Overzealous spam database [CLOSED FOR CLEANING]

Portal Home > Knowledgebase > Articles Database > Overzealous spam database [CLOSED FOR CLEANING]

Posted by tehinternetsizsrs, 09-12-2008, 08:22 AM
As an admin, I recognize how serious spam is. But I ran across one spam database, ran by Rob McEwen: http://www.invaluement.com His database will show on your blacklist checks as ivmSIP/24. The way he does business is to list someone's IP, even if the only offense is that it's on the same /24 block. When you check, and you can see through his own database that your IP has no direct involvement, he happily admits in e-mail that he knows you have no involvement in the spam, but that it's your obligation to approach your host and ask who the spammer was, and what action was taken. If the "evidence" isn't good enough for him, your IP will be listed, even if your only offense was getting a dedicated server with a dirty IP, and even if the ONLY blacklist you're on is his. His goal is admirable: getting rid of spam. But there is such a thing as being too overzealous, and the way he goes about it could unduly threaten an innocent host's business. Instead of doing due diligence, he wants for victims to come to him, and expects them to do his work. If you don't comply, he dubs you "arrogant", and continues to admit that while he knows you're not the spammer, he won't remove any IP's. You may want to check your IP's and see if you're being victimized by this man. Although his database doesn't appear to be of too much consequence because those who use blacklists recognize that /24 blocks are way too overzealous, he does do damage, and he knows it. This isn't some naive guy who made a mistake. He makes a habit out of victimizing good people such as you and I who do not spam, and who in fact take steps to avoid spam activity on their servers. What are your thoughts? Last edited by tehinternetsizsrs; 09-12-2008 at 08:26 AM.
Posted by octagon, 09-12-2008, 10:59 AM
Instead of making accusations, just post the IPs he has blacklisted that are yours and let us make our own decisions....
Posted by invaluement, 09-12-2008, 12:33 PM
The user above, "tehinternetsizsrs", is a person who calls himself "Michael Crook". You can learn more about him by googling the following two phrases: Michael Crook Michael Crook and tuckermax Here is a summary of what happened. First, a large number of spams were sent from various IPs within a /24 block of IPs. Not directly from Michael's IP, but from adjacent ones in the same /24 block. The entire block in question is 74.50.100.0-255 The spams include subject lines such as: "We have your color business cards available yours to keep" "Degrees for Working Moms" "250 full colored bus cards are yours to keep" "The US Government gives away millions a month, get your share" "Get DIRECTV's Best Deal Of The Year" "Flush Out Excess Pounds!" "Complete your degree from Everest College, 100% Online" "See what everyone is talking about" "The US Government gives away millions a month, get your share" "Financial Aid for online students" ...and MANY more like this. And not a single one subject line that I copied above came from the same sending IP on this block... and I could have kept going for a while longer with those subject lines. Therefore, there are only two possibilities: (1) The hoster for Michael Crook is a "spam haven" ...OR... (2) Michael Crook's hoster is also a victim of the spammers and didn't yet know about this infestation of spammers. Stepping back a moment and looking at the big picture, you may ask, "why block the whole /24... why not just block the offending IPs" First, I do block only the offending IP in my *main* IP blacklist, ivmSIP. And for ivmSIP, there is a one-to-one relationship between IPs blacklisted and evidence of spam on file to back up the listing. The reason for the existence of my ivmSIP/24 blacklist is because "snowshoe spammers" OFTEN acquire entire /24 blocks (or large blocks therein), and then start burning through these one-by-one, knowing well that they get a "free pass" (for a period of time) with each fresh IP that haven't used yet. This is getting to be a VERY common scenario and while it is a tiny portion of all spam sent, it represents a large portion of what gets past spam filters and into your inbox. Therefore, a /24 list is needed to preemptively block such snowshoe spammers. That way, after they have burned their last IP (and it is then massively blacklisted), their next IP on the list is *already* blocked from the start, only due to the /24 blacklist. (make sense) Unfortunately, a /24 list is also more "at risk" for blocking innocent bystanders. My goal is to not allow that to happen. And I've taken extensive measures and done extensive research to prevent such from happening. And, overall, this situation is rare. However, what I have found is that, in the cases where this has been reported to me, one of two things happen. (a) Either the ISP was alerted by their innocent customer and immediately booted off the spammers (thus helping to clean up the spam problem for ALL of us!), or (b) the innocent customer requesting the delisting is glad to know about this and decides that their hosting dollars should not be spent supporting a web hoster who gives spammers a pass (That is, in those RARE situations where the hoster dug their heels in and did nothing about the spammer!). There have also been some situations where I reluctantly whitelisted the range only because I could see that the organization effected was legitimate, and that they had at least reported this to their hosting provider. Even the smallest signs of legitimacy were often enough to trigger that decision. Such "signs of legitimacy" typically might involve a long-standing web site with many legit incoming links, a legit business with a storefront, etc. (more on that later) In Michael Crook's case, he claimed that he had reported this situation to his hoster, and that the hoster replied back that they had recently booted off all of the spammers. Normally, I've have then quickly removed all the blocked IPs and this would have been "case closed". But there were several problems. Mainly, there was spam sent from this range that *same* morning when Michael sent me that message he claimed was from his hosting provider about the spammers having already been booted. Secondly, I could not find signs of legitimacy regarding Michael (especially at that time). He was communicating from a gmail account, and his web site wasn't coming up at the time (I suspect it wasn't yet completely set up at that time?). He mistakenly thinks I was counting this and other such factors against him. Instead, I was actually just looking for ANY signs of legitimacy in his favor to justify a removal, but couldn't find any. And I had not ever heard of Michael Crook at that time. Really, I'm very reasonable and I try to find evidence in a requesters favor. THAT is what I was looking for and could not find. He is going to say that I'm considering him guilty until proven innocent. However, my suspicious were aroused when what he relayed back to me from the hosting provider didn't match up with the spam evidence I had on file. I've been bald-face lied to by spammers... some who even admitted their lies when pressed with evidence... therefore, the fact that what Michael reported back from hosting provider didn't match up with the spam evidence on file only hurt his case. I then thought, there are now three possibilities: (1) Michael was lying and never talked to his hosting provider in the first place (2) The hosting provider was lying, and never lifted a finger regarding the spammers (3) Or, Michael and his hosting providers were being honest... but there was just a *new* infestation of spammers on this /24 block Therefore, I asked Michael to ask his hosting provider a simply follow-up question: "which IPs did they kick spammer off, and when" That is all. A simple question. This would have cleared up much. I was trying to give him every benefit of the doubt. I was NOT jumping to conclusions based on too little evidence. But, incredibly, he expects I should now sweep under the carpet this contradiction between my hard evidence and what he reported that his hosting provider said. Sadly, instead of forwarding the follow-up question to his hosting provider for clarification, he stopped cooperating and refused to help. He stated that he was not "able" to do that. But that is contradicted by his earlier statement that he had asked his hosting provider a question and then they gave him an answer. If he could do this once, what is so hard about a single sentence follow-up question? (He is confusing the words "able" and "willing".. but he kept insisting that this could not be done.) Next, Michael turned belligerent and started making threats and accusations. I was NOT on a witch hunt against Michael. I was trying to find ANYTHING that would legitimize his request, beyond just taking his word at "face value". Additionally, I tried to explain to him that it would be a shame to remove this listing just because he insisted it should... where the hoster wasn't held accountable and didn't take appropriate action. Why? Because, at the end of the day, this means that Michael is then placing his own ability to send his mail out above his willingness to answer a simple question. He is also saying that others should get more spam into their inboxes because he shouldn't have to answer a simple question. He called me arrogant. But I find that situation to be arrogant. He might say, "how far can Rob take this... how many innocent victims must there be" (not an exact quote... that is the gist of his complaint.) But I'd reverse this and ask... how far can a hosting client go towards using the services of a spam haven (speaking generically in this case... I couldn't get Michaels cooperation to make such a final determination about his hoster!) ...and then expect the world to bend over backwards to accommodate that person's own outgoing e-mail. For example, one spam-friendly hoster I know of has their entire network blocked by *many* large ISPs. But, right now... today... Michael could potentially go to that hosting company's web site and sign up for a hosting account and then complain about my anti-spam blacklist not removing the entire range on account of his one account? That is the logical conclusion of his arguments... and the eventual outcome if I were to operate my DNSBL as he would have it operated. By his refusal to answer that one simple additional question, he is pretty much expecting this kind of special treatment. His last e-mail to me included the following: "I've notified the police and child welfare authorities in your area that you are a child molester, so you'll have some fun." The e-mail ended with: "Game on, bitch. Even though I hate spammers, I know how to get your info to the right people, so enjoy your name fame, cupcake. You ****ed up this time." I'll let the readers of this thread be the judge of this person's credibility and character.
Posted by Luxore, 09-12-2008, 01:14 PM
Ok, tehinternetsizsrs thinks that Rob's blacklist is too aggressive and that people should know about it. Rob has presented more detail about how he manages his list, and some reasons why he feels his approach is appropriate. This is all good. Pointless maybe but good. Hopefully every person here knows that he should read the policies of a list before using it to block mail, and that even then there is some risk that the list managers may not stick strictly to their own published policies. Hopefully every person here also knows that there are work arounds for use in a case like this. You can pay to send your mail through a service with a good reputation - one which will handle your outbound mail and help you protect your reputation by watching for problems in that outbound mail stream.
Posted by octagon, 09-12-2008, 01:32 PM
I looked up several different IPs on that subnet, and quite a few IPs are blacklisted from various different RBLs (not a lot but a few) You pay for what you get, if the person you're trying to send email wants to use individual IP blocks use those rbl's and not the /24 rbls, but from what I can see he has multiple lists one which is a /24 list. Those lists generally have false positives but mail provides realize that and generally give those lists less points. I use them myself as well in spamassassin to add points to messages (not direct blocks). It's his list with his policies, if you want off of it follow his policies, otherwise don't worry about it. It doesn't seem that for a /24 list his policies are that far out of line, and he obviously pays attention to people's complaints (otherwise he wouldn't post that HUGE post detailing everything). If you're contacting someone who is using his list, just ask them to not use Robs /24 list or to whitelist your IP, or modify the use of his list so it only adds points instead of directly blocks the messages. Problem solved. (maybe you should have done research and requested clean IPs before you signed up for the host) He obviously cares about his list, just contact him with your problem and get your hosting provider to be proactive about their anti-spam policy. Most of the providers I've dealt with are, if not.. go to someone else.
Posted by invaluement, 09-12-2008, 01:48 PM
Just to put this in perspective, I've been telling new and potential customers that they should judge ivmSIP/24 on its own merits, separate from ivmSIP. I'm telling them that ivmSIP/24 *might* be better for scoring, while ivmSIP *should* be OK for outright blocking. But, in either case, the user of the list should test the lists out and examine their effectiveness and potential problems particuarly since every deployement scenario is different. But, the bottom line is that ivmSIP/24 is far newer than the other two lists, ivmSIP and ivmURI... and is sufficiently different such that many of my subscribers either haven't even yet started using ivmSIP/24 yet, or use it for scoring instead of blocking.
Posted by Frontpage1, 09-12-2008, 03:12 PM
Funny that this thread popped up. I have a large forum on one dedicated server that sends out a confirmation email for those registering, additionally the forum software will send an email alerting the member to a reply post if they elect to receive it. We do not send out any other email. All email is scanned for viruses, the IP has reverse DNS, we use DomainKeys, and SPF. However, some stupid RBL will label our IP as a spam source. I just had this happen with Barracuda Spam today. When challenged on what spam was sent from our IP, they could or would not provide any example. How do we know that we are not sending spam? We have a copy of every email sent. For that reason, there are only a few legitimate RBL's in my opinion that do not throw the baby out with the bath water. Our users sometimes can't get their email to register or to get updated on their thread -- and that is a shame.
Posted by Tom Mortimer, 09-12-2008, 05:06 PM
Interesting thread. I'm Tom Mortimer, and I volunteer with another anti-spam blocklist, Spamhaus. A friend of mine who knows Rob McEwen mentioned to me that he'd attracted the attention of "a raving lunatic" (her words) and pointed me to this URL. Since attracting attention from such people is an occupational hazard for anti-spam blocklists and people who work on them, I decided to pop over and see what was happening. Normally I would leave any public comment on other blocklists to the boss, Steve Linford. Due to the above-mentioned mutual friend I have been aware of the Invaluement project for some months, however, and have seen the numbers generated by several sites that use those blocklists on customer traffic. It appears that Rob McEwen has built and run some fine, tightly managed blocklists that are quite effective at keeping spam out of user mailboxes without blocking legitimate email. He's especially effective at catching snowshoe spammers. According to those who have tested his blocklists, McEwen is also conservative in what he lists, and quite quick to delist when it appears that a listing might cause false positives. These testers include a security administrator for a major multinational corporation and at least one large ISP. They are people that we also respect and listen to at Spamhaus. Even if tehinternetsizsrs were known to me as a representative of a reputable ESP, company or ISP, I would hesitate to believe his allegations that McEwen was rude to him and deliberately refused to remove an IP, much less that he in any way misrepresented the evidence he had. Given McEwen's own account, I must conclude that my friend was right: this is a lunatic. Since behavior of the sort this individual threatened is against the law in most jurisdictions (certainly in the UK and US), I hope McEwen has kept the evidence and reported it to the local authorities. Most people who threaten this type of retaliation don't follow through, but there is the occasional disturbed individual who does. Informing the police immediately allows them to evaluate any police reports containing these allegations in the proper light, and bin them.
Posted by tehinternetsizsrs, 09-12-2008, 07:29 PM
Well, the bottom line here is that Ron has admitted he doesn't care about innocent people he victimized. I think that speaks volumes about his character. I get what he's trying to accomplish, but his method ends up victimizing innocent people under the guise of heroism. Again, I wholly support fighting spam, but not at the expense of punishing innocent people. I even outlined the steps I take to ensure my IP's/domains are not involved in spam activities, and it fell on deaf ears. McEwen obviously tried to con me into doing his work for him. It is not my obligation to ask questions about things that occurred before I acquired an IP block. It is not a matter of being unwilling, as McEwen attempts to lie. It's a matter of principle: he wants innocent people such as myself and you to do his dirty work. It's just that simple. He is no hero. A reasonable spam databases catalogues the specific IP. In this case, my specific IP is not involved, save for being on the same /24 block. What he's doing is to me malicious, and while I don't have the time to dedicate to suing him, I hope someone does, and shows him what poor is. He deserves to be taken to task for his actions, in my opinion. I do not apologize for my harsh words to McEwen, nor do I apologize for passing along our e-mail conversation and his home address to people whose income he's affecting, whether or not I agree with the method by which they acquire said income. Oh, I don't support the spammers, but it'll be interesting to see how they deal with McEwen. The source I gave the info to was VERY happy to learn of McEwen. He has proven unwilling to resolve this situation, and that is sad. I find it hilarious that his minions dub anyone who doesn't immediately and fully agree with them "lunatics". It shows what their true intent is. Last edited by tehinternetsizsrs; 09-12-2008 at 07:44 PM.
Posted by Jonathan Kinney, 09-12-2008, 07:45 PM
Here is my 2 cents. A blacklist is just a list, nothing more. It is not the list maker's fault when some ISP or organization decides to use that list. Talk to that ISP or organization that agrees with the policies of the blacklist. I believe in keeping the responsibility where it should be, where the actual action has taken place. IMHO disputing the policies of a blacklist is focusing in the wrong direction. I have opinions, I share them with people, if one of those people were to adopt and act on one of those opinions, that is their responsibility, not mine, if you get my point.
Posted by tehinternetsizsrs, 09-12-2008, 07:52 PM
I know it's just a list, and it so happens that his list doesn't appear to have much consequence. Thankfully, most right-thinking subscribers know that a /24 block is too far-reaching, punitive, and far too aggressive. He happily admits here in front of everyone that he knows he punishes innocents. He's just so psychotic that he doesn't care. It's just the principle of the thing. This McEwen guy is maliciously ruining lives and doesn't seem to care. Then to top it all off, he expects innocent people to prove their innocence by doing his work for him, even when shown that the specific IP in question (forget the /24 block) is innocent. He doesn't care that I'm very proactive in preventing spam on my server. None of that matters to him, thereby calling his true motives into question. One day karma will catch up to him, and I will laugh. Until then, I suppose it's just the price of the internet. Arrogant, abusive, malicious malcontents such as him get to do what they do, and anyone who opposes their methods (I don't oppose his goal) is a "lunatic". Maybe he'll just drink the special kool-aid (TM) and move on. Last edited by tehinternetsizsrs; 09-12-2008 at 07:56 PM.
Posted by Jonathan Kinney, 09-12-2008, 08:04 PM
Rob McEwen", I agree with how you handled the incident, from everything you said, very wise actions.
Posted by tehinternetsizsrs, 09-12-2008, 08:07 PM
Ahh, here we go. Because I didn't take 8 hours out of my day to ask my host things I have no business asking, I'm the bad guy? Is this how web hosts think? Or is it because I don't blindly praise and agree with McEwen? So you're perfectly happy with innocent people being penalized? It might be wise to avoid your company, then. Why am I the bad guy here? I outlined precisely what I do to avoid being involved with spam on my server. Again, I have no business asking my host the questions he wants me to ask. They're invasive and the answers are none of my business. And if McEwen was such a professional, he'd have done his research before ruining peoples' lives. Last edited by tehinternetsizsrs; 09-12-2008 at 08:13 PM.
Posted by tehinternetsizsrs, 09-12-2008, 08:21 PM
Okay, so can I make a list, and throw IP's in there just for the heck of it? If people subscribe to it, and innocent people are affected, it's okay, because it's just a list? Let's null route your whole datacenter and see how you feel then.
Posted by lamerfreak, 09-12-2008, 09:32 PM
I believe you have the ability and right to ask your host any questions that might affect your business. As to "Why am I the bad guy here?" - you're not, necessarily, but your overly defensive protestations in the face of Rob's long and coherent self-defense, are... curious at best, and not very positive.
Posted by tehinternetsizsrs, 09-12-2008, 09:42 PM
Again, your logic fails. Of course I'm defensive. I paid good money and did a lot of work to move everything over to this new server, and now I have some guy blacklisting me? Of COURSE I'm not going to be civil or polite about it. You seem to agree that it's my problem. It's not. I could see your point if my specific IP was involved, but it wasn't, and that is the point you people seem to be missing. It's none of my business what happens on IP's that aren't assigned to me, which is why it's none of my business to ask the host. It's simply information I am not entitled to. Why should I ask them to do extra work because some database Nazi wants to throw people in the proverbial ovens without being guilty?
Posted by lamerfreak, 09-12-2008, 09:49 PM
Again'? No, I disagree. You have every business to take up an issue with your host instead of attempting to pile all of the responsibility on an individual who seems to have done their diligence in leveling a block of larger scope against the provider you've chosen. Is it somehow *not* your business, how they conduct *their* business, if that very thing infiltrates the product/service you've acquired from them? Of course you may be defensive, but that shouldn't extend to the childish blandishments you've attempted to level at any disagreements here. It's page 2 and you've already stooped to using 'Nazi' - I think I'm entitled to 'childish'. Anyone else can look at the posts before this and make their own calculation of that.
Posted by Frontpage1, 09-12-2008, 09:55 PM
Thanks for the post, Tom. I am a big fan of Spamhaus and have not had any trouble with them since starting hosting back in 1998. The other RBL's I worry about though as they are not as professional in management.
Posted by tehinternetsizsrs, 09-12-2008, 09:56 PM
I haven't stooped to anything. McEwen is a Nazi. I am shocked that people find such broad bans acceptable. How would you feel if it were you in this situation? Nevermind, you're just as callous and uncaring as McEwen is. Other RBL's at least have a degree of professionalism. The sad thing is, McEwen's is the *only* one I'm having an issue with. That should speak volumes about McEwen's professionalism, or potential lack thereof. When I'm treated with respect, I return that respect, but McEwen was a vile, hateful creature from the word "go", so he is to be treated as a hostile witness would be on the stand. I repeat my allegations as set forth before: I am not entitled to information from my host if it does not involve my IP. And because this incident didn't involve my IP, I am an innocent. If someone had used my IP before me to spam, then I could see the point, and I would be in my host's kool aid to get it resolved. But it involves someone else's IP's, so for me to ask questions is inappropriate and invasive. Again, I agree with McEwen's goal. All I'm saying is that his method victimizes innocent people, and I am not alleging that it's little ol' me he's picking on. To the contrary, I'm sure he has numerous victims, and he likely laughs himself to sleep every night over it.
Posted by lamerfreak, 09-12-2008, 10:38 PM
Meh. Your statements speak for themselves, in quite the opposite way it seems you would intend. I've dealt with SORBS; that was bad enough, and involved a listing of a huge amount of my ISP's space. I don't believe you'll find me drawing a parallel with Nazism there. I'm not callous and uncaring, but I certainly disagree with the amount of fervent dedication you've shown in trying to tear down even the personalities of anyone who attempts to do so. Much as this thread is your own autobiography on the subject. So then your host is to be dealing with him, are they? The onus is off of you, from that perspective, is it not? I wouldn't use the term 'victimizes' though you're welcome to try it out. It certainly has an effect on likely blameless third parties. Let's be civil. If resorting to personal attacks was your intent from the start, we could have just gone past that already.
Posted by tehinternetsizsrs, 09-12-2008, 11:22 PM
I approached him with civility. I complied with his policies on removal requests, and that respect was met with his unreasonable and unrealistic demands. How in the world am I entitled to information on IP's that don't "belong" to me? That's like me asking your host for information pertaining to your IP...it's simply information I'm not entitled to. What no one seems to understand is that McEwen is assuming guilt before innocence, even when shown a valid website with PTR and SPF records tied to its domain, and even when shown that (again) my IP was not involved. Basically, this is the same thing as me going to prison for murder because someone in my building killed someone without me being involved. Essentially, McEwen has made it personal by denying me the full enjoyment of a service I paid for with his malicious and broad blacklisting methods. After all that, why is the onus on me to be civil? He's essentially broken into my house and taken away my TV set because someone else broadcast something he didn't like. It's borderline harassment, now that he has full knowledge that I wasn't involved. I can see that this will never be resolved. He won't budge, nor will I. Cest la vie. It seems that the majority of people here are content to have abusive Nazis like this ruin the Internet. So let it be told.
Posted by lamerfreak, 09-12-2008, 11:32 PM
Oh, stop with your pathetic grandstanding. There's a lot of public information that's associated with my IP, or anyone else's. He seems to have been looking for something more, within your capability to give. How much time have you and I spent going back and forth, now? Is it relative to the time you would have taken? Privacy not withstanding, for I understand that, your arguments about his activity against you is, in a word, laughable. Your attacks are the completely wrong direction. Your comparisons inept. His database is useless if nobody uses it; my own comparison would be to peering arrangements. Wipe the froth off your mouth and continue, please.
Posted by tehinternetsizsrs, 09-13-2008, 12:20 AM
It is not grandstanding. Here is what the situation means to me: 1.) I've paid for something, and now I have some guy I never met affecting that by claiming my IP is involved in spamming, when in reality it's another IP on the same block. When informed of this, the same guy not only doesn't care, but then proceeds to make demands that he knows that are beyond my means to accomplish. 2.) I've attempted to resolve the issue, and he has refused to cooperate in a spirit of malice and intentional disregard for what's right. 3.) I am somehow expected to bother my host with something that's certainly none of my business, and in reality is of too little concern to bother them with, as it does not involve my IP directly. Why should I get up in someone else's kool-aid, especially when I have always taken steps to ensure my servers aren't vulnerable to such activities? Of course I take it personally. 4.) Of course his activities are personal attacks against me, for he is taking action against an IP that is under my control, despite the fact that I have always taken steps to ensure that spam doesn't happen on my servers. That's chiefly why I take this so personally. I have always ensured that I have SPF and PTR records, that I use secure mail forms, and that I don't allow the users on my forums to e-mail each other. Instead of him appreciating me being responsible as I can, I get unreasonable demands. I'm dismayed that you think that taking this issue personally is "froth" and "grandstanding". I suppose you'd not take it so seriously if this happened to you? The bottom line is that I didn't put out the spam, and the IP in question was not involved. For any reasonable person, this should be enough, and I've said that repeatedly, yet people ignore it, making me wonder how mentally stable they are. Anyway, as I've said, he's not going to budge, and I sure won't, out of principle. The theory here seems to be that I could have had this issue resolved by going to my host to get the answers that his majesty wants, as opposed to complaining about it. But there's a principle here: the fact of the matter is that I have no right bothering my host with such nonsense (nonsense because the IP in question wasn't directly involved), and he has no right using the extreme and almost Hitler-esque methods he does. He has full knowledge that there are ways to accomplish the same goal with less extreme measures, yet he does not care. Anyway, I've beaten this horse dead, and it's obvious the people of WHT are okay with false accusations, so I'm done with this. I suppose I could go to my host and get the answers that his majesty wants, but there's a principle here. I've filtered his e-mail address to go to the trash, and I'm done with it. We're at an impasse, which will never be resolved, so I'll leave it to whoever gets the IP after I'm done with it. Last edited by tehinternetsizsrs; 09-13-2008 at 12:35 AM.
Posted by 47usc230, 09-13-2008, 12:34 AM
You've paid for damaged goods. You bought a mansion in the middle of the ghetto, and are getting mad that someone is mentioning where exactly your mansion is. It is not Rob's job to make sure you get a quality host. That's your job, and you have failed. It is your right and responsibility to question your host on why they allowed so much spam to flow that a whole /24 got listed. If Rob's list is being used to block mail by your recipients, perhaps your recipients trust his judgment better than yours? You've been throwing rants and, dare I say, lies around, claiming attacks from him. I see not a single instance of an attack from him. He stands to gain nothing by blocklisting you. To call it personal is idiotic at best. You bought hosting from a crap provider. That's your doing, not Rob's.
Posted by tehinternetsizsrs, 09-13-2008, 12:44 AM
Wow. So vicious. Actually, my host is one of the better ones out there, and they too are the victims of this man's vicious attacks. The fact of the matter is that this could have happened at ANY host. The simple fact is I only do business with providers who run their own datacenter, because a "host" who doesn't OWN their own datacenter isn't a host at all. If you don't own your own datacenter, YOU are the "crap provider". The fact of the matter is that I have yet to run into problems because of this. This affects one of my IP's and he's the only one causing a problem, which should carry some weight with him, but instead falls on deaf ears and a cold heart. So let it be told, so let it be written. It's all a matter of principle, as of right now. I have suffered no actual harm because of it.....yet. And, quite honestly, if someone signing up for my forums can't get my verification e-mail, I don't consider it to be my problem. If they can't get the e-mail, they can't get in. I already block the "junk" providers like Gmail, Yahoo, MSN, Comcast, and AOL. So, if a potential user can't do a simple thing like get an e-mail message, it's no skin off my nose. It's just aggravating, is all, especially when I initially played this guy's silly game, only to be met with more weird demands. Simply put, I don't trust him. The host that you slam as being "ghetto" is actually a paying advertiser on WHT, so I'm glad to see you do your research. As for it being my responsibility to question, it is not, unless it involves allegations against my IP, which it does not. Again, this involves a /24 block. Yes, this matter could likely have been resolved had I opened a ticket, but McEwen's e-mail to me made me decide that wasn't a good idea. He made it seem as if it was my obligation as a member of the Internet community (a misnomer) to help fellow users of my host by "cooperating". That cinched it for me. It's all principle. Anyway, I think I've said all that there is to be said. Apparently, the prevailing opinion is that the innocent person is required to do all the work, which is just disgusting. It takes no effort to open a ticket, but this is a matter of principle to me. I consider this matter closed now. Again, I'll leave it to the next owner of the IP to deal with. Last edited by tehinternetsizsrs; 09-13-2008 at 12:52 AM.
Posted by invaluement, 09-13-2008, 02:46 AM
If they were beyond Michael Crook's "means to accomplish", then how come Michael was able to ask his hosting provider the initial question, and then relay their answer back to me? Therefore, "beyond my means to accomplish" is either a lie, or Michael is not doing a very good job explaining what he means by that. Did Michael's hosting provider get abducted by aliens from outer space after they had answered the first question? I mean, there has got to be some really far out answer to explain why the first question was NOT beyond his means, but a follow-up question is beyond his means. But he just continues on with the same bogus talking points. If Michael has truly attempted to resolve the issue, he would have relayed back to me his hoster's answer to the follow-up question. "which IPs were spammers booted from, and when did that occur"--such a simple question! And not invasive in the slightest. I didn't ask ANYTHING regarding the spammer's identities or contact information. I find it incredible that Michael would tell me that he has reported me to the local authorities for child molestation just for spite, and then accuse me of "malice" and "disregard for what's right". If this was an honest hangup, then Michael and his hosting provider could have agreed to have them contact me directly. Again, Michael Crook is "sweeping under the carpet" the fact that spam was sent from this /24 block the very same morning that he said that his hosting provider had claimed that the spammers had been kicked of this /24 block. That is NOT "of too little concern". And asking this follow-up question was NOT a "silly game" or a "weird demand", as he has described it. Any rational person will agree with me. That mismatch between what he said that his hosting provider said... and the hard evidence I had on file... is a very serious discrepancy. But, assuming that Michael Crook and his hosting provider were both honest, then, in such a case, the answer to this follow-up question would have actually exonerated both of them. I was fully open to that possibility. At the time, I'd have guessed that this was a higher percentage chance than a bold-faced lie. And, has that occurred, the newer infestations of spammers would have been revealed and removed by the hosting provider, and the ivmSIP/24 listing would have been promptly removed, and the world would have become a better place now that ALL the spammers were kicked off of this /24 block. ALSO: For the record, I'm an admin for surbl.org, and the questions I asked are not anywhere near as specific and detailed as what SURBL requests (and typically requires) in order to get removed from SURBL. And in all my 3+ years at helping SURBL, I never once saw this kind of bad attitude or accusations from a requester. Go to the SURBL home page and scroll down to the section which says "List Removal". Look at those details and tell me if what I've asked for is anywhere near that detailed and/or "invasive"? Yet, I didn't create those SURBL delisting requirements... and, again, I don't recall anyone ever complaining that this was somehow a breach of privacy, and/or getting others to do SURBL's work, even when the request was from a very legit organization which was wrongly listed on surbl. I hope that puts Michael's complaints into proper perspective. Also, I had already provided Michael a list of those IPs in this /24 block from which I had hard evidence of spam. Because spam from those IPs had been sent to my customers, those IPs now *were* my business. That is a huge point. It blows away all of Michaels complaints about privacy issues. If my car plows into the back of your car because I was too busy adjusting my radio, then you getting some personal information and/or insurance information becomes your business! The sender of that spam made those IPs my business. Because I had sent that list of specific IPs to Michael, then if this was really a huge concern, the hosting provider could have limited the response about which IPs had spammers been booted from... and when that happend... to just those specific IPs. And I'd then have had all I needed to cross reference this situation and make an informed decision. Michael is telling me that I'm trying to get others to do my job. But how ironic that what is really happening here is that I'm really working my butt off here doing what should be the hosting provider's job. Nevertheless, in the case of hosters who are doing their best, but miss a few snowshoe spammers on occasion, I'm happy to help... and that is more typically how this situation plays out. No hoster is perfect, some snowshoers are very sneaky, and, most of the time, there is actually a good outcome for everyone involved (except the spammers) when a rare ivmSIP/24 FP is reported. Finally, one other consideration (not yet covered on this thread!) is that DNSBLs are lied to all the time. I have been bold-face lied to in recent weeks by spammers. During our initial communications, not knowing anything about Michael Crook at the time, I had to consider the possiblity that he either could have been the actual spammer controlling this whole /24 range, or could have had some relationship with the spammer, or hoster, might not have been merely a customer assiged a single ip. Part of my questions were also designed to eliminate those possibilies. But if I were to limit my options and questions to what Michael would have me to do, then I would alway have to take the lies from real spammers as truth and give them free passes all the time. Once word got out that the system could so easily be gamed, there would be no point in having a blacklist in the first place.
Posted by HardwareFreak, 09-13-2008, 03:42 AM
No, you don't. This statement contradicts everything you've stated following it. If you were indeed a mail admin, then you would have a clue as the amount of time, resources, and frustration we mail admins must commit to fighting spam. You would also have a clue as how to handle this process without blowing your top and acting like a child, throwing threats about. You would also have a clue as to the following: 1. There are over 4.3 billions IPv4 addresses 2. snowshoe spam is a huge problem 3. blocking individual IPs doesn't begin to address it 4. only way to effectively combat it is /24s, even /16s sometimes I dont run a public block list, just a private. Guess what, the smallest thing I block is a /24, and that's rare. The spam problem in general, and snowshoe specifically, for me, is so severe that I whack the biggest block I can every chance I get. I blocked all of Duke University the other day because of a single bot spam. Why? Because no one in my domain will ever need to exchange email with anyone at Duke, and I'd rather not have to deal with even one spam a year from that net, considering there are millions of nets out there that could accidentally send 1 bot spam in the same manner. Why fight them all one by one if I don't have to. Be preemptive when you can. If you are truly a real mail admin, or sysadmin of any kind, this thread would never have been started. You'd be experiencing the same grief as the rest of us, and would have gladly complied with whatever request Rob made of you, and you'd have wanted to make him your friend. The more friends an admin has in the anti spam world, the far more effective one can become over time, and begin to HAVE TIME to spend on meaningful things in life, instead of fighting spam. -- Fighting spam? Paint with a huge brush, use masking tape sparingly
Posted by HardwareFreak, 09-13-2008, 03:52 AM
Again, if you were an admin, you would know that this is SOP (standard operating procedure) in the fight against snowshoe spam. There are tens of thousands of colos and web hosts. If they don't get complaints from their own LEGIT customers who get blocked, then they have no reason to boot spammers from their business. You're venting your anger and frustration at the wrong target. Stop spouting off here. Go to your provider and punch someone there in the nose. Demand to be moved to a clean /24 or that they boot the spammers. Sit in the lobby chair until they come and say "done". Then demand of them compensation for your lost time. -- Fighting spam? Paint with a huge brush, use masking tape sparingly
Posted by HardwareFreak, 09-13-2008, 04:45 AM
tehinternetsizsrs, Michael Crook Is this you in this video: http://peerfear.typepad.com/crook2.mpg
Posted by ub3r, 09-13-2008, 06:20 AM
Stepping back from the rama of drama that this thread has become, in principal, it's his blacklist, he can do what he wants with it. Nobody's forced to use his blacklist, he can ban 0.0.0.0/0 if he wants, and he's still within his rights. I agree with him about the troops though, if that is him.
Posted by tehinternetsizsrs, 09-13-2008, 07:50 AM
At this point, this issue is moot because McEwen has made it clear that he has no intention of resolving this issue. However, since he has responded, and I'm waiting for my pizza to finish microwaving, I'll bite: If this doesn't prove that he expects me to be his errand boy, I don't know what will. The answer is simple: Rob McEwen is not God, and I am not a reporter. Why is it my obligation to ask "follow-up questions" about something that is none of my business? Simple. Rob McEwen ruins lives, so he can't whine when he faces a little opposition. According to whom? Him? His self-made rules? My host has better things to do than be bothered with trivial issues such as this, I'm sure. And here it is. If I don't play by HIS rules, I'm a "lunatic" and I'm not "rational". That stance in itself is not rational. Again, he's asking me to dive into issues that are none of my business. And while I find spam to be annoying, Rob is using the very same melodrama here that he accuses me of. Yes, because he expects everyone to bow down and accept him as their Lord and Savior. When that doesn't happen, as with me, he gets angry. Napolean complex at best. And I didn't bother to read them. They didn't come from any of *my* IP's, and therefore it's not my place to say anything. Oh, he's the poor victim, is he? Yet, people like me are dragged into his game simply because we're on the same block. That's akin to arresting everyone on a street because a murder happened. Again, I get his point, and I understand he has to deal with spammers who may not consider honesty the best policy, but none of that has anything to do with me. I am technically a server admin, for my own server. I run two websites, neither of which are a business, and I use it for personal e-mail. I ensure that my server adheres to anti-spam measures, as previously constituted. I don't leave the admin tasks to someone else. I do not run a hosting company, but if I did, my anti-spam measures would make "God Complex" McEwen here happy. As it stands now, I do everything I possibly can to lock things down: SPF, PTR, a secure mail form, and disabling of e-mailing features on the forums. What else can I be expected to do, in a reasonable world? As for the other points raised, I suppose that if I were a "mail admin" or server admin for a company, I'd be forced to play nice with McEwen, but I'm not. By making the choice to walk away from this (because McEwen has shown he has no interest in or intention of resolving this), I realize I am still wrongfully involved in this. But the arrogance here is astounding. Some of you seem to think that I should play nice with anyone who claims they fight spam, and that we're all one big community. The bottom line is that I can only be concerned with my server. Of course I shouldn't make unreasonable demands of my host. Contacting them with as many silly and invasive questions as McEwen seems to think I should is just insane. And again, none of my IP's are guilty of anything other than being on the same block, so how can I possibly think that I am in a position to demand anything? That's my point here. If I had allowed a friend to run a site on my box, and he did something spammy, I'd be very proactive in resolving the issue, to the point of complying with McEwen's outrageous requests. That would be the responsible thing to do, and I would do it. But what happened stems from activity on IP's I never had control of. McEwen has full knowledge of this, which leads to my point that he expects me to do his job for him. So, of course I won't sit in my host's lobby, nor will I "demand" anything. Their policies about spam are quite clear, and McEwen seems to be ignoring the possibility of IP spoofing and attacks. Simply put, my host does not tolerate spam, considering they take all measures possible to protect their network, as one employee told me. McEwen has full knowledge of this, but doesn't care. My IP's aren't involved, and in a normal world, that should be the end of it. I mean, why should I get involved in someone else's alleged misdeeds? I'm not involved, and because my IP's aren't involved, it's none of my business. I realize I cannot fight city hall, and nothing I do will appease him. Besides, now it's a matter of principle for me, and opening a ticket or otherwise contacting my host is what he wants, even though it's unreasonable and invasive, not to mention wasting my host's time. So, I will leave it as it stands, no matter how much I disagree with it. Whatever admin gets my IP's after I'm done with them can deal with it, or not deal with it. Does that make me selfish, and a bad member of some non-existent community? Last edited by tehinternetsizsrs; 09-13-2008 at 07:59 AM.
Posted by tehinternetsizsrs, 09-13-2008, 08:07 AM
One other point: even lawmakers are seeing that *some* anti-spam fights are too aggressive: http://www.philly.com/philly/wires/a...tispamlaw.html I've always said that McEwen's goal is good, but his ways are too excessive. I've never claimed to be the only one he "picks on", but sooner or later he's going to victimize an innocent ISP who is quite aggressive about spam, and hopefully they will sue him. Until then, I just have to say that I regret McEwen and I weren't able to resolve this, and this matter will be left for the next guy who gets my IP's.
Posted by ub3r, 09-13-2008, 08:12 AM
And... you've lost my support. Stop being so over-dramatic. It's an RBL. Anyone who emails for a living is a scumbag. Even if the mailings are fully opt-in. You aren't contributing anything to society if you bulk mail for a living. If the guy has actually ruined someone's life, then I must shift my support to him. You're never going to win. It's his computer, he can do what he wants with it. Also, you're a lunatic if you called the cops on him. Get yourself some help man.
Posted by tehinternetsizsrs, 09-13-2008, 08:20 AM
I agree with your opinion on spammers. But none of that activity took place on my IP's, so if being upset about that is "over-dramatic", then that's your opinion. Hey, how about if I accuse you of murder? If you argue, you're being over-dramatic. How's that? Which is why I won't do the easy thing and comply with his request. It's principle. McEwen seems to think that it's my place to ask questions. I don't ask questions. It's far better to accept the status-quo and not rock the boat. If the next guy wants to waste his time on McEwen, that's fine. If that were to have happened, I would say it's barnyard justice for his tactics. And if other things happen to be brewing, I'd also say it's fair game. Last edited by tehinternetsizsrs; 09-13-2008 at 08:23 AM.
Posted by ub3r, 09-13-2008, 08:33 AM
I don't know dude. I read some stuff about you on google, and I honestly think you're a sociopath who could definitely benefit from a break from the internet and a 2 year lithium prescription.
Posted by tehinternetsizsrs, 09-13-2008, 08:36 AM
sarcasm on Yeah, heaven forfend I stand up for the situation, and take care of situations where people have wronged me. /sarcasm off I suppose I should have just done what this guy asked of me to begin with? It's principle, "dude". And judging by your comments, you expect everyone to have the exact same opinion on everything, so it's not surprising you're taking the stance that you are.
Posted by ub3r, 09-13-2008, 08:36 AM
You are not mentally sane, and every notion of sanity that resides within your mind is wrong.
Posted by tehinternetsizsrs, 09-13-2008, 08:41 AM
Interesting. All because I don't grab a virtual gun and fight the war on spam? May I ask where you earned your degree that makes you competent to render such a professional opinion? I am quite sane. I just prefer to take care of those who wrong me in a direct but completely legal manner, instead of just accepting it. That's why I'm not upset over this. Karma will visit Mr. McEwen (and it'll be completely legal), and that's why I'm smiling about this. He could have avoided this had he simply been reasonable, so it's not my fault.
Posted by ub3r, 09-13-2008, 08:43 AM
root@mail root]# iptables -A INPUT -s 74.50.100.0/24 -j DROP On a scale from 1 to 10, how angry does this line make you?
Posted by tehinternetsizsrs, 09-13-2008, 08:47 AM
That command? 0. It just shows your ignorance, and your attempt to goad me into further pointless arguments. Plus, it proves the point I've made all along this thread about abuse and overreacting. So, actually, I thank you for proving me right. Oh and I can't get angry when I automatically ban AOL's entire network, not to mention the entire country of Mexico and all military networks, now can I? Last edited by tehinternetsizsrs; 09-13-2008 at 08:52 AM.
Posted by ub3r, 09-13-2008, 08:49 AM
i love you Michael. Keep on trollin' baby.
Posted by tehinternetsizsrs, 09-13-2008, 08:55 AM
And here's the issue. Anyone who disagrees with the status quo is a troll? So I am supposed to AGREE with McEwen's actions, and do everything in my power to HELP resolve the issue? In what parallel universe is that acceptable? It's HIS obligation to resolve it, not mine.
Posted by ub3r, 09-13-2008, 08:59 AM
Dude, this isn't believable in any way. Everything you do is just a stunt to gain notoriety. You're the internet equivalent of a 4 year old girl who dances in front of the tv to get her father's attention.
Posted by tehinternetsizsrs, 09-13-2008, 09:06 AM
Okay, so being concerned about being on a blacklist is a "stunt"? Are you even a host or administrator, "dude"? I am trying to resolve this issue, but am met with hateful people such as McEwen and yourself who seek to do anything but. That seems like more of a stunt to me. Besides, if I were doing this as a stunt, I'd be doing what tin-foil hat people do, which is call the media, and talk about it on my website. I'm doing neither. Want to run that "stunt" scam again, scam boy?
Posted by lamerfreak, 09-13-2008, 09:11 AM
Wow. Kind of expected this to die. I'm willing to be reasonable in my responses and arguments, and I don't fully agree with either position, but it seems you're the more intractable one. It's not that we side with Rob as 'status quo'; I read both points as presented, and find yours lacking. I still find your arguments are missing the mark. I also find some of the dichotomy of your statements hilarious. If he's a Nazi murderer for having a /24 list, what's the effect of blocking any spam, like the 'junk providers' you do? And, yes, over dramatic. You're portraying his actions in blocking a larger swatch as actively damaging to you, personally, though you haven't yet been affected by it at all. 'the prevailing opinion is that the innocent person is required to do all the work' - well, no, it's not ideal. It would be better if that wasn't required, but I'm guessing that you initiated the contact about getting removed from his list. There's going to be a little back-and-forth before that happens. I don't think any of us are budging in our positions, because there's been nothing adequately convincing, I think.
Posted by tehinternetsizsrs, 09-13-2008, 09:18 AM
No you're not. If you did, you'd see things my way. That may sound arrogant but the underlying point is: my specific IP's weren't involved. If they were, even prior my taking them over, then I'd see the point that people are trying to raise here. Apparently, you missed the part where I said it was my own private server, and as such I'm not making God-like decisions for many users. And, it's not that I block e-mail, I block users of AOL, Mexico, and military networks from accessing my site. Big difference. Yes, I followed the instructions on his website, and then he springs a surprise on me, that he wants me to be the go-between between him and my host. I'm certainly not budging, because that would require (as I've said many times) asking questions. I don't ask questions. It is not my business, and the questions he wants me to ask are literally none of my business, because they do not involve my IP's. Look, all bullcrap aside, the whole reason I'm upset over this is because my IP's weren't involved, other than being on the block. Again, if they had been, I'd likely be doing what McEwen wants. I've shown him that I take steps to keep my server in compliance, and I've shown him that my specific IP's weren't involved, but that's not good enough for him. And finally, yes, you're right. This matter should die now. McEwen won't budge, I won't budge, and I'm wasting my time by jumping back into this thread all the time. So, once and for all, it's over. If the next guy wants to battle McEwen over this, so be it. But the battle lines have been drawn, and no happy medium is possible.
Posted by ub3r, 09-13-2008, 09:18 AM
Everything you do is a stunt. I'm an sysadmin/engineer at a datacenter, and happen to know just about everything about webhosting and the internet in general. Also, it was funny to see you make dreamhosts' blog: http://blog.dreamhost.com/2007/03/15...-a-dmca-crook/ . You're a damn good troll, I'll give you that. If I could hold a straight face as long as you, I could probably make a lot of money in poker.
Posted by invaluement, 09-13-2008, 11:32 AM
If Michael had started off with, "I feel morally compelled to not talk to my hosting provider about this, but you are welcome to contact them directly about this situation, since those are not my IPs" ...then at least he would be consistent. But the truth of the matter is that he came up with this only AFTER I requested he pass along that one simple follow-up question. At that point, there was a lot more "attitude" from him and little-to-zero attempts at explaining to me this strange moral code that he states above. The fact is that, early on, he (claimed) that he passed on a question to his hosting provider and relaying that answer back. He didn't (up to that time) provide for me paragraph after paragraph of campaign speeches from him about how he felt this was morally wrong of him to have to do such a thing. (oh, the horror!). In fact, quite the opposite. Before passing along the first question, there was not even a hint of complaint from him. Not in the slightest. He didn't say, "ok, Ill do this, but I feel strange about bothering my hosting provider about other's IPs".. there was nothing like this... NOT in the slightest! This severely undercuts his arguments and any claim to following some code of ethics he might have. He wants to have it both ways. But how curious that he suddenly developed this new code of ethics (that he should not ever even talk to his hosting provider about the spamming behavior of other IPs on this /24 block)... only AFTER I presented a single follow-up question that potentially might have tripped him up. Only, instead of explaining to me this code of ethics, he immediately went into attack mode and spent much time and energy making me out to be the enemy. Here is a good analogy. If the police pull you over and want to search the trunk of your car (for whatever reason), and they currently have no right to force a search of the trunk of your car. Next, they ask you, "may we search your trunk?". You say "yes". Then, after opening the trunk and starting this very legal search (hey, you said "yes"!! You could have said "no"), you THEN say to the police, "wait a minute. Don't open that container and stop this search immediately". Then, you proceed to call the police a bunch of "pigs", and tell them they are corrupt, and also tell them why you shouldn't have to sit there and be delayed for 10 minutes because you have more important things to do. Then, at the court hearing, you suddenly wax elegant about how your civil rights were violated and go off on what the Constitution says about search & seizure, trying to pass this off as your original position all along. THAT is the equivalent of what happened here. Only, Michael wants to revise history and act like he didn't way "yes" to begin with--- (which, in this case, was his relaying the initial question back from his hosting provider) In short, he is making up the rules as he sees fits and as he goes along... and revising history as well.
Posted by lamerfreak, 09-13-2008, 11:39 AM
Not only arrogant, but functionally illogical. It doesn't work like that. People are allowed to make judgement decisions. While I can see the sort of position and principle you're espousing, it doesn't match the rest, and the bluster that goes along with it is out of place. Though, I do have to ask, if I may - Rob, would you pursue the matter with his upstream independently? Matter of principle or not?
Posted by tehinternetsizsrs, 09-13-2008, 11:41 AM
Oh, Rob. You must be Jewish, because that's the most subterfuge I've seen from any one person. Your first question was unreasonable, but I did it in good faith, thinking you'd remove the block, and in the interest of resolving the issue. When you failed to do so, it said to me that regardless of what I do, you're just toying with me, and have no intention of helping. I stopped cooperating because you did. You showed no good faith. Your analogy about cops is outrageous, considering you take issue with my analogies. It also speaks to the superiority and authority complexes you seem to have. To prove my point, I have approached my host with the two questions you insist on having answered, like a baby, despite the fact for you to expect me to do your work over something that never involved me directly is akin to my being raped. When you get your answers, and you still refuse to help, my point will be proven. I have opened a ticket, and have provided them with a link to your little project, and your e-mail address, as well as the your ticket #. The fact that you still spout off after I sent you e-mail advising that I was playing ball with your unreasonable questions shows you have no desire to resolve this. You play the victim card quite well, but in reality, you are the bully. However, I have asked the questions of my host. I am sure you will amazingly have more questions and more excuses. Last edited by tehinternetsizsrs; 09-13-2008 at 11:47 AM.
Posted by ub3r, 09-13-2008, 11:45 AM
The holocaust is a pretty big influence for you huhh? You've gone from calling him a nazi, to calling him a jew. Pick one, will ya?