Deluge of of entries to Spamhaus blocklists includes 'various household names'
- Reference: 1660802347
- News link: https://www.theregister.co.uk/2022/08/18/deluge_of_entries_to_spamhaus/
- Source link:
"Our researchers are observing mail being repeatedly sent to multiple mailboxes that have NEVER accepted one single message from the sender," [1]said Spamhaus, which specified that some of the bad behavior it was detecting came from companies it described as "household names".
Spamhaus regularly changes how it assesses spam and handles blocklists. Getting listed on an SBL will get an IP blocked from sending mail. In 2016, the company started issuing its informational listings as a less harsh early warning system to less egregious offenders, so they had a chance to clean up their email hygiene before getting blocked.
[2]Email blocklisting: A Christmas gift from Microsoft that Linode can't seem to return
[3]The curious case of Spamhaus, a port scanning scandal, and an apparent U-turn
[4]FBI spams thousands with fake infosec advice after 'software misconfiguration'
[5]Google gets the green light to flood US Gmail inboxes with political spam
Speculation in parts of the [6]mass email sending community is that Spamhaus has found itself a finer-toothed comb to sort through offending companies, resulting in the growth of SBL listings.
The result is frustrated email service providers and customer relationship managers feeling blindsided by multiple listings that come out of the blue.
[7]
"Oh great, our corporate domain … has just been listed on the Spamhaus DBL. Has that domain sent any spam? Nope. Will Spamhaus tell me why they listed it? Nope. Should ISPs stop using Spamhaus to filter email? Yup," complained one [8]Twitter user.
[9]
Another [10]Twitterer complained about being stuck on a list and bounced back and forth between Spamhaus and their webhost to resolve whey they were unable to post, even after delisting.
Just to be clear, Spamhaus wants everyone to know this is the result of "Poor. Sending. Practices." Those practices include not managing bounces effectively, disregarding opt-in procedures, and not enlisting sunset policies so a period of non-engagement from the email recipient triggers discontinuation of contact.
[11]
"With the recent spate of listings, most of the senders I've worked with have landed in the proverbial doghaus after reaching too far back into their unengaged audience, often for a (sigh) blast, or a T&Cs update," explained email marketing compliance and enablement professional Alison G. on [12]LinkedIn .
And while this might be a headache for many, Alison G. puts a positive spin on it. "While prone to sarcasm, I sincerely consider these listings to be a kindness. As stressful as it can be to find out you're on the Haus's radar, they're doing you a favor by extending an opportunity to improve sending behavior prior to instituting an active block." ®
Get our [13]Tech Resources
[1] https://www.spamhaus.org/news/article/818/poor-sending-practices-trigger-a-tidal-wave-of-informational-listings
[2] https://www.theregister.com/2022/01/17/linode_microsoft_email/
[3] https://www.theregister.com/2019/04/16/spamhaus_port_scans/
[4] https://www.theregister.com/2021/11/15/fbi_fake_emails/
[5] https://www.theregister.com/2022/08/11/google_political_spam/
[6] https://www.spamresource.com/2022/08/spamhaus-just-woke-up-are-you-ready.html
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yv4N2ud0nRpOJYWTVgRi@gAAAEg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[8] https://twitter.com/PartTimeSnob/status/1559982177101701120
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yv4N2ud0nRpOJYWTVgRi@gAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://twitter.com/anaxcrosswords/status/1557826498861604865
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yv4N2ud0nRpOJYWTVgRi@gAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.linkedin.com/posts/activity-6955653607400640514-FpHV/?utm_source=linkedin_share&utm_medium=member_desktop_web
[13] https://whitepapers.theregister.com/
Re: IT much?
I ran my own email server for years but I gave up in the end because Spamhaus kept blocking basically any email coming from my ISP's range. I had a static IP from them and I had SPF records set up and never sent any spam, just normal work and family & friends emails. But I got blocked anyway.
So, yeah, fuck 'em.
Re: IT much?
I had similar problems with Spamhaus. It took an age to get unblocked and there was never any evidence to support their reasons for blocking.... No-one else was blocking our email servers, we sent very few e-mails and in the end some of our clients setup email accounts with providers who weren't using Spamhaus in order to continue working.
This was some years ago so perhaps it's better now and I haven't had any problems with them for several years now.....
I appreciate that it's a sad reality that we need services like Spamhaus and I even use them myself but it's a huge pain in the doodahs when you get in their bad books through no fault of your own with no way to get out.....
Re: IT much?
I too run my own mail server and when my I ended up on a blocked list it was because the smarthost I was using was the offending spam-merchant. I stopped using the smarthost and set up an SPF record but some months later got on to a Spamhaus blocklist because my fixed IP was not on their list of 'authorised mail senders' (Who knew there was one?).
Getting myself removed was relatively simple. Their unblocking service web page had an option to select if you run your own mail server. I chose that and within a few hours I could send mail again.
accor hotels are on there I hope. never using them again.
Lack of feedback
One of my clients was blocked on Tuesday and we can find no evidence of any spam being sent, either on the mail server itself, on in the NAT sessions list on the firewall.
If they just included the sender and the subject of the offending email, or the message id, or some bit of info that would help narrow it down it would help enormously.
In this particular case there was only a handful of people in the office but it still wasted hours of our time in investigating potential sources.
Re: Lack of feedback
"In this particular case there was only a handful of people in the office but it still wasted hours of our time in investigating potential sources."
Well, there you have it - Spamhaus's time wasn't wasted, so why would they care?
I'm surprised they haven't been sued for libel if they're not prepared to justify listing.
Now you mention it, I do wonder why nobody's done this yet. Especially in the English courts, where that sort of thing can get very messy and very expensive very quickly.
I've had problems with them for years. One of my clients who is an international film house and distributor was trying to email Channel 4 from their dedicated server and it wasn't going through (this was almost 20 years ago). Just disappearing into the ether. The server was thoroughly checked and there were no breaches or spam being sent. In the end Spamhaus had blocked an entire range (not just a block) because of one offending IP. This just seems draconian at best. It's akin to blocking a whole council estate because of what is happening in one house in a set of huge tower blocks.
I get why server admins use Spamhaus, but they must miss A LOT of genuine communication by doing so. Seems more trouble than it's worth to be honest.
IT much?
It's amusing when somebody screams about Spamhaus being a corrupt shadowy net traffic overlord conspiracy because they're blocked without ANY spam being sent, but they're outsourcing e-mail to a 3rd party. Quoted Tweeter #1 is outsourcing mail to the global king of phishing, Google. Tweeter #2 is complaining about Spamhaus without being listed on Spamhaus so I'm not sure what the actual complaint is.
Spamhaus is an opt-in feature on the receiving end. It's used because people like it.