China - Source of 71% of All Spam

[LightGuide]

.
http://www.businessweek.com/technolo...1934_tc058.htm

[Randall]

Mantel says the spammers are sophisticated enough that they know how to hide the origin of an e-mail. And since many filters identify messages as spam if they come from addresses that already have sent similar junk mail, the same spam is being sent simultaneously from hundreds of IPs.

Site hosting is different, however. It doesn't jump around.

Sounds like a job for Chipmunk's upcoming URL-filter. Maybe we can have an option to block known Chinese IP ranges, since I can't imagine many legit non-Chinese sites are hosted there.

Randall

[LightGuide]

I don't know anyone in China.

I don't, and never have, and may never, do any business with China on any of my commercial sites.

Thus, from where I'm sitting, being able to block/dump/redirect anything and everything incoming from a Chinese IP sounds very attractive.

[TVB]

I always get a chuckle out of the spam sent in chinese characters. I banned a big chunk of chinese IPs a while back when our forums were getting hammered by a harvester using a chinese IP. While there is a chance that someone might be coming into our site from China, it was a chance I decided to take. At the time, I was also derided for that decision from others here in the FQ forum.

Betsy

[LightGuide]

Originally posted by TVB:

...I banned a big chunk of chinese IPs a while back when our forums were getting hammered by a harvester using a chinese IP. ... At the time, I was also derided for that decision from others here in the FQ forum.

Betsy

I missed that; but I cannot understand why you would be castigated for it!

A publisher certainly has the right to choose *not* to distribute his or her content as he or she sees fit. By analogy, if you chose to distribute a magazine or newspaper only in one city, would there be something inherently wrong with that?

From a technical standpoint, I have always seen the inability to control website distribution regionally if desired as one of the most serious shortcomings of the Internet.

etLux

[cindik]

I set up my feedback email address to include the IP of the client.

Now I know the IP addresses of the bots that harvested the feedback address.

[Randall]

Too bad they didn't discuss spambots in that article. Does it follow that a site hosted in China would use harvesters operating from China's IP space? Maybe not, if the spammers aren't Chinese themselves. And even if you suppose that 71% of the spambots are based in China, those spammers can still buy lists compiled by the other 29%. Blocking spambots won't protect you from dictionary attacks either...

That's what I like about Chimunk's theory: They can hide the source of the spam, but they still have to drive traffic to an actual web site to make any money. If we can identify those sites and filter out the emails containing those URLs, it could make a dent in the stuff that's slipping past EFM, SA and whatever else people are using. Blocking all sites with Chinese IPs would appear to be a step in the right direction.

Randall

[Andilinks]

It has gotten to the point that when I detect an abusive bot from China I block the entire range, usually the first two number blocks:

210.200.105. Yes Range denied Range denied Range denied China Range denied
210.200.105.225 No - - - n/a - - - - - - n/a - - - - - - n/a - - - China - Guangdong - Guangzhou range denied 210.200.105
210.200.105.245 No 12/13/2003 - - - n/a - - - - - - n/a - - - China - Guangdong range denied 210.200.105
211.152.14. Yes 3/4/2004 Range denied Range denied China - China Channel 3.58 MB


this entire bot blocking list is here:

http://hometown.aol.com/botlist22/botlist.txt

Andi

[cindik]

Time for a new video:

Bots Behaving Badly

[Randall]

"URLs Gone Wild"?

Randall