Re: [gnu@gnu.org: [Fwd - Frm: sergei@servermail.cepro.cefetpr.br, Subj: failure notice!]]

[Russ Allbery <rra at stanford dot edu>]

Richard Kenner <kenner@vlsi1.ultra.nyu.edu> writes:

>     See MAPS at http://www.mail-abuse.org/ BTW, my understanding is that
>     the original message in this thread was blocked not through ORBS,
>     but with MAPS service, and MAPS site lists the originating host in
>     its database together with a sample of spam from it.

> I hope I'm misunderstanding you.  That site doesn't list ISPs that had
> some user on them that sent a spam message, right?  What exactly does it
> take to get listed?

RSS, which is what I believe blocked the original message that started
this thread, lists only open relays that have been spammed through and for
which RSS has a copy of the spam that was relayed through the server.
ORBS, which wasn't actually an issue in this particular thread but which I
believe the lists here are still using, does active scanning and will list
systems that have never been spammed through but which *could* be spammed
through, as well as listing any site that doesn't allow them to scan it
(well, it's slightly more complex than that, but that's the basic
principal).

In order of increasing false positives in blackhole lists, there is the
original MAPS RBL (requires evidence of refusal to deal with the problem
and therefore has very low false positive rates, but doesn't block much
spam), MAPS DUL (which blocks mail direct from dialups, a common spamming
technique), MAPS RSS (which blocks abused open relays), and ORBS
(unaffiliated with MAPS and the most aggressive widely used blackhole
list, fairly controversial).

Hope this helps.

-- 
Russ Allbery (rra@stanford.edu)             <http://www.eyrie.org/~eagle/>