nanog mailing list archives

Re: anybody else been spammed by "no-ip.com" yet?


From: Scott Granados <scott () graphidelix net>
Date: Fri, 3 May 2002 18:51:54 -0700 (PDT)


I do agree here that using fake addressing and so on is really bad on 
many levels.  I know on one of the networks I was involved in recently 
we had a customer who was a spammer and I pulled his services very 
quickly, some might even say to quickly.  I also realize that even 
though I personally don't find it to bad to to deal with others don't 
agree so like I stated my professional policy differs from what I do 
personally.

On Fri, 3 May 2002, Forrest W. Christian wrote:

On Fri, 3 May 2002, Scott Granados wrote:

deal with spam is.  Honestly sure I get it like everyone else, in some
of my accounts more than others but I also get a real truckload in my
snailmail box.  Just as with all the pottery barn catalogs <no offense
to pottery barn I guess>:) I have a delete key just like my trash can.
I know at one time the argument was made, and quite correctly that
people were paying to receive this service and these messages cost them
money. Today with flat rate access and many people not paying on a per
packet basis it seems to me that the responsibility lies with the end
user to filter properly and or dress that delete key.  I always shut
down customers who spam and disrupt service simply because I don't want
the backlash or want specific ips blocked but in a way I don't feel its
right that the carriers do the filtering it seems tome up to the end
user.

Let me put this into real world terms.

I run a mail server (among other things) with about 4000 mailboxes, and
about 40,000 messages a day.

over 85% of all mail on average is marked as spam by spamassasin on this
mail server.

I, late last year, had to upgrade it to a multiprocessor box with
gigabytes of memory, striped raid 0+1, etc. etc. etc. to handle the load.

I could have used a mail server only 15% of the size of this one.  Or
better put, I could have used a 300mhz pentium III box with low-end IDE
drives and a modest amount (256MB) of memory instead of the Dual PRocessor
6-SCSI 2GB ram thing we are running now.

Add to that the 8-10 hours a week we spend cleaning up messes related to
spammers who decide that sending 50,000+ messages as fast as they can to
us is a good thing.   For instance, on thursday of last week, we took
almost 5000 messages in about a hour from one spammer in particular.  The
mail server *can't* handle this load so it basically was a Denial of
Service attack.

Right now there are 5000 messages in our mail queue which are spam bounces
which aren't being accepted by the spammer's mail server.

I could go on and on and on and on.

I might be more inclined to tolerate the spammers if they weren't bad net
citizens.  They forge their email addressses so they can't receive
bounces.  They don't have any consideration about the load they are
placing on the remote mail server (I've seen 40 streams open at once to my
mail server from the same class C - all injecting mail as fast as
possible).   And on and on and on.

- Forrest W. Christian (forrestc () imach com) AC7DE
----------------------------------------------------------------------
The Innovation Machine Ltd.                              P.O. Box 5749
http://www.imach.com/                                Helena, MT  59604
Home of PacketFlux Technogies and BackupDNS.com         (406)-442-6648
----------------------------------------------------------------------
      Protect your personal freedoms - visit http://www.lp.org/



Current thread: