After being barraged by spam and 419 scams from Rima-TDE and telefonica.es
[translated], the AHBL has
announced that all of Spain's national ISP's e-mail will be
blocked by their blacklisting service. One has to ask though, is blocking an entire country like this the future of
spamfighting, or has something gone horribly wrong?"
According to
this post on /. it
looks like the AHBL has placed the mail servers of Telefonica De Espana on their
abuse list, having the effect of blocking the outgoing e-mail of ALL users of Spains largest ISP.
What!??!? You would think that a site such as SlashDot with the power to influence that they yield would have at
least explained a bit more about the AHBL before allowing this post to reach the front page.
But, since they didn't…I will. Before freaking out and assuming that these users are blocked from
sending e-mail to anyone on the Internet, we ought to keep in mind that the AHBL's lists are only used by organizations
who point their spam blocking software (such as Spam Assassin) or spam blocking appliances at the list. In other
words, you subscribe to the list which is free. While the list of subscribers may be a large list of ISP's
including some of the worlds largest, possibly including the likes of those such as Yahoo and MSN, it is NOT blocking
an ENTIRE country as the author suggests.
Regardless, we're on a slippery slope when one organization intends to block e-mail from thousands of people because
one or two bad apples spoiled the pie. If this is the future of Spam, we have lots to worry about. This
could have just as easily been my private ISP. I can guarentee that they would never do this to the likes of
Yahoo or MSN because the AHBL would have lawyers crawling up their behind so fast that they wouldn't know what to do
with themselves.
But I digress.
Notice To All Telefonica De Espana Users The AHBL is blocking nearly all of Telefonica De Espana IP space
currently. This is because of the ever increasing amount of spam and illegal 419 coming from rima-tde.net IP space.
(TDE is the govt run ISP of Spain Note from BB - I've been getting mails from users indicating that TDE is now
privately owned, I will be attempting to confirm this ASAP) TDE does not seem to care one way or another about the
abuse and illegal activities coming from their network, and has not responded to any abuse or spam complaints, nor
have they seem to have dealt with any of their customers. In order for TDE netspace to be delisted, the following
must occour: * TDE must contact admins@2mbit.com and inform us of how they plan to clean up their network, and how
they are currently cleaning up their network. If you are an end user, DO NOT CONTACT US. We are only interested in
hearing from TDE themselves at this point. * TDE must terminate their users which are sending spam and 419 scams and
not just move them to another netblock to avoid the blocking. * TDE must agree to continue to police their networks
and deal with abuse in a timely fashion (72 hours or less). Once TDE has compiled with the above, TDE netspace will
be delisted. However, should it become known that TDE is ignoring complaints, or playing games with the spam
fighting community, their netspace will be relisted and not removed for a minimum of 6 months.
The AHBL will not tolerate abuse from any network.
This block would not be necessary if TDE actually made even the slightest effort to clean up their network - which
they have yet to do.
In a follow up, the AHBL qualifies their position by saying.
Update - April 26th, 2004
(Note from BB: I neglected to mention that these discussions took place nearly a month ago, and that TDE has made no
further attempts to contact us in regards to the issue)
TDE contacted us by e-mail and we were told by them that the cause of all of the 419 scams and spam was from the
scammers operating out of Internet Cafe locations, and that they were working with the police to try and stop the
problem.
However, when asked why TDE does not just block outgoing port 25 on their dynamic clients, we received no
reply. We also asked that TDE provide us with details on exactly what their dynamic ranges are, so that we
could better tune our blocks, and they have yet to get back to us on that either.
The only reason why we have resorted to this broad of a block is because TDE has not shown any effort to work with
us to isolate the problem, and we continue to receive thousands of 419/spam attempts daily by Rima-TDE netspace to
our own mail servers and other mail servers we monitor or run.