Spam Prevention Early Warning System
Online Advertising
Spam Prevention Early Warning System
The Spam Prevention Early Warning System (SPEWS) is an
anonymous service which maintains a list of
IP
address ranges belonging to Internet service providers which host spammers and show little
action to prevent their abuse of other network's resources. It is used
by numerous Internet sites as a source of information about the senders
of unsolicited bulk email, better known as
spam.
SPEWS itself publishes a large text file containing its listings, and
operates a database where users may query the reasons for a listing. Users of
SPEWS can reprocess these data into formats usable by software for
Stopping Spam.
For instance, until recently many mail sites used a
DNSBL based on
SPEWS data, operated at spews.relays.osirusoft.com. This DNSBL was shut
down on August 27, 2003 after several weeks of
denial of service attack. A number of other DNSBLs exist based on the SPEWS
data, which remain accessible to the public.
There is a certain degree of controversy regarding SPEWS' anonymity and its
methods. SPEWS remains anonymous to avoid harassment and barratrous lawsuits of
the sort which have hampered other anti-spam services such as the MAPS RBL and
ORBS. Some regard this anonymity as irresponsible, while others find it
sensible. In addition, many ISP clients whose providers are listed on SPEWS take umbrage that their own
IP addresses are associated with spamming, and that their mail may be blocked by
users of the SPEWS data.
Process
The precise process by which SPEWS gathers data about spam sources is unknown
to the public, and it is likely that its operators use multiple techniques.
SPEWS seems to collect some information from
honeypots
-- mail servers or single email addresses to which no legitimate mail is
received. These may be dummy addresses which have never sent any email (and
therefore could not have requested to be subscribed to any legitimate mailing
list). They may also be placed as bait in the header of a
Usenet post or
on a Web page, where a spammer might discover them and choose to spam them.
The SPEWS Web site makes clear that when spam is received, the operators file
a complaint with the ISP or other site responsible for the spam source. Only if
the spam continues after this complaint is the source listed. However, SPEWS is
anonymous -- when these complaints are sent, they are not marked as being from
SPEWS, and the site is not told that ignoring the complaint will result in a
listing. This has the effect of determining the ISP's response to a normal
user's spam complaint, and also discourages "listwashing" -- continuing to spam,
but with the complaining address removed from the target list.
If the spam does not stop over time, SPEWS increases the size of the address
range listed through a process referred to as "escalation". This process is
repeated, conceivably until the entire netblock owned by the offending service
provider is listed or the block is large enough that the service provider is
forced to take action by the complaints of its paying customers.
Criteria for listing
SPEWS criteria is based on "spam support"; That means that when a network
operation provides any services to the identified spammers, the resources
involved are listed. For instance, part of an
Internet Service Provider's network may be listed in SPEWS for providing DNS service to a domain mentioned in a piece of
e-mail
spam, even if the messages weren't sent from said provider's mail servers.
Listing data or evidence files
IP addresses listed in SPEWS are mentioned in "evidence files". Those are
plain text files which upon inspection appear edited by hand, where those IP
addresses along with the technical evidence backing the listing, is depicted.
The contents of those evidence files may seem rather cryptic to readers who are
not intimately familiar with the technical
jargon of the
Internet.
Criticism of SPEWS
No one knows how many service providers use the SPEWS list to reject mail.
The number is enough, though, to make people who are listed as spammers,
neighbours of spammers, or service providers of spammers quite upset.
Contacting SPEWS
One common criticism is that there is no way to contact SPEWS. According to
the SPEWS FAQ: "Q41: How does one contact SPEWS? A41: One does not..." Having no
way to contact SPEWS is seen as a way for SPEWS to avoid having to deal with
complaints--even if they are legitimate--and to be immune from many consequences
of mistakes, bad policies, or other problems.
Criticism
SPEWS critics (often those who use IPs listed in SPEWS) claim it blocks sites
and does so for reasons they consider unfair. Critics argue that an ordinary
customer of an ISP should not be held responsible for the actions of other
customers of that ISP.
Supporters (often those who use SPEWS) respond that SPEWS is a list of
ISPs with spam problems. It is the ISP that's listed, not the customers.
This is often argued with an analogy of pizza delivery companies who will not
deliver to high crime areas. It's a bad situation for someone "stuck" in a bad
area, but supporters argue that this also provides encouragement for a good
citizen to unstick themselves and move to an ISP without a spam problem. The bad
ISP loses revenue and the good ISP gets more customers, further encouraging bad
ISPs to clean up.
Counter Argument
Supporters of SPEWS often point to the claim that SPEWS "blocks" email from
sites as a misconception. A SPEWS listing only causes mail to be refused if the
recipient of the email (or their ISP) chooses to block based on the SPEWS IP
list.
This counter argument has been criticized on the grounds that SPEWS is
spreading information in a way conducive for blocking and in the knowledge that
people are using it to block. According to this criticism, SPEWS should then be
considered partly responsible for any blocking that happens and can be
legitimately blamed if the blocking is inappropriate. In this view, the claims
that lists such as SPEWS are advisory and that SPEWS itself does not block are
seen as attempts to evade responsibility for SPEWS' own actions.
Delisting
According to the
SPEWS FAQ, listings are removed when the spam or spam-support has stopped.
Just as they do not solicit nominations for listings, the SPEWS operators do not
solicit requests for delistings. There is no contact information published on
the
SPEWS Web site. There is no spews.org mail server, and the
operators of SPEWS do not receive email under the SPEWS name.
It is believed that the operators read certain
Usenet
newsgroups related to spam and email abuse. However, no poster has claimed to be
a SPEWS operator and no regular of the newsgroups claims to know their identity.
By the accounts of many of those regulars, SPEWS can detect automatically when
such support stops, but this is not supported by any information in the SPEWS
FAQ.
External links
FAQ links
-
- The people in NANAE are seasoned war veterans who have developed
their own terminology and way of doing things.
-
- Sometimes posts mysteriously disappear from NANAE; casualities of
war. The program Dave the Resurrector usually recovers these vandalized
posts.
Home | Up | History of spamming | Stopping e-mail abuse | e-Mail spam | e-Mail fraud | Messaging spam | Mobile phone spam | Newsgroup spam | Spit (VoIP spam) | Honeypot | Spamware | Pills porn and poker | Joe job | Spam Prevention Early Warning System
Online Advertising, made by MultiMedia | Free content and software
This guide is licensed under the GNU
Free Documentation License. It uses material from the Wikipedia.
| 
Our Services
Members
Site News
Tools
Manual's
And our Forums with