rfc-ignorant.org
It maintains a number of lists (at present "dsn",
"abuse", "postmaster", "bogusmx", "whois" and
"ipwhois") which contain domains or IP networks
whose administrators choose not to obey the RFCs(pedantically
a "Request for Comments"), the building block
"rules" of the net.
A listing here simply implies that a site has
chosen not to implement the conditions described
in a particular RFC. It is, of course, up to other
sites to decide for themselves whether or not
they wish to communicate with sites that have
not chosen to implement, say, RFC2142, and have
a working "abuse@domain" address.
Put another way, rfc-ignorant.org does not block
anyone. They document who has chosen not to implement
certain protocols described in the RFCs, and provide
a means for allowing people to determine for themselves
if they wish to communicate with non-compliant
systems.
Njabl.org (Not Just Another Bogus List)
There are three ways for IP addresses to get listed.
Operating an open relay or proxy An open relay
is any system that will deliver email to any address
from any source. Spammers tend to hunt for these
systems, and then dump thousands, sometimes hundreds
of thousands of emails into these servers, which
they then spend hours or days trying to deliver
to sites all over the world. In addition to insecurely
configured mail servers, web servers with insecure
HTML form to mail gateway CGI scripts can be used
as "open relays", as can insecurely configured
proxy servers. The bottom line is if a server
can be used by any non-authenticated source to
send email to any address on the Internet, it
qualifies as an open relay and may be added to
this dnsbl.
Being a dial-up port IP or other dynamic address
Rather than hunt for open relays, some spammers
will send their email directly from a dial-up
account. In general, there's no need for a dial-up
user to talk directly to any SMTP server other
than that of their own ISP. So njabl.org is compiling
a list of dial-up port IP ranges, mostly at larger
providers where the abuse seems to be the worst,
and they add those to the list. They also include
any other IP pools that appear to be dynamically
assigned as well as NAT pools, since they are
effectively dynamic. Open proxies and trojan proxies
are so rampant now that a large percentage of
'open proxies' are actually dynamically assigned
dial-up, DSL, or cable modem IPs. These users
should all be using their own provider's SMTP
servers rather than direct-to-MX as is often done
with spam.
Operating a system that directly sends out spam
(unsolicited, bulk email, usually of a commercial
nature)
The big commercial spammers who swear they got
recipients name from an associate of an
associate who swears you visited their web site
and opted into the "all the spam you can
handle" service plan.
DNSRBL (Domain
Name System Real-time Black List)
It publishes via DNS, a list of IP addresses of
machines that they know to be either direct SPAM
sources or Dial-up (dynamic address) pools which
would never be a source of non-SPAM eMail.
DNSRBL has created a series of eMail addresses
that they use as 'Honey Pots'. They then use these
addresses to post to several bulletin boards and
usenet groups. They also have Honey Pot eMail
addresses that are used to unsubscribe to SPAM
eMail lists. They have never been subscribed to
any mail-list of any kind. SPAMMERS scan these
bulletin boards and the usenet groups for eMail
addresses. Since the only place these addresses
have been exposed are these places where SPAMMERS
'harvest' their eMail addresses, when an eMail
is received, it is analyzed to verify its source
and the eMail server generating the SPAM is placed
in our spam list.
ORDB (Open
Relay Data Base)
It stores IP-addresses of verified open SMTP
relays. These relays are, or are likely to
be, used as conduits for sending unsolicited bulk
email, also known as spam. By accessing this list,
system administrators are allowed to choose to
accept or deny email exchange with servers at
these addresses. Any blocking that occurs, takes
place at the receiving system.
|