The Spamhaus Project - Frequently Asked Questions (FAQ)

What is the SBL?
	The Spamhaus Block List (SBL) is a realtime database of IP addresses of spam-sources, including known spammers, spam gangs, spam operations and spam support services. SBL listings are made according to policies outlined in SBL Policy & Listing Criteria. The database is maintained every day, around the clock, by Spamhaus Project team members around the world.

Why was my IP listed in the XBL?

When mail is received to one of XBL's feeds, the connection is analyzed automatically to determine if the connecting machine is either an open proxy or a spam-sending Trojan Horse. If so, the IP Address is immediately added to Spamhaus' XBL blocklist. XBL only lists single IP address, and only when the spam/virus/trojan connects directly to its feed's servers, not when an intermediate, non-infected-MTA connects, nor due to a virus being bounced by a legitimate MTA ("backscatter").

IP addresses, that host URLs with executable virus/trojan content in emails sent from XBL'd addresses, will also be added due to the very strong likelihood that this is also a trojan infected machine.

Most IPs are listed as a result of directly sending spam or viruses to the CBL system's detectors (spamtraps, special addresses which do not belong to any real users, and which receive only spam) or by initiating SMTP transactions that look similar to viruses or botnet-proxies. Other listed IPs come from NJABL's proxy list. Other feeds of spam-sending exploited systems may be added, but only if they meet Spamhaus quality standards. (XBL formerly included the RSL & BOPM lists, which no longer exist)

If the IP belongs to a NAT gateway/firewall system, Spamhaus strongly recommends blocking all outgoing port 25 traffic from machines on your network not configured and maintained specifically as mailservers. A single infected machine sending spam out through a NAT can result in blocked mail form the whole LAN. See CBL's FAQ for more information.

Removing trojans/viruses from your system

If you find your IP has been listed by XBL, your system is very likely compromised by a virus via mail, web, or other download. To fix it, you need to find and close any open SOCKS, Wingate or HTTP type proxies. Many viruses install open proxies and other Trojan Horse or "backdoor" malware on systems, so you should download a copy of stinger for Windows from www.nai.com, and fix anything it finds.

Also download and read this CERT document Recovering from a Trojan Horse or Virus (PDF).

Useful links:

Before You Connect a New Computer to the Internet
http://www.us-cert.gov/reading_room/before_you_plug_in.html

Understanding Firewalls
http://www.us-cert.gov/cas/tips/ST04-004.html

Windows Update
http://windowsupdate.microsoft.com/

Protect Your PC
http://www.microsoft.com/security/protect/default.asp

Corporate Information
	The Spamhaus Project Ltd. (Spamhaus) is a nonprofit company limited by guarantee with its base in Geneva, Switzerland and Registered Office in London, United Kingdom. Company No. 05303831. For full information about Spamhaus, who we are and what we do, please see: About Spamhaus

I get messages that I'm blocked by you, but when I check my IP on your site it's not listed

Very likely your IP was blocked by our XBL system and has been recently removed either by you or by someone else requesting a removal of the IP. Data in our DNS servers around the Internet, and cached at mail servers, takes a bit of time to update, so wait a couple of hours and the problem should clear by itself.

But bear in mind that if your IP was listed on the XBL, it was listed because the detectors which feed the XBL received either spam or a virus directly from the IP, or found it to be an open proxy. Keep reading for information on what you need to do to ensure it doesn't simply get listed again.

"Role Accounts" & "Feedback Loops"

Spam reports are an important mechanism to detect abuse occurring on or from your network. Reporting spam is a long and venerable tradition on the internet. Most ISPs consider well-crafted spam reports to be a favor to them; they want to know about the problem so they can fix it, before it becomes worse or listed in SBL. There are even specific abuse role accounts required by the RFC documents which are the blueprints of the internet.

A role account is an e-mail address which serves a particular function, not an individual person, for example "sales@" or "info@". Postmaster@domain (RFC2821) and abuse@domain (RFC2142) are the two role accounts which every ISP, webhost, mail service and DNS host must have in order to promptly identify spam and abuse related problems on their network. Networks which do not tolerate spammers are careful to look at their abuse mail every day and take effective actions to stop any problems which arise.

A Feedback Loop (FBL) is an automated stream of spam reports sent by prior agreement between individual receiving and sending networks, often based on a "This Is Spam" button in the user interface. FBLs are intended to help streamline and automate the spam reporting process with specific machine-readable parts. A standard Abuse Reporting Format (ARF) is specified and implemented for FBLs. ARF follows existing RFC2045 MIME standards for e-mail (and the earlier RFC1341). More about ARF is here and here.

A single spam report could be a fluke or someone reporting mail they actually signed up for, or it could represent 10,000 or more spam recipients. For wide-scale, pure-spam mailshots, the reporting rate is often even less than one in 10,000 due to filtering and "LART fatigue" of many who used to report spam. In general, hand-crafted reports are more likely to be actual spam than reports from automated http://tinyurl.com/kda37"This Is Spam" (TIS) buttons. Even TIS reports average in excess of 80% spam, though. Evaluate reports as you will; ignore them at the risk of your network's reputation and e-mail deliverability.

Here are some tools which can help direct spam reports to your proper role account. WARNING: FBLs can produce very high volumes of e-mail. Use a specifically designated e-mail account and allow plenty of disk space and server cycles to accept the full stream of reports. Some networks use a seperate server to accept the flow (for example, fbl@abuse.domain.tld). Do not apply content-based spam filters to FBL or abuse@ accounts or you will discard the very messages you need to keep your network clean.

1. The Network Abuse Clearinghouse
Not a reporting service or FBL per se, but a database of correct addresses for spam reports based on domain. Registered users can send spam reports via its mail server, or anyone can query it to find reporting addresses for a particular domain. Since reports are not automated, volumes tend to be lower and reports hand-crafted. This may identify some of the more stubborn spam issues on a network, for example HTTP redirectors or DNS. See the Abuse.net website for instructions on using and updating its database.

2. SpamCop
SpamCop reports the spam source, SMTP relay and spamvertised URLs in the message body based on IP. Registered users can use SpamCop to parse and report spam. A SpamCop feed might be high volume depending on your network size and output. The instructions on this page explain how anyone can receive SpamCop daily or hourly summaries about spam problems in specified IP ranges. For more information see the SpamCop FAQ for abuse-desks and administrators.

3. AOL Feedback Loop: http://postmaster.aol.com/tools/fbl.html
When AOL users click the "This Is Spam" button in their e-mail client, this system generates a "SCOMP" report to you. While it can be high-volume, it offers excellent feedback on proxies, virus infections and spammers on your network. You need to sign up for this free service with AOL. (And same with the MSN, Yahoo! and Outblaze systems, too.) AOL's whitelist info is here.

4. Outblaze (mail.com): Request a feedback loop by contacting postmaster@outblaze.com. ISPs and COI bulk mailers only!

5. Microsoft (msn.com, live.com, hotmail.com) has Feedback Loops and other information for bulk mailers at http://postmaster.msn.com/. Their Smart Network Data Services includes delivery numbers at SNDS, "Junk Mail Reporting Program" FBL at JMRPP and other services. Senders may also be interested in this PDF to help their delivery.

6. United Online Trusted List and Feedback Loop (Netzero and Juno): http://www.unitedonline.net/postmaster/whitelisted.html

7. Road Runner FBL: http://feedback.postmaster.rr.com/
Road Runner's postmaster page: http://postmaster.rr.com/

8. Yahoo! FBL: http://feedbackloop.yahoo.net/
Deliverability information: http://postmaster.yahoo.com/

9. "USA.net offers a feedback loop service, operated by Return Path, free of charge, to parties sending large amounts of mail to USA.net members. The feedback loop (FBL) will forward any mail reported as spam originating from the associated IP addresses back to the listed email address. We highly recommend the use of a dedicated e-mail address for this purpose." (Spamhaus: good advice for any FBL!) And, of course, http://postmaster.usa.net/.

10. Comcast Feedback Loop: http://feedback.comcast.net/
Postmaster pages for more info: http://postmaster.comcast.net/

11. Earthlink Feedback Loop: Write to fblrequest@abuse.earthlink.net with your IP range, domains, your network's contact information including name, contact e-mail and phone, and the e-mail to which the FBL will be sent. ISPs only. [May 2009: reported to be unresponsive; status unknown.]

12. Excite Feedback Loop: http://feedback.bluetie.com/

13. Cox.net Feedback Loop: http://fbl.cox.net/ and Postmaster pages.

14. Mailtrust Feedback Loop: http://fbl.mailtrust.com/ (Rackspace.com)

15. Tucows (OpenSRS) Feedback Loop: http://fbl.hostedemail.com/

Spamhaus is happy to update this information at the request of the FBL provider or other authority. Other sites have additional information. Also, private FBLs can be established between consenting parties. And ask your network friends and geek buddies to filter spam from your IP ranges into a forwarding account for you.

Tip: Do not put your FBL or abuse@ account behind spam filters, and particularly not behind content filters. What's the point of filtering away the evidence you need to clean up your network?

Finally, be sure that your network has an enforcible Acceptable Use Policy (AUP) as a part of your contract with each and every customer! More examples are here. Seek legal counsel to ensure that your AUP will cover you in the event of account termination for abuse.

What is a DNSBL?

The acronym DNSBL stands for Domain Name System Block List. Understanding DNSBL Filtering explains the concept in words and diagrams.

DNSBLs list IP addresses. These IP addresses are often those that the list operator has observed sending spam, hosting the web sites of spammers, or providing other services to spammers (collectively called spam support services). The Spamhaus Policy Blocklist (PBL) lists IPs that the ISP does not (or should not) allow to send email directly to other SMTP servers, but should send email only via the ISP's designated outgoing SMTP servers. Some DNSBLs have other listing criteria, such as geographic lists of IPs by country. Those DNSBLs may be used for a variety of purposes.

DNSBLs are used by companies, ISPs, and even individual email applications to help determine whether an email is likely to be spam, and if it is to prevent that email from being delivered to the recipient. Usually a company or ISP's SMTP server checks the DNSBL when an email is received, and refused that email if it is coming from a listed IP or if it contains a URL that is hosted on a listed IP.

DNSBLs are sometimes called RBLs (Realtime Blackhole Lists) after MAPS, the granddaddy of all DNSBLs. They can also be called just blocklists, blacklists, or simply BLs.

IMPORTANT: A DNSBL cannot stop anyone from sending mail. It only prevents delivery at the receiving end when the receiver specifically configures his mail server or mail software to consult it. DNSBLs are strictly defensive tools; they cannot be used to launch denial-of-service (DOS) attacks or to do any offensive damage.

What is ROKSO?

The Register of Known Spam Operations (ROKSO) is a register of spam senders and spam services that have been thrown off Internet Service Providers 3 times or more in connection with spamming or providing spam services, and are therefore repeat offenders. Spamhaus believes that these known determined professional spam operations are responsible for approximately 80% of spam on the Internet.

The ROKSO database collates information and evidence on each spam operation to assist ISP Abuse Desks and Law Enforcement Agencies.

The existence of these known professional spammers, the aliases and shell companies they use to obtain ISP accounts, their methods and history is vital need-to-know information for the protection of internet networks.

The current list of ROKSO spammers is located at this webpage.

Spamtrap

A spamtrap is an address that is used to capture spam sent to it in order to provide information on what spam is being sent and from where. Spamtraps do not belong to real users, they are decoys set up to catch spammers, monitor and collect spam.

When using spamtraps in automated systems, in order to prevent legitimate email from being invited, a spamtrap e-mail address is never published where a human can find it. As the address is never visible to humans, no sender would be encouraged to send messages to the email address for any legitimate purpose.

Normally spamtrap addresses are obtained by spammers through the use of automated e-mail address harvesters, through 'dictionary attacks' on mail servers, by buying lists from other spammers, or by importing lists from generic address CD-ROMs sold by spammers around the Internet. Almost all CD-ROMs of 'targetted' or 'opt-in' email addresses sold on the internet contain spamtraps belonging to Spamhaus and other major anti-spam systems.

Because spamtraps do not belong to a real user they can never "opt-in" to any bulk email advertising list since it is impossible for the spamtrap address to initiate, respond or to give or to confirm consent.

Email Addresses

The Golden Rule is: Never buy email addresses from anyone.

No legitimate company will ever sell you a list of 'opt-in' email addresses. Anyone selling you lists of 'opt-in' email addresses is very simply a spam outfit. If you have been sold a list of email addresses which the seller promises are "opt-in", you have been conned.

Sending any bulk email to an address list purchased from a third party is guaranteed to get you in trouble for spamming, since none of the owners of the addresses on the purchased list gave you consent to subscribe them to your list.

All advertisements for lists of "opt-in email addresses" are fraudulent. No matter how legitimate the seller's web site looks, or how much the seller 'guarantees' or promises you the addresses are 'opt-in', never get suckered into buying any email address list.

Many spam outifts offer lists of 'opt-in' email addresses for sale and tell naive buyers that it is 'safe' to send bulk email to them. It never is. Inevitably purchased lists contain Spamtraps or generate complaints and the buyers find themselves blacklisted for spamming, then only after ruining their company names and losing their internet accounts they discover that the list seller's 'guarantee' was not worth a dime.

The Exception Which Proves The Rule is when a legitimate COI list is transfered from one owner to another owner, exclusively, such as in a company buyout, with all the subscription agreements retained including the topic of the list. COI records should be transfered as part of the agreement. That is obviously a special case, and very different from buying generic lists which are repeatedly resold to multiple buyers.

Help! My IP address is on the PBL! What should I do?

Nothing, in most cases. Read through this FAQ for further explanations.

The first thing to know is: THE PBL IS NOT A BLACKLIST. You are not listed for spamming or for anything you have done. The PBL is simply a list of all of the world's dynamic IP space, i.e: IP ranges normally assigned to ISP broadband customers (DSL, DHCP, PPP, cable, dialup). It is perfectly normal for dynamic IP addresses to be listed on the PBL. In fact all dynamic IP addresses in the world should be on the PBL. Even static IPs which do not send mail should be listed in the PBL.

PBL listings do not prevent you sending email unless your email program is not authenticating properly when it connects to your ISP or to your company's mail server. This can happen if you have forgotten to turn on 'SMTP Authentication' or if you have switched 'SMTP Authentication' off by mistake.

If you are using a normal email program such as Outlook, Entourage, Thunderbird or Apple Mail and you are being blocked by a Spamhaus PBL listing when you try to send email, the reason is simply that YOU NEED TO TURN ON 'SMTP AUTHENTICATION' in your email program's account settings. That will solve the problem for you. See: How do I turn on SMTP Authentication?

Server admins who need help with SMTP AUTH can find lots of information for most servers such as Sendmail, Postfix, Exim, Qmail, Exchange, etc.

What is DROP?

DROP (Don't Route Or Peer) is an advisory "drop all traffic" list. DROP is a tiny subset of the SBL designed for use by firewalls and routing equipment. The DROP list will not include any IP space allocated to a legitimate network and reassigned - even if reassigned to the proverbial "spammers from hell". DROP includes IP space totally controlled by spammers or 100% spam hosting operations. These are "direct allocations" from ARIN, RIPE, APNIC, LACNIC, or other Regional Internet Registries and "portable allocations" (known as "PI") from RIPE.

Spamhaus strongly recommends the use of DROP by tier-1 and backbone networks. Simply consulting the DROP list's webpage when someone asks you to route some suspicious IPs can help avoid picking up customers you would just as soon not have on your network.

How do I turn on SMTP Authentication?

SMTP Authentication is required when sending email out via most major ISP mail servers and most corporate mail servers. It is simply a username/password system which permits authenticated e-mail senders, just like most other computer accounts require authentication.

If you do not have SMTP Authentication turned on in your email software (Outlook, Entourage, Eudora, Apple Mail, etc.) you run the risk that the mail server will not recognize that you are a legitimate customer.

If the mail server is using spam filters (such as Spamhaus' PBL or XBL) it may refuse to take your email, because it thinks you are a stranger and your dynamic IP address is probably on Spamhaus' PBL list of dynamic IP addresses which mail servers should not accept mail from unless the sender is authorized to use that mail server.

To fix this, you need to turn on "SMTP Authentication", here's how:

In Microsoft Outlook & Outlook Express:

In Eudora:

In Apple Mail:

In Agent:

Wikipedia and Google have lots more information about "smarthosts" and "SMTP AUTH".

I have a Million Dollars for you, just contact me for it.

Millions of email users around the world regularly receive scam emails. This type of spam is sent out to huge lists of addresses in the hope a few 'suckers' will bite. These emails promise $Millions in 'inheritance' from someone you never knew existed, or inform you that you won '$Millions' in an 'Email Lottery' (no such thing exists), or promise you a share of $Millions if you'll help launder the money (which does not exist). The email Subjects vary endlessly, typical themes include:

CONGRATULATIONS! You have won a Lottery!

Contact Western Union Bank Urgently!

Your ATM MASTERCARD worth $800,000 USD is with FedEx!

URGENT! Contact My Secretary Now!

Contact me for your Compensation Fund

These scam emails have endlessly-varying topics, typical examples say things such as:

"I write to solicit your assistance in a funds transfer deal involving US$ 3.5M.This fund has been stashed out of the excess profit made last 2years by my branch office of the International Commercial Bank of Lagos Nigeria which I am the manager."
"I am a rich widow, all my family died in a horrible plane crash, I too am dying of cancer. Before I die I wish to give all my {$Millions} to you, because I found your name on the Internet and I trust you. Please help me. God Bless You."
"I have deposited your ATM MASTERCARD worth $800,000 USD with FedEx. Insurance and delivery charges have been paid for, but the only fee remaining is the security safe keeping fee of $185 USD which you will be required to pay."
"Congratulations on your success in our sweepstake! Your email address attached to Ticket No:WRNM/SMI/5990 won the draw in the Second category! You have been approve for the star prize of USD$1.7M! Just send us your bank details..."
"My name is Dr. Rev. Brown Hamilton Esq. I am the attorney of Late Mrs. Jennifer Wilson, who died in London UK . I have a business proposition for you. My late client lodged huge amount of money in a security vault..."

"The Bank Of Nigeria is pleased to notify you that you have been chosen by the board of trustees as one of the final recipients of a Grant/Donation cash aid of US$850,000.00"

Without exception, ALL such emails are scams. Never, ever, respond to any of these emails, you would be responding directly to criminals.

What is the DBL?
	The Spamhaus Domain Block List (DBL) is a realtime database of spam domains including spam payload URLs, spam sources and senders ("right-hand side"), known spammers and spam gangs, and phish, virus and malware-related sites. The database is maintained 24/7 by both an automated system and by Spamhaus Project team members around the world.

Is the new Spamhaus DBL included in my Datafeed?
	Yes. All DNSBLs Spamhaus produces are always included in the Datafeed. There is no additional cost to use new additions in the Datafeed. You will find an announcement and usage instructions in your Datafeed Account Area. You can then begin using the DBL straight away.

Does this remove me from Spamhaus blocklists?
	NO. It is not possible to whitelist an IP address or domain that is on any Spamhaus Project blocklist. The whitelist application system will not accept any IP address or domain that is on any Spamhaus Project blocklist, or that has a history of being on any Spamhaus Project blocklist.

How do I get on the whitelist?

During the first 6 months of the whitelist operation, in what Spamhaus refers to as the 'sunrise period', free whitelist accounts are being given to a select number of known 'white hat' organizations only.

During the sunrise period applications for whitelist accounts are ONLY available by invitation. To add an IP address or a domain to the whitelist you must first be sent an invitation by someone who already has a whitelist account.

Whitelist account holders are chosen by others who trust them; they cannot simply apply.

Will this stop me getting on a Spamhaus blocklist?
	NO. A whitelisted IP address or domain which later becomes blocklisted by Spamhaus Project is automatically suspended from the whitelist until the blocklisting issue is fully resolved with Spamhaus Project.

Why use a DNSBL? (DNS Block List)

Doing a DNSBL lookup on a message at SMTP connect time is cheap in hardware cycles and system time. Your DNS server may even have it cached from the last time the spammer tried.

If your MTA already knows the incoming message is spam it can deny a spam message before having to pass it to mail-scanner (medium cost), through the virus scanner (medium to expensive), bayesian filtering (medium), spamassassin network tests: blacklists, DCC, pyzor, razor, etc. (medium - high).

Mail rejected by a DNSBL during delivery is not silently discarded into the "bit bucket". A DNSBL realtime rejection creates a delivery status notification (DSN) to the sender identifying the cause of the rejection, therebye allowing troubleshooting on the sender's end. (i.e., no "lost messages")

Realtime rejection avoids the "backscatter" problem of some spam filters which accept delivery, close the connection, and then try to return the mail after it is determined to be spam. Of course, as we all know, most spam and all viruses have forged sender addresses, and so the "bounce" goes back to an innocent third party (if it is deliverable at all).

Using the SBL-XBL lists together, or the combined Spamhaus Zen zone (recommended), rejects a very large amount of spam and virus mail with very low "false positive" rejections of legitimate mail. And remember, when used in SMTP realtime, all those rejected legitimate mails are instantly reported to the sender with a DSN.

Spam
	Spam is Unsolicited Bulk E-mail ("UBE"). Unsolicited means that the Recipient has not granted verifiable permission for the message to be sent. Bulk means that the message is sent as part of a larger collection of messages, all having substantively identical content. For the standard accepted definition of "Spam" see: http://www.spamhaus.org/definition.html

A Quick Fix (POP before SMTP)

If you are encountering a problem with the PBL when sending email from an email program (Outlook, Entourage, Apple Mail, Thunderbird, etc.) try checking for new mail first and then sending. Do what you normally do to check if you have new mail (make your email program connect to your mail server to check for new incoming emails), then a few seconds after checking, try sending mail.

If checking before sending works, you can use this method (it is called 'POP before SMTP') to send your emails while you find a permanent fix to the problem. Importantly, if this method works, it means that you have a problem with your SMTP Authentication settings (it means your SMTP Authentication is OFF or badly configured).

Identify your IPs so other networks can reach you!

Problems which aren't identified don't get fixed.

Provide roper role accounts in RIR records, including abuse role accounts. Be sure such accounts are read frequently by admins with the authority to fix the problems identified by reports to that address.

Properly identify subnet clients. For example, ARIN requires public identification records for /29 (8 IPs) and larger ranges (section 4.2.3.7.2.).

This FAQ also has information about proper rDNS as well as the role accounts to go with those hostnames.

Who uses the SBL?

The SBL is used by many of the world's Internet backbones, large tier-1 providers and ISPs in almost every county, including a number of large U.S. and European government and military networks, and some of the best giant free email providers. Most large SBL subscribers, universities and corporations (which include major banks, aerospace and electronics) have hourly SBL Data Feeds. The combined SBL user base (mailboxes protected by the SBL) now exceeds 600 Million internet user mailboxes*.

Companies marketing anti-spam software and hardware gateways have also incorporated an SBL feed into their products where it helps protect their customers by identifying worldwide spam sources.

* as of October 2009 the SBL user base exceeded 1,467,562,000 internet user mailboxes.

How do I use a Spamhaus DNSBL?

These answers presume you are running your own mail servers!

All modern mail servers have a 'DNSBL' feature (sometimes called 'RBL Servers' or 'Blacklist'). If you are not sure whether yours does, read its 'Help' file or ask your mail server vendor.

Depending on how much email traffic you have, you can either use Spamhaus public mirrors free by setting your mail server's 'DNSBL' feature to query zen.spamhaus.org, or - if you have high traffic - you will need a special Data Feed from us.

There is more information in our "How-to-Use" FAQ, and see the following FAQ 'What zone should my server or spam filter query?'

Remember, use your mail server to query a Spamhaus DNS zone such as zen.spamhaus.org. Do not automate queries of our website lookup form!

There are other ways to use SBL beyond just checking the connecting IP. Our Effective Spam Filtering page has suggestions for checking URIs in the spam against SBL, which is very effective at stopping spam. Nameserver IPs of connecting hosts are another check which some admins have found effective. If you decide to do such checks on your mailstream, be very careful which Spamhaus zone you select for each step. Checking against SBL is quite conservative and will have few false positives. Checking against XBL is more aggressive and while it will catch more spam it may also intercept more non-spam mail. Don't use URI checks against PBL unless you know exactly what you're doing; that will result in rejecting non-spam mail for most servers. Remember that Zen zone contains SBL, XBL and PBL combined, so you will need to select the correct response based on the 127 return code.

Bank / Paypal "Update your Account" Phishing Scams

Phishing is a high-tech scam that uses spam or pop-up messages to deceive you into disclosing your credit card numbers, bank account information, Social Security number, passwords, or other sensitive information.

Phishing spams are email messages that claim to be from a business or organization that you deal with, such as your bank, an online payment service such as PayPal, an auction house such as eBay, your Internet service provider (ISP), or even a government agency. The message usually says that you need to "update" or "validate" your account information, and often threatens the closure of your account if you don't respond.

When clicked, the email link will take you to an official-looking web site, which usually looks identical to the real one (since the fraudster has simply lifted the logos and wording from the real site), and will request you enter your account number, password, etc. This should obviously not be done as they will then empty accounts of funds or use them to commit other crimes.

If you see one of these scams, please report it to the Anti-Phishing Working Group by emailing their <reportphishing@antiphishing.org> address. eBay scams can also be emailed to <spoof@ebay.com> and PayPal has a reporting page.

SPAM ®

SPAM Chopped Pork and Ham is a famous canned meat product made mainly from ham. Great in sandwiches, salads or mac & cheese, or with eggs, cheese, or pineapples, or sliced, diced, baked or fried. The name derives from "sp(iced h)am". SPAM is a registered trademark of Hormel Foods Corporation. The product name "SPAM" (used always in uppercase) has nothing to do with the internet jargon word "spam" meaning unsolicited bulk email. While "spam" (junk email) is bad for internet users, SPAM (Chopped Pork and Ham) is good for internet users. If you have never tasted SPAM, try it today!

I have 'SMTP Authentication' switched ON but I'm still blocked!

If you are absolutely sure that you have SMTP Authentication turned on properly in your email program, then contact the administrator of the mail server you are trying to send your email out through. It will usually be your ISP's mail server or your company's mail server. Ask them to check your "SMTP Authentication" settings.

Things to check:

Are your outgoing mail server account, username and password correct? (check them, and remember that passwords are case-sensitive)
Is the SMTP authentication working correctly at your mail server? (ask your ISP to check)
Make sure you are connecting to your mail server's 'authenticated mail' port 587 and not the ordinary 'unauthenticated' port 25. (ask your ISP to check for you)
Mail servers only run spam filters such as Spamhaus PBL on port 25, so if you find you are being blocked by the PBL when you try to send mail to your mail server that means you are not communicating with the mail server on the 'authenticated' port 587 but you're still on port 25. This means your 'SMTP Authentication' is not working correctly. (ask your ISP to check for you)

In summary, if you are being blocked by the PBL when you try to send mail from your PC or Mac to your mail server that means you are sending on port 25, which means that even though you think you have SMTP Authentication switched on, your SMTP Authentication is not working correctly. This can often be something as simple as a bad password, see "Things to check" above.

Single IP Removal for Mail Server Administrators

If you are a mail server administrator and the static IP address of your outbound mail server is listed in the PBL it is easy and quick to exempt it. Follow the PBL links from the "Lookup IP" form and you will find a web form for self-removal. Fill in the form and follow the instructions, and your static IP address will be removed from the PBL. Allow 45 minutes for DNS to propogate after removal, then try your mail again.

You should only remove an IP address which meets all of these criteria:

You should only remove one mail server IP address, not the whole nearby range which does not send mail. If you need to remove more than one IP address you should contact your ISP and show them this FAQ.

How to use the Block Lists

The Spamhaus Block List (SBL), Exploits Block List (XBL) and Policy Block List (PBL) can be used by all modern mail servers by setting your mail server's anti-spam DNSBL feature (sometimes called "Blacklist DNS Servers" or "RBL servers") to query our zones. All three zones can be queried in one single DNS lookup at zen.spamhaus.org.

For information on how to configure your mail server to use the Spamhaus zones, please refer to your mail server documentation or manuals, or ask your mail server developer. With so many different mail servers in use we can not offer technical help with setting up the query system.

An overview off Effective Spam Filtering strategies explains additional uses of spam block lists such as URI_SBL in SpamAssassin and SURBLs and URIBL, domain-based DNS spam blocking lists.

How do I use the SBL?

The Spamhaus Block List ("SBL") is in a format intended to be used by the mailservers of corporations or ISPs. End users should ask their email provider if they use the SBL, and if not, ask them to implement it. If this is not possible, end users should look for spam filtering software that is able to use "DNSBL" systems (sometimes called "Blacklist DNS Servers" or "RBL servers"). Most will have the SBL (or ZEN, or the older SBL-XBL) as a default or available as an option. Use of the SBL in query mode is free for users with normal mail server traffic (but ISPs and corporate networks with heavy email traffic will need to use our Data Feed service).

The SBL can be used by almost all modern mail servers, by setting your mail server's anti-spam DNSBL feature (sometimes called "Blacklist DNS Servers" or "RBL servers") to query sbl.spamhaus.org.

For information on how to configure your mail server to use sbl.spamhaus.org please refer to your mail server documentation/manuals or ask your mail server developer. With so many different mail servers in use we can not offer technical help with setting up the SBL.

We recommend you use sbl.spamhaus.org together with xbl.spamhaus.org and pbl.spamhaus.org, as the SBL and XBL/PBL block different spam sources. To save you having to query three separate DNSBL zones, there combined "zen.spamhaus.org" zone contains the complete SBL, XBL and PBL data. Your server can safely reject SMTP connections from any IP listed in Zen by simply setting your mail server's DNSBL check to query zen.spamhaus.org only. Read the XBL FAQ and PBL FAQ for further information if your application uses second-stage filtering such as URI checks or full header traversal.

We ask, but do not require, that all ISPs using our BL zones inform customers of the fact you run spam filters (simply because it is the correct thing to do). Use of known-to-be-effective spam blocklists is normally seen as a service advantage and strong sales point. All SBL, XBL and PBL users are welcome to use the "email protected by" SBL, XBL and PBL web badges on sites.

We get a lot of abuse mail, how can we handle it?

There are two queue-management tools designed specifically with the needs of an abuse desk in mind. They both come highly recommended and are both used in production environments at large ISP/NSP abuse departments:

Abacus commercial ticketing/tracking system

RT Incident Response open-source ticketing tool

Also, procmail can be extremely useful for sorting an inbound mail stream. For example, you could flag and sort any mail which had any of your IPs in it. Spammers can even turn themselves in, that way.

Filtering an abuse@ mailbox can be tricky because much of the mail which it should receive looks like spam. Filter out spam reports and you risk not identifying a problem on your network. Spamresource.com offers some thoughts on how to deal with all the spam aimed at the abuse box.

The 'Nigerian' 419 Scam

Named after the 4.1.9 section of the Nigerian penal code, the 419 scam is an 'advance fee' fraud which has suckered many unwary Internet users.

You receive an email generally marked "urgent" or "confidential" from someone asking for your help in moving "millions of dollars" out of their country. Often the scammer claims to be a Nigerian bank manager, a Nigerian government official, the wife of a deceased Nigerian general, an official with the Nigerian National Petroleum Corporation, or other 'important' person. Sometimes the scammer claims to be a church minister, an Iraqi officer on the run from Saddam's men, or a tragic widow dying of cancer (and you're her last hope), etc.

The variations of 419 'Advance Fee Fraud' are highly creative and virtually endless. Always there is an offer of giving you a percentage of a "vast sum of money" for your help moving the money out of the country. The money naturally, doesn't exist. Common variations on the scam include: needing help moving millions of dollars from a forgotten account, getting diamonds or gold out of the country, a frozen inheritance, oil money, charity money, etc.

At some point, the victim is asked to pay up front an Advance Fee of some sort, be it an "Advance Fee", "Transfer Tax", "Performance Bond", or to extend credit, grant COD privileges, send back "change" on an overage cashier's check or money order, etc. If the victim pays the fee, there are often many "complications" which require still more advance payments until the victim finally runs out of money.

What zone should my server or spam filter query?

For most mail servers seeking general-purpose spam blocking, Spamhaus recommends using the combined zone zen.spamhaus.org which is a composite of all the Spamhaus IP lists, built for the most effective server-level spam blocking and long-term server configuration stability. Because ZEN includes PBL (which has many dynamic ranges), be sure to whitelist any dynamic ranges which are authorized to use your outbound relay, of course. Authenticating users via SMTP AUTH is also a good idea.

For more about specific Spamhaus zones, see their respective sections in this FAQ (sidebar left), and particularly the main pages for each zone:

There is also a zone of sbl-xbl.spamhaus.org which includes both SBL and XBL, but not PBL. It may be appropriate for mail client filtering, later in this FAQ.

Spammer

A sender of Unsolicited Bulk E-mail (UBE), or "spam". A person who either knowingly or unknowingly sends UBE is termed a "spam sender", the short form of which is "spammer". Also a person who engages in the business of spam, supplying software, hosting, or other materials to enable spamming.

Traditionally it means any person who sends, pays or arranges for someone else to send, or assists someone else to send spam, or otherwise directly or indirectly benefits from spam.

For the standard definition of "Spam" see: http://www.spamhaus.org/definition.html

I delisted my IP, but it keeps getting relisted again. Why??

You have either an open proxy, a virus, a trojan spam-sender or some other sort of security compromise which is causing your IP to be relisted. Always ensure that viruses, trojans and open proxies are removed or secured before trying to delist your IP.

If you run a Microsoft Windows based system, you should download a copy of stinger for Windows from www.nai.com, and fix anything it finds. See "Removing trojans/viruses from your system" in this FAQ for further information. More tools for checking if your PC may be infected are at http://www.mynetwatchman.com/tools/sc/

If after checking your PC for viruses/trojans/worms you are still unable to find the problem, contact the CBL team (see the CBL website http://cbl.abuseat.org for the correct email address).

The 'Nigerian' Purchase Scam

You receive an email from someone wanting to buy somthing from you/your website, he wants to pay by check and (usually) wants you to ship the products to his address in Lagos, Nigeria.

The variants on this scam often involve:

A payment via check is made, but (some weeks later) is returned by the bank on which it's drawn because it was forged. The scammer counts on your willingness to ship the product after your bank has (provisionally) cleared the check, and before the check has cleared its way through the whole international banking system.
An "accidental" overpayment by the buyer, who asks you to deposit the check and then refund the amount of the "overpayment" when you ship the goods. You're out both the cost of the goods, and whatever "overpayment" you refund, when you find that the original check is made of rubber.

DNSBL Queries

We recommend you use SBL together with XBL and PBL, as the three zones block different spam sources. To save you having to query three separate DNSBL zones there is a special combined DNSBL zone called Zen which contains the complete SBL, XBL and PBL data. We recommend you use this combined DNSBL zone for checking SMTP connecting IP. To use it, simply set your mail server's DNSBL check to query zen.spamhaus.org only. (Don't query SBL, XBL or PBL and Zen!)

DNSBL	Zone to Query	Returns	Contains
SBL	sbl.spamhaus.org	127.0.0.2-3	Static UBE sources, verified spam services and ROKSO spammers
XBL	xbl.spamhaus.org	127.0.0.4-7	Illegal 3rd party exploits, including proxies, worms and trojan exploits
PBL	pbl.spamhaus.org	127.0.0.10-11	IP ranges which should not be delivering unauthenticated SMTP email.
ZEN	zen.spamhaus.org	127.0.0.2-11	Combined zone (recommended) Includes SBL, XBL and PBL.

How often should my system fetch the DROP list?
	Please DO NOT auto-fetch the DROP list more than once per hour! The DROP list changes quite slowly. There is no need to update cached data more than once per hour, in fact once per day is more than enough in most cases. Automated downloads must be at least one hour apart. Excessive downloads may result in your IP being firewalled from the Spamhaus website.

Query Service or Rsync Service, which should I choose?

The choice of which service to apply for, Datafeed Query Service or Datafeed Rsync Service, depends on how big your network is and how high your email traffic is.

If you have 1,000's of users and very high email traffic or you want to serve our DNSBL data locally to multiple mail servers on your network, we recommend you use the Rsync Service. The Rsync Service requires some setup on your end (requires you also set up Rbldnsd) and usually a dedicated server (although you can also run Rbldnsd on the same machine as your DNS server). So only take the Rsync Service if you understand why you want Rsync/Rbldnsd.

If your network is medium-sized, small, or you want a non-complicated solution with no software to install, the best choice is the Datafeed Query Service. With this service the Datafeed Service Group assigns you a unique account ID and access to a set of private Datafeed Query Service servers. The Query Service is very simple to install (it should take you literally one minute to set up on most moderns mail servers). It requires no extra software or servers.

Instructions for using the Datafeed Query Service with Microsoft Exchange 2007 (PDF. 166 KB) have been published by MXTools.

Both services perform the same. You can switch from Query Service to Rsync Service later on if you find reason to need Rsync Service.

But we're not seeing any spam reports!

There are any number of reasons you didn't see spam reports before your IPs were blocked by Spamhaus or other lists or networks. Among them:

You're not signed up for sufficient Feedback Loops. (scroll up for FBLs!)

Your abuse@ account is filtered so spam reports don't get through. It goes over quota, has insufficient retention capacity, inadequate search tools, isn't read frequently or completely, or is otherwise dysfunctional.

Filters are catching spam from your IPs before it hits reporting addresses.

People, users and ISP admins, are tired of reporting spam and simply block it as soon as it's detected, no questions or comments. Sometimes called "LART fatigue".

The use of "disposable e-mail addresses" means those who use them aren't seeing spam in their primary accounts, so it doesn't get reported.

Spammers have improved their listwashing methods to eliminate spam reporting addresses. ISPs aid that process by passing reports along to spammers, but spammers have many other means to wash away the symptoms of their ill-gotten lists while not fixing the basic problem (i.e., no opt in).

What do the 127.*.*.* Return Codes mean?

Return Code	Zone	Description
127.0.0.2	SBL	Spamhaus SBL Data
127.0.0.3	SBL	Spamhaus SBL CSS Data
127.0.0.4	XBL	CBL Data
127.0.0.5	XBL	Customized NJABL Data
127.0.0.10	PBL	ISP Maintained
127.0.0.11	PBL	Spamhaus Maintained

Spamhaus uses this general convention for return codes:

Return Code	Description
127.0.0.0/24	Spamhaus IP Blocklists
127.0.1.0/24	Spamhaus Domain Blocklists
127.0.2.0/24	Spamhaus Whitelists

Snowshoe Spamming

Like a snowshoe spreads the load of a traveler across a wide area of snow, snowshoe spamming is a technique used by spammers to spread spam output across many IPs and domains, in order to dilute reputation metrics and evade filters.

Snowshoers use many fictitious business names (DBAs), fake names and identities, and frequently changing postal dropboxes and voicemail drops. Conversely, legitimate mailers try hard to build brand reputation based on a real business address, a known domain and a small permanent range of sending IPs. Snowshoers often use anonymized or unidentifiable whois records, whereas legitimate senders are proud to provide their bona fide identity.

Some showshoers use tunneled connections from their back-end spam cannon to the spam egress IP. The back-end IP address is not in the spam headers. ISPs, you are in a position to detect those back-end spam cannons by checking where traffic flows are coming from. Remember, the tunneled connection is not necessarily on port 25. Spamhaus always appreciates such information.

Listwashing

Listwashing is the systematic removal of complainants from an illicitly gathered address list with no other action taken to stop spamming the remainder of the list. Listwashing removes spam symptoms without curing the underlying problem. ISPs which simply pass abuse reports on to their spamming customers without investigation or further consequences are aiding in listwashing and spamming.

Listwashing is often done in conjunction with snowshoe spamming and waterfalling to attempt to clean bad lists and improve deliverability, rather than simply using OPT IN address acquisition in the first place. Listwashers nearly always include per-recipient codes in the headers and payload URLs. Together with careful list segmentation, dirty lists can be washed to a clean enough state that some ESPs are willing to risk sending spam by importing those lists.

How much spam will the SBL block for me?

This depends on a number of factors; how many domains you host, how many email addresses in those domains have been harvested by spammers, pulled out by dictionary attacks, etc.

Current numbers show the SBL can stop, on average, 5-10% of incoming spam at SMTP connection time, and 60-90% of spam in message body URI checks.

The SBL is meant to be used in conjunction with other Blocklists. The SBL targets spammers who host on, or spam from, a fixed location.

Additional systems such as the Spamhaus XBL (Exploits Block List) and the Spamhaus PBL (Policy Block List) should be used to block spam from spammers who use criminal methods to spam. These target spammers using open botnet-proxies - PCs they have infected with viruses. The combination of all three is available in our Spamhaus Zen zone.

See the Spam Filtering Guidewith charts and details on how the Blocklists function.

Why didn't you notify me first!

Spamhaus adds between 1,500,000 to 2,000,000 IP addresses to the SBL, XBL and PBL databases every single day.

There is no technology to match the hundreds of millions of IP addresses in the world to email addresses of people using them at any given time. IP addresses are not like phone numbers, there is no 'directory' of internet users and we can not 'call' an IP address or send a message to an IP address. Quite simply, there is no magic way to know that (say) IP address '86.132.10.22' is currently being used by 'joe.smith@btbroadband.com'.

Existing Internet technology only allows us to know that (say) IP address '86.132.10.22' belongs to 'British Telecom' and is located somewhere in Southern Britain.

Waterfalling
	A list owner is "waterfalling" when they run the same illicitly obtained address list through a series of ESPs, each time cleaning bounces, complainants and maybe non-respondants, and then hoping to move up to a cleaner ESP with better deliverability. The result still includes spammed addresses but fewer spam complaints to the ESP.

URIBL_SBL
	The SBL can also be used as a URI Blocklist and is particularly effective in this role. In tests, over 60% of spam was found to contain URIs (links to web sites) whose webserver IPs were listed on the SBL. SpamAssassin, for example, includes a feature called URIBL_SBL for this purpose.

Can the SBL block legitimate email?

The SBL's primary objective is to avoid 'false positives' while blocking as much spam as possible. Indeed because SBL false positives are extremely rare, there is little visible controversy regarding the SBL yet we are one of the Internet's biggest spam blocking systems.

It is important to note that, unlike most commercial ISP-level spam filter solutions, in its most used form, the SBL does not "absorb and trash" incoming email - instead it has a vital delivery fail-safe mechanism: By design, no matter how rare they may be, any false positive rejected by mail servers using the SBL follows correct RFC defined SMTP mail delivery proceedure and is returned ("bounced") to the immediate Sender with the explaination of why the message could not be not delivered and what the Sender should do about it. One of our main objectives is to help keep valid, non-spam email from being lost, or mixed in with hundreds of spam messages where they can be overlooked or automatically trashed as many systems will do.

However, like any system used to filter email, the SBL has the potential to block items of legitimate email if for example they are sent from an IP under the control of a spammer or via IPs belonging to a Spam Service. The chances of any legitimate email coming from such IPs are very slim, but need to be acknowledged.

In order to terminate some persistent spam operations the SBL team occasionally needs to escalate a listing and it is in the application of an escalation that 'collateral damage' can occur. Once a known spam operation is blocked, the SBL team then attempts to open dialogue with the ISP providing service to the spammer and assists the ISP with collating evidence to terminate the spammer. In rare instances the ISP turns out to be knowingly assisting the spam operation for profit. In these cases the SBL Team may deem the ISP itself to be the 'Spam Support Service' and may escalate by listing the ISPs corporate resources (such as corporate mail servers), determined on a case-by-case basis to focus action on the ISPs executives and always with the primary objective of avoiding blocking legitimate customers.

If the recipient is given the choice to opt-out, is it still spam?

Spam is Unsolicited Bulk Email. If you send any bulk email to a recipient who did not request it from you or did not give their prior and informed consent to be subscribed to your list, you are spamming that recipient. Whether you offer an opt-out option in the message or not does not change the fact that the recipient has been sent Unsolicited Bulk Email, spam.

Nobody must ever be required to opt-out of anything they did not opt-in to in the first place. Given all the nasty and infectious material circulated by spammers, the endless tricks spammers employ to get users to click links to websites which on arrival infect their computers with Trojans, it can never be recommended that anyone click on any links in any unknown e-mail.

How does one get listed in ROKSO?

ROKSO is a "3 strikes" register. We do not list first-time, inadvertent spammers or inexperienced marketing departments spamming 'by mistake'. To get to 3 strikes (3 terminations for spam offences such as emailing spam, hosting spammers, selling spamware) requires a very determined spam outfit.

Being thrown off an ISP takes a lot of doing, very few customers are thrown off an ISP without having been given warnings or chances to stop violating the ISPs Terms of Service. Being thrown off ISPs *twice* for spam offences means the spammer is determined, knows the consequences, and has actually signed up to a new ISP with the specific intention of breaking the ISPs Terms of Service. Being thrown off *three* ISPs for spam offences means the spammer is a committed hard-line spam operation that regards ISPs as simply throwaway resources.

A termination (strike) is assigned to a spam operation when any account for Internet services used by the spam operation or any entity acting on behalf of or in concert with it is terminated for abuse by the host or upstream provider.