- NZNOG - lists.nznog.org

RE: [nznog] IP / domain blocking for SPAM prevention
by Richard Parkinson 25 Sep '03

25 Sep '03

If in saying "filters" you mean, delivers it to a folder along with hoards of other junk for some poor admin to check to ensure there is no legitimate mail in the pile... Yep. I don't find this a great task though. A quick sort by subject, or sender and you quickly wipe out all the crap, leaving a handful of legitimate emails to let through. This might be a painful task for larger sites such as Massey or an ISP. Cheers, Richard. -----Original Message----- From: Steve Withers [mailto:swithers(a)mmp.org.nz] Sent: Friday, 26 September 2003 10:39 a.m. To: NZ NOG Subject: [nznog] IP / domain blocking for SPAM prevention Further comments on IP and domain blocking for *personal* mail servers: Just checked my maillog from yesterday. 70% of rejected mail connects came from hotmail, yahoo, earthlink and aol. 30% came from the 61.* and 218.* Korean IP spaces 10% was rejected by ordb / relay denied / other blocked domains I have wondered if ISPs want to encourage customers to set up individually customisable mailservers on broadband connections - some sort of appliance - that acts as their mail server. Let the business and competent private users decide what they will and won't receive....with benefits to the ISP in terms of reduced bandwidth consumed as spam isn't deliverable to these people. Just lots of rejected connect attempts. This may even be a managed service an ISP could offer a customer / business. If payment is on data-volume, this could help reduce such charges - offsetting any service fee to some extent. Am I right in thinking Mailmarshall still allows the spam to be delivered? It just filters it. The method above prevents delivery. It would be impossible to do this at ISP level....but it may be a service line an ISP might like to offer a client who wants to define what they do and do not receive. -- Steve Withers <swithers(a)mmp.org.nz> _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

RE: [nznog] Argghhh.... [Fwd: Your e-mail message was blocked]
by Richard Parkinson 25 Sep '03

25 Sep '03

Happy with MailMarshal here :) Works fine if you put the effort into setting it up properly. -----Original Message----- From: Juha Saarinen [mailto:juha(a)saarinen.org] Sent: Friday, 26 September 2003 10:12 a.m. To: Frank March Cc: ActionLine; nznog(a)list.waikato.ac.nz; Jennifer Mortimer Subject: Re: [nznog] Argghhh.... [Fwd: Your e-mail message was blocked] Frank March wrote: > Although I seldom post to this list (and when I do it is arguably > off-topic on occasions), and most of the traffic is of marginal direct > interest to me, I do find this list useful as a gauge of the > temperature and general health of the Net in NZ which is immensely > valuable for my job. However, if the problem persists, and complaints > persist, I will remove myself from the list. I would regard this as > being a very unfortunate outcome. > > And, by the way, and anticipating a message later in the thread from > Juha, I dont ever recall his swearing at me (about me perhaps....) $&@)#*&$@!!! Did you delete the message??? ;-) No, seriously, use a Hotmail account for the list instead of your MED one. Mail Marshal is a blunderbuss approach for dealing with an admittedly difficult problem and I don't know anyone "protected" by it who is happy with it. There's an important issue here to consider as well: as a civil servant, you presumably need to be accessible to the public. Using a filtering system with a high false positive rate prevents that. Oh hi, Donald. Yes, yes, I know, it's OT for the list... -- Juha _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Argghhh.... [Fwd: Your e-mail message was blocked]]
by Steve Withers 25 Sep '03

25 Sep '03

On Fri, 2003-09-26 at 09:39, Frank March wrote: > On average Mailmarshal as configured here seems to catch 50% of genuine spam > 'aimed' at me (but is getting better) and about 25% of the blocking messages > are false positives (despite recent problems with this list, I think this > might also be improving incrementally). Nevertheless, personally, I would > much rather have the spam. The record with virus filtering is, however, > exemplary. I had to stop using the junk filter in Outlook because it decided that ALL mail from my boss was spam. I still don't know why. I don't use any server-based spam detection. Because my mailserver is for our family only I do block entire IP ranges and about 450 domain names. We get perhaps 2 spam e-mails through each day between the 4 of us. However...I block all mail from hotmail, yahoo, aol and a few others. That killed a HUGE amount of dross. Senders get a reject message explaining that their domains are the source of too much spam and would they mind resending from a responsible ISP. This also means I often don't see e-mail from people on mailing lists who use these "junk" domains....though this depends on how the list server is configured. -- Steve Withers swithers(a)mmp.org.nz -- Steve Withers <swithers(a)mmp.org.nz>

1 0

RE: [nznog] Argghhh.... [Fwd: Your e-mail message was blocked]
by Simon Lyall 25 Sep '03

25 Sep '03

On Fri, 26 Sep 2003, Frank March wrote: > On average Mailmarshal as configured here seems to catch 50% of genuine spam > 'aimed' at me (but is getting better) and about 25% of the blocking messages > are false positives (despite recent problems with this list, I think this > might also be improving incrementally). Nevertheless, personally, I would > much rather have the spam. The record with virus filtering is, however, > exemplary. A 25% false positive rate for Spam is bad to the point of being incompetent. Anything worse than a 1% FP rate except where someone is specifically after "aggressive" filtering is very bad. That sort of rate forces people to constantly check their spam folders (I assume they can) to find incorrectly identified email. I'd hate to think how many important emails are being lost. Blocking just 50% of spam isn't very good either, especially considering the amount of legit email dropped. I would guess it's another case of the govt paying peanuts and getting monkeys. Probably they have just installed the software "out of the box" rather than engaging brain and actually trying to set it to the appropriate level for the site. -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.

1 0

California cracks down on spam
by Barry Murphy 24 Sep '03

24 Sep '03

"California will prohibit Internet advertisers from sending unsolicited emails under the toughest law of its kind in the United States, providing for fines of up to $1-million (about R7-million). Governor Gray Davis signed legislation this week that targets not only the firms that package and send spam to consumers, but also the companies whose products and services are being advertised" I especially like the last setence above. full story at: http://www.iol.co.za/index.php?click_id=79&art_id=vn20030925032433274C67959… Barry

2 1

Nokia Firewall Appliance Specials
by Steve Rielly 24 Sep '03

24 Sep '03

Hi All, We are offering for sale, the following brand new, unused, equipment with full warranties, at heavily reduced prices, as a result of a cancelled order. You may already have one of these Nokia security appliances installed, and at the reduced price may be interested in purchasing a second unit as a spare. Alternatively, with the new Check Point Express licenses offering high availability (HA) software at reasonable prices, you may wish to consider installing a second firewall for HA using one of these appliances We have not put prices on them we are looking for offers on the equipment starting at 50% of their normal RRP. The products are... Nokia BIG-IP HA+540 Firewall Appliance Nokia BIG-IP 5000 Firewall Appliance Nokia IP440 Firewall Appliance Nokia IP330 Firewall Appliance Nokia IP71 Firewall Appliance We are offering the appliance hardware only and not the Check Point software licenses that go with them. These will need to be purchased through the normal channels, or we can provide a quote for you. Please email your offers to steve.rielly(a)extranet.co.nz The highest or any offer may not necessarily be accepted. Cheers, Steve Rielly Security Engineer Extranet Technologies Limited Level 1, 60 Cook St, Auckland, New Zealand P.O. Box 7726, Wellesley Street, Auckland, New Zealand Ph: +64 9 3771122, Mob: 025 835530 Fax: +64 9 3771109

1 0

Spam systems
by Barry Murphy 24 Sep '03

24 Sep '03

Thanks to NZNog I have had my first valid emails pushed to the spam folder. I hadn't as yet had one email get marked as spam where it was intended for me, however with the last couple of emails from Jamie, David and Dan, all 3 of these got marked. I have now allowed nznog through without filtering, so this shouldn't happen again, but thanks once again for brining my ratios down!! Only jokes :) Barry

1 0

Our friends Verisign...
by Simon Byrnand 24 Sep '03

24 Sep '03

Hi all, After the discussion a few days ago about the stunt Verisign has pulled recently, and most people expressing outrage over it, I wonder how many network operators/ISP's etc are actually willing to go as far as running the patches that are surfacing for the various nameserver software that will return NXDOMAIN when a root server tries to return an A record directly instead of a referal ? (Effectively reverting the behaviour to what it was before for your customers, and fixing issues with mailservers trying to look up non-existant domains in the aid of spam detection etc etc) I guess some people that might consider doing so could be waiting for "official" patches to come out first (like the one recently released as an rc for BIND 9) rather than hacks before implementing it, but what is the general feeling about this kind of action ? Anyone want to 'fess up to doing it already ? :) (on a medium to large scale) Regards, Simon Byrnand iGRIN Internet

11 14

[Fwd: Message Stopped by: Junk Mail Inbound]
by Simon Byrnand 23 Sep '03

23 Sep '03

Ok, everyone must have it in for me tonight. I'm off to bed :) Night all.. ;) Regards, Simon ---------------------------- Original Message ---------------------------- Subject: Message Stopped by: Junk Mail Inbound From: admin(a)safecom.co.nz Date: Wed, September 24, 2003 11:17 pm To: simon(a)igrin.co.nz -------------------------------------------------------------------------- The Safecom SMTP Relay has quarantined this email due to the triggering of the Junk Mail policy. The email has been forwarded to the Mail Administrator of the intended recipients company. This Mail Administrator will forward the mail to the recipient should it be deemed as legitimate email i.e not Chainmail, Virus Hoax or Jokes. Message: BB0027f6d5.00000001.mml From: simon(a)igrin.co.nz To: Ivan.Walker(a)hpac.govt.nz Subject: [nznog] Argghhh.... [Fwd: Your e-mail message was blocked] This is an automated response. Do not reply to this message. If you have any further questions please contact the intended recipient to confirm whether they received the email.

2 1

SPAM (Fw: PLEASE ASSIST)
by Dan Clark 23 Sep '03

23 Sep '03

Hi Guys, Just wondering if it is just me that is receiving an influx of these kind of messages relating to offshore accounts and foreign money etc? These used to be common then they stopped, but now they are back. Maybe my SPAM filter has broken. Regards, Dan Clark Network Manager Scarfies.Net Ltd Wickliffe Ltd ----- Original Message ----- From: "JULIUS J BALA" <j_bala2003(a)gawab.com> To: <dan(a)scarfies.net> Sent: Wednesday, September 24, 2003 4:09 PM Subject: PLEASE ASSIST > FROM: DR. JULIUS JUBRIL BALA, > FEDERAL SECRETARIAT COMPLEX, > IKOYI. > > Best wishes of good health and success in your pursuits particularly through my proposal as contained in this letter.Before going into details of my proposal to you, I must first solicit you to treat with the utmost confidentiality, as this is required for its success. > > INTRODUCTION: > > My colleagues and I are senior officials of the Federal Government of Nigeria's Contracts Review Panel who are interested in investing some funds that are presently floating in the accounts of the Central Bank of Nigeria.In order to commence this transaction, we solicit your assistance to enable us transfer into your account the said floating funds. > > We are determined to conclude the transfer before the end of this quarter of 2003. The source of the funds are as follows: During the last military regime,government officials awarded contracts that were grossly over-invoiced to Contractors.The present civilian government set up the Contract Review Panel, which has the mandate to use the instruments of payments made available to it by the decree setting up > the panel, to review these contracts and if necessary pay those who are being owed outstanding amounts. My colleagues and I have identified quite a huge sum of these funds which are presently floating in the Central Bank of Nigeria ready for disbursement and would like to invest some of it for our own purposes. > > However, by virtue of our positions as civil servants and members of this panel,we cannot acquire these funds in our names or in the names of companies that are based in Nigeria. I have therefore been mandated, as a matter of trust by my colleagues in the panel, to look for a reliable overseas partner into whose account we can transfer the sum of U.S.$16,500,000.00(sixteen million,five hundred thousand U.S. Dollars). That is why I am writing you this letter. > > We have agreed to share the money to be transferred into your account,if you agree with our proposition as follows; (i) 10% to the account owner (you). (ii) 80% for us (the panel officials). (iii) 10% to be used in settling all expenses (by both you and us )incidental to the actualisation of this project. We wish to invest our share of the proceeds of this project in foreign stock markets and other business till we are > ready and able to have access to them without raising any eyebrows here at home. > > Please note that this transaction is 100% safe. We intend to effect the transfer within fourteen(14) banking days from the date of receipt of the following information: Your name, company's name, address,telephone and fax numbers . The above information will enable us write letters of claim and job description respectively. This way, we will use your company's name to apply for the payment and backdate the award of the contract to your company. We are looking forward to carrying out this transaction with you and we solicit your utmost confidentiality in its execution. > > Please acknowledge the receipt of this email by replying urgently. Also,endeavour to furnish me with your phone number so that I can call you and bring you into a more detailed picture of this transaction when I hear from you. > > Best regards, > > Dr Julius Bala. > > > >

4 4