Tillbaka till svenska Fidonet
English   Information   Debug  
OS2BBS   0/787
OS2DOSBBS   0/580
OS2HW   0/42
OS2INET   0/37
OS2LAN   0/134
OS2PROG   0/36
OS2REXX   0/113
OS2USER-L   207
OS2   0/4779
OSDEBATE   0/18996
PASCAL   0/490
PERL   0/457
PHP   0/45
POINTS   0/405
POLITICS   0/29554
POL_INC   0/14731
PSION   103
R20_ADMIN   1117
R20_AMATORRADIO   0/2
R20_BEST_OF_FIDONET   13
R20_CHAT   0/893
R20_DEPP   0/3
R20_DEV   399
R20_ECHO2   1379
R20_ECHOPRES   0/35
R20_ESTAT   0/719
R20_FIDONETPROG...
...RAM.MYPOINT
  0/2
R20_FIDONETPROGRAM   0/22
R20_FIDONET   0/248
R20_FILEFIND   0/24
R20_FILEFOUND   0/22
R20_HIFI   0/3
R20_INFO2   2632
R20_INTERNET   0/12940
R20_INTRESSE   0/60
R20_INTR_KOM   0/99
R20_KANDIDAT.CHAT   42
R20_KANDIDAT   28
R20_KOM_DEV   112
R20_KONTROLL   0/13030
R20_KORSET   0/18
R20_LOKALTRAFIK   0/24
R20_MODERATOR   0/1852
R20_NC   76
R20_NET200   245
R20_NETWORK.OTH...
...ERNETS
  0/13
R20_OPERATIVSYS...
...TEM.LINUX
  0/44
R20_PROGRAMVAROR   0/1
R20_REC2NEC   534
R20_SFOSM   0/340
R20_SF   0/108
R20_SPRAK.ENGLISH   0/1
R20_SQUISH   107
R20_TEST   2
R20_WORST_OF_FIDONET   12
RAR   0/9
RA_MULTI   106
RA_UTIL   0/162
REGCON.EUR   0/2055
REGCON   0/13
SCIENCE   0/1206
SF   0/239
SHAREWARE_SUPPORT   0/5146
SHAREWRE   0/14
SIMPSONS   0/169
STATS_OLD1   0/2539.065
STATS_OLD2   0/2530
STATS_OLD3   0/2395.095
STATS_OLD4   0/1692.25
SURVIVOR   0/495
SYSOPS_CORNER   0/3
SYSOP   0/84
TAGLINES   0/112
TEAMOS2   0/4530
TECH   0/2617
TEST.444   0/105
TRAPDOOR   0/19
TREK   0/755
TUB   0/290
UFO   0/40
UNIX   0/1316
USA_EURLINK   0/102
USR_MODEMS   0/1
VATICAN   0/2740
VIETNAM_VETS   0/14
VIRUS   0/378
VIRUS_INFO   0/201
VISUAL_BASIC   0/473
WHITEHOUSE   0/5187
WIN2000   0/101
WIN32   0/30
WIN95   0/4275
WIN95_OLD1   0/70272
WINDOWS   0/1517
WWB_SYSOP   0/419
WWB_TECH   0/810
ZCC-PUBLIC   0/1
ZEC   4

 
4DOS   0/134
ABORTION   0/7
ALASKA_CHAT   0/506
ALLFIX_FILE   0/1313
ALLFIX_FILE_OLD1   0/7997
ALT_DOS   0/152
AMATEUR_RADIO   0/1039
AMIGASALE   0/14
AMIGA   0/331
AMIGA_INT   0/1
AMIGA_PROG   0/20
AMIGA_SYSOP   0/26
ANIME   0/15
ARGUS   0/924
ASCII_ART   0/340
ASIAN_LINK   0/651
ASTRONOMY   0/417
AUDIO   0/92
AUTOMOBILE_RACING   0/105
BABYLON5   0/17862
BAG   135
BATPOWER   0/361
BBBS.ENGLISH   0/382
BBSLAW   0/109
BBS_ADS   0/5290
BBS_INTERNET   0/507
BIBLE   0/3563
BINKD   0/1119
BINKLEY   0/215
BLUEWAVE   0/2173
CABLE_MODEMS   0/25
CBM   0/46
CDRECORD   0/66
CDROM   0/20
CLASSIC_COMPUTER   0/378
COMICS   0/15
CONSPRCY   0/899
COOKING   27601
COOKING_OLD1   0/24719
COOKING_OLD2   0/40862
COOKING_OLD3   0/37489
COOKING_OLD4   0/35496
COOKING_OLD5   9370
C_ECHO   0/189
C_PLUSPLUS   0/31
DIRTY_DOZEN   0/201
DOORGAMES   0/1974
DOS_INTERNET   0/196
duplikat   5999
ECHOLIST   0/18295
EC_SUPPORT   0/318
ELECTRONICS   0/359
ELEKTRONIK.GER   1534
ENET.LINGUISTIC   0/13
ENET.POLITICS   0/4
ENET.SOFT   0/11701
ENET.SYSOP   33773
ENET.TALKS   0/32
ENGLISH_TUTOR   0/2000
EVOLUTION   0/1335
FDECHO   0/217
FDN_ANNOUNCE   0/7068
FIDONEWS   23439
FIDONEWS_OLD1   0/49742
FIDONEWS_OLD2   0/35949
FIDONEWS_OLD3   0/30874
FIDONEWS_OLD4   0/37224
FIDO_SYSOP   12841
FIDO_UTIL   0/180
FILEFIND   0/209
FILEGATE   0/212
FILM   0/18
FNEWS_PUBLISH   4155
FN_SYSOP   41520
FN_SYSOP_OLD1   71952
FTP_FIDO   0/2
FTSC_PUBLIC   0/13558
FUNNY   0/4886
GENEALOGY.EUR   0/71
GET_INFO   105
GOLDED   0/408
HAM   0/16041
HOLYSMOKE   0/6791
HOT_SITES   0/1
HTMLEDIT   0/71
HUB203   466
HUB_100   264
HUB_400   39
HUMOR   0/29
IC   0/2851
INTERNET   0/424
INTERUSER   0/3
IP_CONNECT   719
JAMNNTPD   0/233
JAMTLAND   0/47
KATTY_KORNER   0/41
LAN   0/16
LINUX-USER   0/19
LINUXHELP   0/1155
LINUX   0/22002
LINUX_BBS   0/957
mail   18.68
mail_fore_ok   249
MENSA   0/341
MODERATOR   0/102
MONTE   0/992
MOSCOW_OKLAHOMA   0/1245
MUFFIN   0/783
MUSIC   0/321
N203_STAT   894
N203_SYSCHAT   313
NET203   321
NET204   69
NET_DEV   0/10
NORD.ADMIN   0/101
NORD.CHAT   0/2572
NORD.FIDONET   189
NORD.HARDWARE   0/28
NORD.KULTUR   0/114
NORD.PROG   0/32
NORD.SOFTWARE   0/88
NORD.TEKNIK   0/58
NORD   0/453
OCCULT_CHAT   0/93
Möte OSDEBATE, 18996 texter
 lista första sista föregående nästa
Text 623, 196 rader
Skriven 2004-09-17 09:43:14 av Rich (1:379/45)
    Kommentar till text 619 av Geo. (1:379/45)
Ärende: Re: Spammers faster than the good guys....
==================================================
From: "Rich" <@>

This is a multi-part message in MIME format.

------=_NextPart_000_0155_01C49C9A.C18C23A0
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

   The reverse DNS check to which I referred is not that the domain of =
the sending machine matches the domain of the sender.  That is known not = to
work and is why Sender-ID has a richer mechanism.  What was described = to me
is that the forward and reverse of the MX record match and that = the match the
net block owner or at least I have had email bounce from = someone that claimed
these checks.  Maybe it is someone that doesn't get = high volume.

Rich

  "Geo." <georger@nls.net> wrote in message news:414ab6ef@w3.nls.net...
  No they don't, at least most don't.

  For example netlink does a MX check but not a PTR check because there =
are tons
  of domains that send mail thru a shared server (any ISP who hosts =
multiple
  domains) and that server has only a single PTR record. As such that =
PTR can
  match the forward lookup for the server but it can't match every =
domain the
  server handles. If you just check the PTR and then do a forward lookup =
to see
  if it matches then you gain nothing since pretty much every =
compromised home
  machine has matching DNS entries like that so it's worthless. As a =
result the
  only thing we bother checking is that an MX exists in order to sort of =
validate
  the FROM address domain isn't total bs.

  Don't misunderstand, some people do check the FROM domain against the =
PTR, but
  those servers don't handle any volumes or they would quickly be out of
  business.

  Geo.

  "Rich" <@> wrote in message news:414a62ee$1@w3.nls.net...
     And the folks that check MX also often perform reverse DNS on the =
sending IP
  to make sure the domain matches.

  Rich

    "Geo." <georger@nls.net> wrote in message =
news:414a202f@w3.nls.net...
    "Rich" <@> wrote in message news:4147b794$1@w3.nls.net...
    >>   First, I'm still looking for you to provide real world examples =
that
    anyone does this along with a description of how it benefits them.<<

    Nobody does it yet because SPF isn't making the spammers lives any =
tougher
  yet.
    As far as the technique, all you do is point the MX record for the =
domain you
    are spamming from and that's the IP address the bounces are going to =
go to.

    >>   As for your claim of no MX or MX pointing to a non-existent IP, =
you
  better
    explain why that doesn't address the issue you claim that spammers =
have.  I
    thinnk you are off in never never land.  No MX record should be =
faster than a
    valid MX as the NDR is abandoned.<<

    That may be true, but no MX record is also a good way to get your =
mail
  rejected
    since lots of servers verify the sending domain has an MX record as =
part of
    their spam filtering.

    Geo.



------=_NextPart_000_0155_01C49C9A.C18C23A0
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.3790.186" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>&nbsp;&nbsp; The reverse DNS check to =
which I=20
referred is not that the domain of the sending machine matches the = domain of
the=20
sender.&nbsp; That is known not to work and is why Sender-ID has a = richer=20
mechanism.&nbsp; What was described to me is that the forward and = reverse of
the=20
MX record match and that the match the net block owner or at least I = have
had=20
email bounce from someone that claimed these checks.&nbsp; Maybe it is =
someone=20
that doesn't get high volume.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
  <DIV>"Geo." &lt;<A =
href=3D"mailto:georger@nls.net">georger@nls.net</A>&gt; wrote=20
  in message <A=20
  =
href=3D"news:414ab6ef@w3.nls.net">news:414ab6ef@w3.nls.net</A>...</DIV>No=
 they=20
  don't, at least most don't.<BR><BR>For example netlink does a MX check =
but not=20
  a PTR check because there are tons<BR>of domains that send mail thru a =
shared=20
  server (any ISP who hosts multiple<BR>domains) and that server has =
only a=20
  single PTR record. As such that PTR can<BR>match the forward lookup =
for the=20
  server but it can't match every domain the<BR>server handles. If you =
just=20
  check the PTR and then do a forward lookup to see<BR>if it matches =
then you=20
  gain nothing since pretty much every compromised home<BR>machine has =
matching=20
  DNS entries like that so it's worthless. As a result the<BR>only thing =
we=20
  bother checking is that an MX exists in order to sort of =
validate<BR>the FROM=20
  address domain isn't total bs.<BR><BR>Don't misunderstand, some people =
do=20
  check the FROM domain against the PTR, but<BR>those servers don't =
handle any=20
  volumes or they would quickly be out =
of<BR>business.<BR><BR>Geo.<BR><BR>"Rich"=20
  &lt;@&gt; wrote in message <A=20
  =
href=3D"news:414a62ee$1@w3.nls.net">news:414a62ee$1@w3.nls.net</A>...<BR>=
&nbsp;&nbsp;=20
  And the folks that check MX also often perform reverse DNS on the =
sending=20
  IP<BR>to make sure the domain matches.<BR><BR>Rich<BR><BR>&nbsp; =
"Geo." &lt;<A=20
  href=3D"mailto:georger@nls.net">georger@nls.net</A>&gt; wrote in =
message <A=20
  =
href=3D"news:414a202f@w3.nls.net">news:414a202f@w3.nls.net</A>...<BR>&nbs=
p;=20
  "Rich" &lt;@&gt; wrote in message <A=20
  =
href=3D"news:4147b794$1@w3.nls.net">news:4147b794$1@w3.nls.net</A>...<BR>=
&nbsp;=20
  &gt;&gt;&nbsp;&nbsp; First, I'm still looking for you to provide real =
world=20
  examples that<BR>&nbsp; anyone does this along with a description of =
how it=20
  benefits them.&lt;&lt;<BR><BR>&nbsp; Nobody does it yet because SPF =
isn't=20
  making the spammers lives any tougher<BR>yet.<BR>&nbsp; As far as the=20
  technique, all you do is point the MX record for the domain =
you<BR>&nbsp; are=20
  spamming from and that's the IP address the bounces are going to go=20
  to.<BR><BR>&nbsp; &gt;&gt;&nbsp;&nbsp; As for your claim of no MX or =
MX=20
  pointing to a non-existent IP, you<BR>better<BR>&nbsp; explain why =
that=20
  doesn't address the issue you claim that spammers have.&nbsp; =
I<BR>&nbsp;=20
  thinnk you are off in never never land.&nbsp; No MX record should be =
faster=20
  than a<BR>&nbsp; valid MX as the NDR is =
abandoned.&lt;&lt;<BR><BR>&nbsp; That=20
  may be true, but no MX record is also a good way to get your=20
  mail<BR>rejected<BR>&nbsp; since lots of servers verify the sending =
domain has=20
  an MX record as part of<BR>&nbsp; their spam filtering.<BR><BR>&nbsp;=20
  Geo.<BR><BR><BR></BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_0155_01C49C9A.C18C23A0--

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)