Jump to content
Sign in to follow this  
sneader

Facebook on SpamCop RBL

Recommended Posts

I've noticed that many of Facebook's mail servers have been listed in the SpamCop RBLs for the last few months. I've whitelisted their netblock, 69.63.176.0/20, after becoming aware of the problem, as it's unacceptable to our users to have mail from Facebook blocked.

I was surprised to see that there were no other posts in the forums discussing this issue. With the popularity of Facebook, it would seem to be a true problem that many would want to discuss and solve.

Here is what I'm seeing, as an example (see below).

Any thoughts on this issue would be appreciated.

69.63.178.163 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in a short time.

Causes of listing

* System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)

* SpamCop users have reported system as a source of spam less than 10 times in the past week

Additional potential problems

(these factors do not directly result in spamcop listing)

* IP is listed in SpamCop exclusion list

Because of the above problems, express-delisting is not available

Listing History

In the past 80.2 days, it has been listed 22 times for a total of 25.7 days

Other hosts in this "neighborhood" with spam reports

69.63.178.160 69.63.178.161 69.63.178.162 69.63.178.164 69.63.178.165 69.63.178.166 69.63.178.168 69.63.178.169 69.63.178.170 69.63.178.171 69.63.178.172 69.63.178.173 69.63.178.175 69.63.178.176 69.63.178.177 69.63.178.178 69.63.178.179 69.63.178.180 69.63.178.181 69.63.178.182 69.63.178.183 69.63.178.184 69.63.178.185 69.63.178.186 69.63.178.187 69.63.178.188 69.63.178.189 69.63.178.190 69.63.178.191 69.63.178.194 69.63.178.196 69.63.178.197 69.63.178.198 69.63.178.199

Share this post


Link to post
Share on other sites
<snip>

Any thoughts on this issue would be appreciated.

<snip>

...Could you be provide some hints as to what type of "thoughts" you'd likely find of value? I ask because I fear any reply I might offer would offend you because it's a list of things you already know. Are you looking essentially for an explanation as to what the report you quote is saying or are you looking for something deeper?

...For what it's worth, I share your surprise that no one else has complained about this. :o:blink:

...Thanks!

Share this post


Link to post
Share on other sites

It seems that SCBL listing may be due to spamtrap hits (more than to member reports). The SCBL is 'hair trigger' in that respect which is why it is not recommended for outright blocking. The number of times individual IP addresses are getting listed indicates a real problem at Facebook and hopefully any SC member reports they are getting will help them discover the (few) FB users at fault and adjust their behavior. That is how it is supposed to work and that might be a good thing - there is evidence of the addresses falling on to other RBLs and that tends to be a progressive process (most do not have the short-cycle auto de-listing that SC has). Example:

http://www.robtex.com/ip/69.63.178.164.html#blacklists currently shows SpamCannibal and Project Honeypot as well as SC

I'm not sure what "* IP is listed in SpamCop exclusion list" means in relation to express delisting but from the range of FB addresses being (occasionally) listed I doubt FB would be looking for express delisting anyway - the abuse of their service is continuing.

[Edit - addition] Huge volume is a factor here - individual servers in tfbnw.net are putting out about as much volume as some entire networks. It would be miraculous if they weren't scoring the occasional appearance in the SCBL. http://www.senderbase.org/senderbase_queri...tring=tfbnw.net indicates total network volume approaching 1% of global total. All-in-all it looks like a good illustration of 'when and why not' to use the SCBL to 'block and drop' on those 'outmail' servers. As said, it is not recommended for such service - How do I configure my mailserver to reject mail based on the blocklist? and What is the SpamCop Blocking List (SCBL)?

Share this post


Link to post
Share on other sites

FaceBook servers are sending ordinary spam, so they should be on our list like any other spam source.

Reports are being send to spamcop[at]facebook.com. We've sent them over 30,000 reports.

I can't help but think they should be aware of the problem.

- Don D'Minion - SpamCop Admin -

.

Share this post


Link to post
Share on other sites
We've sent them over 30,000 reports.

I can't help but think they should be aware of the problem.

Yes, you'd have thought so... Guess its the Facebook business model.

Recruit millions of users and allow them to receive spam through their system unless said millions decide to turn off alerts about messages. That spam is forwarded as regular Email and bingo tens of thousands of spam reports.

I cannot imagine that they'll do anything unless or until customers make serious floods of complaints.

Andrew

Share this post


Link to post
Share on other sites
I'm not sure what "* IP is listed in SpamCop exclusion list" means in relation to express delisting
There is no relation at all.

- Don D'Minion - SpamCop Admin -

.

Share this post


Link to post
Share on other sites
There is no relation at all.
Thanks Don. The following "Because of the above problems, express-delisting is not available" 74010[/snapback] threw me.

Share this post


Link to post
Share on other sites
Thanks Don. The following "Because of the above problems, express-delisting is not available" 74010[/snapback] threw me.
Yeah... I gotta get that changed.

- Don -

Share this post


Link to post
Share on other sites
FaceBook servers are sending ordinary spam, so they should be on our list like any other spam source.

Reports are being send to spamcop[at]facebook.com. We've sent them over 30,000 reports.

Don, did FB finally get a clue? I haven't seen any sourced from there for awhile, and I see that the FB reporting addy is now spamreport[at]

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×