi ng,” October 2019 when a robocaller uses your area code and/or prefi x to ap- pear as if someone locally—maybe a friend or neighbor—is Note: In December 2020, the FCC ordered that organiza- trying to reach you.
    [Show full text]
  • Locating Spambots on the Internet
    BOTMAGNIFIER: Locating Spambots on the Internet Gianluca Stringhinix, Thorsten Holzz, Brett Stone-Grossx, Christopher Kruegelx, and Giovanni Vignax xUniversity of California, Santa Barbara z Ruhr-University Bochum fgianluca,bstone,chris,[email protected] [email protected] Abstract the world-wide email traffic [20], and a lucrative busi- Unsolicited bulk email (spam) is used by cyber- ness has emerged around them [12]. The content of spam criminals to lure users into scams and to spread mal- emails lures users into scams, promises to sell cheap ware infections. Most of these unwanted messages are goods and pharmaceutical products, and spreads mali- sent by spam botnets, which are networks of compro- cious software by distributing links to websites that per- mised machines under the control of a single (malicious) form drive-by download attacks [24]. entity. Often, these botnets are rented out to particular Recent studies indicate that, nowadays, about 85% of groups to carry out spam campaigns, in which similar the overall spam traffic on the Internet is sent with the mail messages are sent to a large group of Internet users help of spamming botnets [20,36]. Botnets are networks in a short amount of time. Tracking the bot-infected hosts of compromised machines under the direction of a sin- that participate in spam campaigns, and attributing these gle entity, the so-called botmaster. While different bot- hosts to spam botnets that are active on the Internet, are nets serve different, nefarious goals, one important pur- challenging but important tasks. In particular, this infor- pose of botnets is the distribution of spam emails.
    [Show full text]
  • A Survey of Learning-Based Techniques of Email Spam Filtering
    View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by Unitn-eprints Research A SURVEY OF LEARNING-BASED TECHNIQUES OF EMAIL SPAM FILTERING Enrico Blanzieri and Anton Bryl January 2008 (Updated version) Technical Report # DIT-06-056 A Survey of Learning-Based Techniques of Email Spam Filtering Enrico Blanzieri, University of Trento, Italy, and Anton Bryl University of Trento, Italy, Create-Net, Italy [email protected] January 11, 2008 Abstract vertising pornography, pyramid schemes, etc. [68]. The total worldwide financial losses caused by spam Email spam is one of the major problems of the to- in 2005 were estimated by Ferris Research Analyzer day’s Internet, bringing financial damage to compa- Information Service at $50 billion [31]. nies and annoying individual users. Among the ap- Lately, Goodman et al. [39] presented an overview proaches developed to stop spam, filtering is an im- of the field of anti-spam protection, giving a brief portant and popular one. In this paper we give an history of spam and anti-spam and describing major overview of the state of the art of machine learn- directions of development. They are quite optimistic ing applications for spam filtering, and of the ways in their conclusions, indicating learning-based spam of evaluation and comparison of different filtering recognition, together with anti-spoofing technologies methods. We also provide a brief description of and economic approaches, as one of the measures other branches of anti-spam protection and discuss which together will probably lead to the final victory the use of various approaches in commercial and non- over email spammers in the near future.
    [Show full text]
  • Detecting Phishing in Emails Srikanth Palla and Ram Dantu, University of North Texas, Denton, TX
    1 Detecting Phishing in Emails Srikanth Palla and Ram Dantu, University of North Texas, Denton, TX announcements. The third category of spammers is called Abstract — Phishing attackers misrepresent the true sender and phishers. Phishing attackers misrepresent the true sender and steal consumers' personal identity data and financial account steal the consumers' personal identity data and financial credentials. Though phishers try to counterfeit the websites in account credentials. These spammers send spoofed emails and the content, they do not have access to all the fields in the lead consumers to counterfeit websites designed to trick email header. Our classification method is based on the recipients into divulging financial data such as credit card information provided in the email header (rather than the numbers, account usernames, passwords and social security content of the email). We believe the phisher cannot modify numbers. By hijacking brand names of banks, e-retailers and the complete header, though he can forge certain fields. We credit card companies, phishers often convince the recipients based our classification on three kinds of analyses on the to respond. Legislation can not help since a majority number header: DNS-based header analysis, Social Network analysis of phishers do not belong to the United States. In this paper we and Wantedness analysis. In the DNS-based header analysis, present a new method for recognizing phishing attacks so that we classified the corpus into 8 buckets and used social the consumers can be vigilant and not fall prey to these network analysis to further reduce the false positives. We counterfeit websites. Based on the relation between credibility introduced a concept of wantedness and credibility, and and phishing frequency, we classify the phishers into i) derived equations to calculate the wantedness values of the Prospective Phishers ii) Suspects iii) Recent Phishers iv) Serial email senders.
    [Show full text]
  • Efficient Spam Filtering System Based on Smart Cooperative Subjective and Objective Methods*
    Int. J. Communications, Network and System Sciences, 2013, 6, 88-99 http://dx.doi.org/10.4236/ijcns.2013.62011 Published Online February 2013 (http://www.scirp.org/journal/ijcns) Efficient Spam Filtering System Based on Smart * Cooperative Subjective and Objective Methods Samir A. Elsagheer Mohamed1,2 1College of Computer, Qassim University, Qassim, KSA 2Electrical Engineering Department, Faculty of Engineering, Aswan University, Aswan, Egypt Email: [email protected], [email protected] Received September 17, 2012; revised January 16, 2013; accepted January 25, 2013 ABSTRACT Most of the spam filtering techniques are based on objective methods such as the content filtering and DNS/reverse DNS checks. Recently, some cooperative subjective spam filtering techniques are proposed. Objective methods suffer from the false positive and false negative classification. Objective methods based on the content filtering are time con- suming and resource demanding. They are inaccurate and require continuous update to cope with newly invented spammer’s tricks. On the other side, the existing subjective proposals have some drawbacks like the attacks from mali- cious users that make them unreliable and the privacy. In this paper, we propose an efficient spam filtering system that is based on a smart cooperative subjective technique for content filtering in addition to the fastest and the most reliable non-content-based objective methods. The system combines several applications. The first is a web-based system that we have developed based on the proposed technique. A server application having extra features suitable for the enter- prises and closed work groups is a second part of the system. Another part is a set of standard web services that allow any existing email server or email client to interact with the system.
    [Show full text]
  • Account Administrator's Guide
    ePrism Email Security Account Administrator’s Guide - V10.4 4225 Executive Sq, Ste 1600 Give us a call: Send us an email: For more info, visit us at: La Jolla, CA 92037-1487 1-800-782-3762 [email protected] www.edgewave.com © 2001—2016 EdgeWave. All rights reserved. The EdgeWave logo is a trademark of EdgeWave Inc. All other trademarks and registered trademarks are hereby acknowledged. Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Other product and company names mentioned herein may be the trademarks of their respective owners. The Email Security software and its documentation are copyrighted materials. Law prohibits making unauthorized copies. No part of this software or documentation may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into another language without prior permission of EdgeWave. 10.4 Contents Chapter 1 Overview 1 Overview of Services 1 Email Filtering (EMF) 2 Archive 3 Continuity 3 Encryption 4 Data Loss Protection (DLP) 4 Personal Health Information 4 Personal Financial Information 5 Document Conventions 6 Other Conventions 6 Supported Browsers 7 Reporting Spam to EdgeWave 7 Contacting Us 7 Additional Resources 7 Chapter 2 Portal Overview 8 Navigation Tree 9 Work Area 10 Navigation Icons 10 Getting Started 11 Logging into the portal for the first time 11 Logging into the portal after registration 12 Changing Your Personal Information 12 Configuring Accounts 12 Chapter 3 EdgeWave Administrator
    [Show full text]
  • IFIP AICT 394, Pp
    A Scalable Spam Filtering Architecture Nuno Ferreira1, Gracinda Carvalho1, and Paulo Rogério Pereira2 1 Universidade Aberta, Portugal 2 INESC-ID, Instituto Superior Técnico, Technical University of Lisbon, Portugal [email protected], [email protected], [email protected] Abstract. The proposed spam filtering architecture for MTA1 servers is a component based architecture that allows distributed processing and centralized knowledge. This architecture allows heterogeneous systems to coexist and benefit from a centralized knowledge source and filtering rules. MTA servers in the infrastructure contribute to a common knowledge, allowing for a more rational resource usage. The architecture is fully scalable, ranging from all-in- one system with minimal components instances, to multiple components instances distributed across multiple systems. Filtering rules can be implemented as independent modules that can be added, removed or modified without impact on MTA servers operation. A proof-of-concept solution was developed. Most of spam is filtered due to a grey-listing effect from the architecture itself. Using simple filters as Domain Name System black and white lists, and Sender Policy Framework validation, it is possible to guarantee a spam filtering effective, efficient and virtually without false positives. Keywords: spam filtering, distributed architecture, component based, centralized knowledge, heterogeneous system, scalable deployment, dynamic rules, modular implementation. 1 Introduction Internet mail spam2 is a problem for most organizations and individuals. Receiving spam on mobile devices, and on other connected appliances, is yet a bigger problem, as these platforms are not the most appropriate for spam filtering. Spam can be seen as belonging to one of two major categories: Fraud and Commercial.
    [Show full text]
  • That Ain't You: Detecting Spearphishing Emails Before They
    That Ain't You: Blocking Spearphishing Emails Before They Are Sent Gianluca Stringhinix and Olivier Thonnardz xUniversity College London z Amadeus [email protected] [email protected] Abstract 1 Introduction Companies and organizations are constantly under One of the ways in which attackers try to steal sen- attack by cybercriminals trying to infiltrate corpo- sitive information from corporations is by sending rate networks with the ultimate goal of stealing sen- spearphishing emails. This type of emails typically sitive information from the company. Such an attack appear to be sent by one of the victim's cowork- is often started by sending a spearphishing email. At- ers, but have instead been crafted by an attacker. tackers can breach into a company's network in many A particularly insidious type of spearphishing emails ways, for example by leveraging advanced malware are the ones that do not only claim to come from schemes [21]. After entering the network, attackers a trusted party, but were actually sent from that will perform additional activities aimed at gaining party's legitimate email account that was compro- access to more computers in the network, until they mised in the first place. In this paper, we pro- are able to reach the sensitive information that they pose a radical change of focus in the techniques used are looking for. This process is called lateral move- for detecting such malicious emails: instead of look- ment. Attackers typically infiltrate a corporate net- ing for particular features that are indicative of at- work, gain access to internal machines within a com- tack emails, we look for possible indicators of im- pany and acquire sensitive information by sending personation of the legitimate owners.
    [Show full text]