Spamhaus: abuse and blackmail

How the world's most famous spam blocking service really got the work done

 

by Andrea Gozzi (asgozziATgbhtechDOTcom)

 

 

Notice

While reading this page, please keep in mind that I use the Spamhaus DNSBLs myself!
I think they provide a great service and do a great job by keeping lots of spam out of our precious mailboxes.

I decided to publish this report after a lot of thought (the facts took place in September 2008) because I believe the way Spamhaus handled the situation through blackmail and threats is despicable. They clearly abused their position should have acted in a totally different way.

 

 


 

 

About Spamhaus

If you have managed/worked with a mail server in the last few years, you certainly know all about The Spamhaus Project (http://www.spamhaus.org) and their widely used DNS-Blocklists.

According to Wikipedia, Spamhaus is

" (..) a volunteer effort founded by Steve Linford in 1998 to track e-mail spammers and spam-related activity (..)"

and

"(..) [Spamhaus] is responsible for three widely used anti-spam DNS Blocklists (DNSBLs) — the Spamhaus Block List (SBL), the Exploits Block List (XBL), and the Policy Block List (PBL). Many internet service providers and other Internet sites use these free services to reduce the amount of spam they take on. The SBL, XBL and PBL collectively protect over 1.4 billion e-mail users (..)"

What Spamhaus basically does is add a host, IP or subnet considered a source of spam to its list. As soon as a that same source is added to the list, every mail server implementing the DNS-Blocklists will either discard or reject any email message coming from it.

The three lists work as follows:


Since we can all make mistakes, such as a mis-configured email server, Spamhaus also provides a removal mechanism for the host, IP or subnet in question.
If you ended up in the XBL or PBL, it's pretty easy to be de-listed. Just fill the online forms and in a couple hours you'll be removed.

Getting out of the SBL is another story.
The only way to be de-listed is through intervention by your ISP or the netblock owner. They have to contact Spamhaus directly and make them a bunch of promises (read here: http://www.spamhaus.org/faq/answers.lasso?section=Spamhaus%20SBL#137) in order to have the host, IP or subnet removed.

 

 

About me

There's not really that much to say :)
I am a computer enthusiast and, since being displeased by most of the dedicated servers offers around, have been running my own servers at home for the last couple years. I used to have an enterprise plan from a Belgian ISP, the Brussels-based VOO (formerly Brutele SC), since 2003 and always been pretty happy with it.

Around mid-August 2008 I discovered Spamza.com. I was immediately intrigued by it.

 

 

About Spamza

What Spamza basically did was let anyone subscribe anybody to all those commercial mailing-lists that do not require double opt-in . There have been various claims about the how many mailing lists the email address was getting subscribed to, but (having seen the code myself) the real number was around 90.

A better and more accurate description of Spamza can be found here or here.

Since you could enter any email address you wanted, Spamza was greatly abused. Most people used Spamza to clog other people's mailboxes and force them to spend hours manually unsubscribing from every mailing-list.

By the end of August Spamza's hosting provider, 1&1 Internet Inc., had decided to terminate their account. I do not know what reasons were behind this decision but I can easily suspect a Spamhaus involvement.
In the following days the creator of Spamza, Frank L., posted a message on DIGG asking for help in finding a new place to host Spamza on. I contacted him and offered him some space and bandwidth on my server.

 

 

The facts

During the first days of September Frank worked on moving Spamza to its new location. Since the "spamza.com" domain had been registered for less than 40 days it could not be transferred to a new registrar yet.1&1 also refused to allow Frank to set new nameservers for the domain, so he had to register "spamza.org".

I do not recall the exact date but roughly by September 5th the new Spamza was up and running. To avoid further complaints Frank had set up a blacklisting system where anyone could add their email address so that it could never be subscribed using the Spamza automated system.

At this point, something has to be made clear: no email message was EVER sent from the server where the Spamza html files were located on.
I had personally set up and configured the server so it would be impossible for the HTTP daemon to transmit email messages.

On September 3rd I registered, in my name, the domain name "spamza.info" with the agreement that it would be later transferred to Frank.

 

First email: email from Mike Paulsen

On September 12, 2008 I was contacted via email by Mike Paulsen. He did not identify himself nor disclose his role, if he had any, in the Spamhaus organization.
This is the complete email message I received:

 

 

Subject:From:Date:

 

Since my server had obviously not been cracked, I simply forwarded the message to Frank and let him deal with it.
What is interesting is that he did not address the email to the RFC2142-complaint address "abuse@spamza.org" (like he should had) but instead went through a great deal of trouble to find my personal address.

 

Spamhaus list entry

Exactly like Mike Paulsen had warned me, the IP address hosting "www.spamza.org", 212.68.198.73, got listed in the Spamhaus SBL on September 12, 2008.
Personally, I didn't really care. I deliver mail via an external relay located on the other side of the world, so the blacklisting didn't affect me.
Moreover, I was allocated a nice subnet of addresses by my ISP, and those were not listed. All my bases were covered.

 

Second email: Fabien Bels

Mr Bels is a network engineer working for VOO. He got in touch with me on September 17th to let me know that Spamhaus had contacted him regarding Spamza.
In our phone conversation he told me that being an ISP listed on the DNS-Blocklist was bad for business and he advised me to take the website down.

He did not threaten me in any way, but being at war with your ISP isn't a good thing, so I complied. I did not have control over the DNS settings for the domains owned by Frank, but I removed all the website's files.

 

Third email: Fabien Bels

On September 18, 2008 I received a new email from Mr Bels.
The most interesting part is the email he received from Spamhaus:

 

 

 

Subject:From: Date:

From:
To:Subject:Date:

 

 

 

 

 

 

 

Why would Spamhaus list enterprise mailservers that have absolutely no connection whatsoever to Spamza? Is it maybe because they noticed I had no problem with my IP address being in the SBL and they decided the only way to get my ISP's attention was by unfairly blocking their outbound mail?

Anyway, Mr Bels had been so understanding and helpful the previous day that I wanted to everything in my power to fix the situation.

 

 

Spamhaus


Myself to Spamhaus - #1

To try and get VOO's outbound servers removed from the DNS-blocklist, I emailed directly Spamhaus:

 

 

Subject:To:Date:


 

Spamhaus to myself #2

 

 

 

Subject:
From:
Date:



 

Spamhaus did respond promptly, which I really did appreciate. Unfortunately, I can't say the same about the contents of the message.
I can only suppose they are not used to deal with people challenging their decisions.

For starters, if they are so strict about their Subject: policy, why did they bother getting back to me?

 

Myself to Spamhaus - #3

 

 

 

Subject:To:Date:

 

 

 

Happy ending

There were a couple more messagges exchanged between myself and Spamhaus in which they basically tried to make me apologize to them as if they were the WWW's "higher authority". But in the end they actually removed VOO's outbound servers from the SBL list.
The other IP address, 212.68.198.73, was de-listed a few days later.

I believe it is worth showing an extract from the last email I received from Spamhaus:

 

 

 

Subject:
From:
Date:

 

I was right! They do have a "higher authority" fantasy.

 

 

Final thoughts

As I stated at the beginning of this report, it took me a while to realize how unfair and abusive Spamhaus' behaviour was.
Spamhaus listed the server's IP in the SBL, but that didn't matter to me, so they went after my ISP.
At that point, one of two things happened: either somebody must have done a poor "investigating" job and ended up listing the corporate outbound servers for "voo.eu" instead of the customers' ones (very easy to find since the IP address was in BRUTELE-AS netblock) or the fight against Spamza turned personal.
I believe the latter.

This said, I admit that probably hosting Spamza wasn't a very good idea. It made somebody at Spamhaus angry and they decided they should start playing MOTU.