|Spamhaus CSS Component of the SBL
A dedicated Snowshoe component of the Spamhaus Block List.
About the CSS
As a snowshoe spreads the weight of a traveler across a wide area of snow, snowshoe spammers spread their spam output across many IPs and domains, diluting reputation metrics and evading filters. Snowshoe spammers frequently use many fictitious business names (DBAs), false names and identities, concealed anonymous domains and frequently changing postal dropboxes and voicemail drops to prevent others from connecting snowshoe spam operations to one another and recognizing who is behind the operations and the spam they send.
Spamhaus believes that the problem of snowshoe spam is now large enough to warrant a special response aimed specifically at it. The CSS is our response to this problem, and is a collaborative effort of Spamhaus and the CBL.
Using CSS in your spam filtering
CSS is an integral part of the SBL (and therefore part of ZEN). CSS data is distinguished only by a different SBL return code (127.0.0.3 as opposed to normal SBL records which use 127.0.0.2). If you are already using the SBL or ZEN you should not need to do anything except ensure that your spam filter handles the additional 127.0.0.3 return code.
CSS Delisting Procedure
Unlike traditional SBL records, SBL CSS records do not have a manual delisting procedure. CSS records are automatically expired after 3 days. For this automatic expiration to work, it is vital that all spamming is terminated. If spamming continues, or continues from IPs in the vicinity of a listed IP, the CSS expiration date is continually reset forward upon being redetected. Redetections are also flagged to the SBL team for more extensive SBL listings of the IP range(s) involved.
In normal operation, therefore, CSS records expire automatically once the customer leasing the IPs is removed from the network and CSS detectors stop detecting spam activity from those IPs. Contact the CSS Removals team ONLY if you are the ISP responsible for the complete IP allocation(s) to a customer and if an IP is still listed on the CSS more than 3 days after the customer has been completely removed from your network.
To manually remove a CSS listing click this link and follow the instructions.
Spamhaus appreciates any information supplied to us by ISPs that can help identify a snowshoe spam customer for our records.