Recent issue with SORBS

[Jon Radel]

Ken A wrote:

> That's the killer right there. You will find yourself listed by SORBS,
> and probably re-listed even if you pay the 'donation to charity' that
> they require in some cases. SORBS and others tend to list on /24 or
> larger blocks, probably just for ease of maintenance. Do a reverse
> lookup on all the IPs in your range. If they come back as 'xxx'
> 'marketing' and 'warez' or similar, move your hosting. It's not worth
> the pain. :-\

Whatever one might think of their tactics, I *have* found what SORBs
says they will do and what they actually do to match pretty closely.
They are pretty explicit about the fact that will list entire netblocks
when listing single addresses doesn't appear to discourage the spammers.
  See http://www.au.sorbs.net/overview.shtml

What I can't find right now are the statements I recall that they do
this deliberately to encourage providers to give anybody who spams the
boot immediately, and to generally apply pressure by making life painful
for anybody who does business with anybody willing to host a spammer.
And I must say, much as I too was irritated when I had to clean up after
I got a tainted /20, the conversation here shows that it works.  The
only saving grace in my case was the that upstream provider in question
had an energetic staff person whose primary job was to manage spammer
tracking and delisting for other customers.

Incidentally, if you are going to analyze a problem you're having, do
yourself a huge favor and don't think solely in terms of the /24 you're
in.  Go to ARIN, RIPE, etc. and find the hierarchy of netblocks your
addresses are assigned out of.

--Jon Radel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2828 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070215/08540da1/smime.bin