Spam Prevention Early Warning System
|
|
The Spam Prevention Early Warning System (SPEWS) is an anonymous service which maintains a list of IP address ranges belonging to Internet service providers which host spammers. It is used by numerous Internet sites as a source of information about the senders of unsolicited bulk email, better known as spam.
SPEWS itself publishes a large text file containing its listings, and operated a database where users may query the reasons for a listing. Users of SPEWS can reprocess these data into formats usable by software for mail filtering.
For instance, until recently many mail sites used a DNSBL based on SPEWS data, operated at spews.relays.osirusoft.com. This DNSBL was shut down on August 27, 2003 after several weeks of denial of service attack. A number of other DNSBLs exist based on the SPEWS data, which remain accessible to the public via the web site.
There is a certain degree of controversy regarding SPEWS' anonymity and its methods. SPEWS remains anonymous to avoid harassment and barratrous lawsuits of the sort which have hampered other anti-spam services such as the MAPS RBL and ORBS. Some regard this anonymity as irresponsible, while others find it sensible. In addition, many ISP clients whose providers are listed on SPEWS take umbrage that their own IP addresses are associated with spamming, and that their mail may be blocked by users of the SPEWS data.
Discussions of SPEWS online have frequently degenerated into flamewars. In these, many arguments are based on misconceptions, such as the claim that SPEWS "blocks" email from listed sites. In fact, SPEWS merely publishes a listing, which mail server operators may choose to act upon in various ways, such as by blocking email from the listed address.
| Contents |
Process
The precise process by which SPEWS gathers data about spam sources is unknown, and it is likely that the operators use multiple techniques.
SPEWS seems to collect some information from honeypots -- mail servers or single email addresses to which no legitimate mail is received. These may be dummy addresses which have never sent any email (and certainly have never requested to be subscribed to mailing lists). They may also be placed as bait in the header of a Usenet post or on a Web page, where a spammer might discover them and choose to spam them.
The SPEWS Web site makes clear that when spam is received, the operators file a complaint with the ISP or other site responsible for the spam source. Only if the spam continues after this complaint is the source listed. However, SPEWS is anonymous -- when these complaints are sent, they are not marked as being from SPEWS, and the site is not told that ignoring the complaint will result in a listing. This has the effect of determining the ISP's response to a normal user's spam complaint, and also discourages "listwashing" -- continuing to spam, but with the complaining address removed from the target list.
If the spam does not stop over time, SPEWS increases the size of the address range listed. This process is repeated, conceivably until the entire netblock owned by the offending service provider is listed.
Criticism of SPEWS
No one knows how many service providers use the SPEWS list to reject mail. The number is enough, though, to make people who are listed as spammers, neighbours of spammers, or service providers of spammers quite upset.
One criticism is that it often lists IP ranges of companies that do not spam, or even have strong anti-spam policies. This is because eventually the entire area of a service provider that hosts a spammer can be affected -- something like blocking all e-mail from UUNET, in order to get UUNET to stop hosting a spammer. In particular this is sometimes seen as guilt by association.
Conceivably, entire nations could be listed if they only had a small number of ISPs, all of them with serious enough abuse problems. In particular, Nigeria and China seem to be subject to very large blocks, though by no means even a majority of either nation's network ranges are listed. Some people may feel that there is no choice for people in countries that are listed, and it becomes a matter of freedom of speech.
A large proportion of the anger regarding SPEWS is not due to the SPEWS operation itself, but because SPEWS can bring people with a moderate or ambivalent position on spam into contact with strong critics of spam.
Some mail server administrators choose to use the SPEWS "Level 2" list to outright block mail from both known spammers and spam-friendly ISPs, knowingly causing "collateral damage" against non-spamming customers of spam-friendly ISPs. While a mail server operator is under no obligation to accept mail from anyone, blocking non-spamming customers can be seen as antagonistic or by those affected. The server response may also incorrectly state that mail had been "blocked by SPEWS", which can generate great hostility against the SPEWS project itself, for people who have not previously learned of the SPEWS project and are unaware that SPEWS is not responsible for blocking anything.
Some people, already angry at having their mail blocked due to "collateral damage", ignore the advice given on the SPEWS bounce page (http://spews.org/bounce.html), which encourages them to complain to their ISP. An acceptable alternative to complaining to their own ISP would be to complain to the ISP responsible for the blocking, but some seek to contact SPEWS directly to address their grievances, which is done via the USENET newsgroups news.admin.net-abuse.blocklisting (news:news.admin.net-abuse.blocklisting) (NANABL) and news.admin.net-abuse.email (news:news.admin.net-abuse.email) (NANAE). The latter group is open to absolutely anybody, and participants include anti-spam enthusiasts and other strong-minded people, a small minority of whom prefer to antagonise and mock those who are blocked despite not spamming.
Due to their anonymity, there is nothing that the operators of SPEWS can do to disassociate themselves from NANAE hecklers or over-exuberant mail administrators, which is one aspect of the controversy regarding the SPEWS service.
Counter Argument
The most common argument is that no company is required to financially support spam. That if spam continues to increase, it may eventually make e-mail impossible. Thirdly, use of SPEWS is voluntary.
Delisting
According to the SPEWS FAQ (http://www.spews.org/faq.html), listings are removed when the spam or spam-support has stopped. Just as they do not solicit nominations for listings, the SPEWS operators do not solicit requests for delistings. There is no contact information published on the SPEWS Web site (http://www.spews.org/). There is no spews.org mail server, and the operators of SPEWS do not receive email under the SPEWS name.
It is believed that the operators read certain Usenet newsgroups related to spam and email abuse. However, they do not post, and the regulars of these newsgroups do not know their identity. Many regulars take umbrage to new posters who come under the belief that simply posting to Usenet will get their addresses removed from SPEWS -- and greater umbrage to listees who come with chips on their shoulders, behaving offensively and making threats. Posters to these groups, which include news.admin.net-abuse.email, cannot remove addresses from SPEWS -- but they can provide informed speculation on the reasons for specific listings, and advice on how to stop the problems that lead to listings.
It should also be noted that speculating as to the SPEWS operators' intent, emotional state, psychology, patience, or other private attributes is a habit, not to say a pastime, on these newsgroups. None of these speculations should be taken as authoritative. The news.admin.net-abuse.email group is also frequented by disruptive trolls, some of whom deliberately follow-up to new posters' questions about SPEWS with provocatively false responses. The moderated newsgroup news.admin.net-abuse.blocklisting is somewhat calmer.
Observers -- and SPEWS itself, in its FAQ and other documents -- have recommended several techniques to avoid or stop the spam problems which SPEWS targets with listings. These are chiefly useful to internet service providers and other network operators, though customers of listed ISPs may be able to recommend these to their providers. These techniques are not specific to those who wish to be delisted from SPEWS; rather, they are broadly useful to network operators who wish to avoid harboring spammers on their networks.
Responding to spam complaints
The SPEWS FAQ, as well as the Internet standards document RFC 2142, recommend that operators of Internet sites use standard email addresses to receive complaints about abuse and email problems. These are abuse@site and postmaster@site. Other Internet operators expect to be able to send complaints about spam to these addresses at the site responsible. Sites whose operators do not read mail sent to these addresses are likely to miss spam complaints, and be seen as unresponsive to spam problems.
Spam-fighters regard the sending of spam complaints as a courtesy to the site complained-to. Just as in some jurisdictions it is legal to shoot a neighbor's dog if it strays onto one's property and does damage, it is likewise legal to simply refuse all email from a site which emits spam. It is, by this argument, courteous to, instead, simply inform the offender of the harm being done -- so that it may put a stop to the problem (or a leash on the dog).
Sites which are seen as quickly responding to spam problems when reported are not, generally, seen in SPEWS listings.
Cleaning up after spammers
It is SPEWS' stated policy that if a site is listed by SPEWS for carrying a spam source or spam-support service as a customer, the listing will remain (or grow) unless and until the offender is no longer present on the site. That said, observers have found that site operators shutting down a spammer customer sometimes leave resources active which are of use to the spammer. Commentary on newsgroups suggests that SPEWS does not remove listings until all such resources are terminated.
A common case is a spammer operating a co-located Web site on an Web hosting provider. The Web site may be used to process orders for a product advertised in spam. The spammer might not send spam email from the same ISP which hosts the Web site, as this would lead to rapid termination under the provider's acceptable-use policies. However, spam-fighters will complain to the Web-hosting provider about this site, as it is a spam-support service essential to the spammer's illegally-promoted business.
The network harboring this site may also be added to the spammer's SPEWS listing. This frequently gets the attention of a hosting provider which has ignored complaints emailed to abuse@site. In some cases, the provider has shut down the Web site, but left auxiliary resources such as DNS and email accounts under the spammer's control -- allowing the spammer to easily relocate the money-making part of his spam operation to another site.
Observers of SPEWS have noted that SPEWS listings often are not removed until these auxiliary resources, also of use to the spammer, are removed.
For listed providers' non-spamming customers
Many of the new posters who show up in news.admin.net-abuse.email complaining about SPEWS listings are in a common situation. They are non-spamming customers of ISPs with bad reputations for hosting spammers, and they have found themselves unable to send email to sites which use SPEWS. While SPEWS' false-positive rate is relatively low for recipient sites which use it, the odds can look reversed to senders who are listed in it.
See also
External links
FAQ links
- First Post To NANAE Newsgroup (http://www.amray.net/nanaefaq.html)
- Address munging FAQ (http://members.aol.com/emailfaq/mungfaq.html)
- List of terms found in NANAE (http://www.spamfaq.net/terminology.shtml)
- The people in NANAE are seasoned war veterans who have developed their own terminology and way of doing things.
- Dave the Resurrector FAQ (http://www.killfile.org/faqs/cancel.html)
- Sometimes posts mysteriously disappear from NANAE; casualities of war. The program Dave the Resurrector usually recovers these vandalized posts.