Spam Prevention

***GatorJosh*** · #1 12-29-2009, 12:59 PM

We have been gathering email statistics from all of our shared/reseller servers for the past month. We are analyzing this data and coming up with new methods to help prevent spam on our servers. We have come up with a list of remote domains that are involved with spamming and are implementing a block of these domains. We are testing this on about 200 shared hosting servers. The list of blocked domains is rather small and only contains around a total of 80 domains. To make sure this list remains accurate, we are unable to disclose these domains. If an email is sent or recieved from a domain on this list, the sender of the email will receive a bounced email stating "Sorry you are sending to/from an address that has been blacklisted".

We will be testing this on the first 200 servers this week and then if there are no issues, the remainder of the shared servers the following week.

ceaser · #2 12-29-2009, 01:25 PM

Thanks for the update Josh. Good to know you guys are hard at work fighting a tough battle. Quick question though, is it possible to have this setup on VPS servers, or enable VPS users to have access to the script you use to blacklist the domains? Just wondering if we are protected too.

joanne · #3 12-29-2009, 01:30 PM

Great Job! Could we also add any subject line with Viagra in it to be sent back too??!!

***GatorCarl*** · #4 12-29-2009, 03:03 PM

We are planning on setting something up for vps and dedicated servers but do not have anything available currently. We are still testing things out to see what kind of difference it makes. As for Viagra, we are not able to filter out all emails with this subject because some people might actually have legitimate email with this in the subject. Cpanel does have filters that can be setup to automatically remove these emails so they do not get delivered to your account.

MikeC · #5 12-29-2009, 06:02 PM

HG,

When these spam emails are being bounced, it is at SMTP time, correct? If it's after receipt and the bounce is returned to the apparent sender, then HG will likely be spamming folks who have had their sending addresses spoofed (it's commonly called back scatter) and not the real offenders.

Mike

***GatorCarl*** · #6 12-29-2009, 06:21 PM

The way we have it setup, it is just preventing the server from sending to certain domains. It does not prevent emails from coming in but if the email is being sent out from the server, it will be stopped. This should reduce the back scatter since we are blocking some common domains that are being spoofed from and the bounces are not being sent out to these invalid domains.

MikeC · #7 12-29-2009, 06:33 PM

OK, so it's outbound spam & back scatter that's being blocked, not inbound. I didn't catch that nuance in the previous description. Cool, I hope it works out.

Mike

***GatorJosh*** · #8 12-30-2009, 08:19 AM

Quote:

Originally Posted by MikeC

OK, so it's outbound spam & back scatter that's being blocked, not inbound. I didn't catch that nuance in the previous description. Cool, I hope it works out.

Mike

Sorry for not making that clear. At this time during the initial tests its only for outbound mail that we are filtering. It is very likely that this will be changed to inbound/outbound if there are no issues found.

probo · #9 01-01-2010, 02:18 AM

blacklist email from Viagra word or something

striddy · #10 01-01-2010, 03:24 AM

Quote:

Originally Posted by bulawebs

blacklist email from Viagra word or something

Did you read post # 4 ?

jackman-UK · #11 01-04-2010, 06:42 AM

Quote:

I was unable to send this e-mail because the domain ( ****.co.uk ) has been black listed due to spam or forgery.

Is that the error message?

***GatorCarl*** · #12 01-04-2010, 01:16 PM

Quote:

Is that the error message?

No, the error message is "Sorry you are sending to/from an address that has been blacklisted" worded exactly like that. If you have a ticket or want to pm the details of where you are getting this, I can take a closer look.

probo · #13 01-04-2010, 01:16 PM

Quote:

Originally Posted by striddy

Did you read post # 4 ?

Sorry missed that one...Gald to know cpanel has that feature

Keith W · #14 01-14-2010, 05:46 PM

I don't know if this is related to this spam thing your working on but I find it strange that since this I have gone form having no spam to loads every day now

Str82u · #15 01-16-2010, 12:33 AM

Good to know, I'll be watching but I bounce anything that says, you know those products, and don't even notice that stuff, appreciate the heads up, I bet the mail I'm bouncing is gonna bounce back.

KRUZNBY · #16 02-13-2010, 07:28 AM

Something has changed in the last week. All of my spam used to be diverted to my spam folder, but now none of it is.

moaa · #17 03-15-2010, 11:40 AM

Hi there,
I am receiving large number of Chinese goods spam every day. Any progress on fighting this from Hostgator side?

***GatorDaveC*** · #18 03-16-2010, 05:05 PM

Quote:

Originally Posted by moaa

Hi there,
I am receiving large number of Chinese goods spam every day. Any progress on fighting this from Hostgator side?

We have a subscription to Spamcop's rsync server, CBL and a couple of other RBL lists.

On top of having purchased RBL subscriptions, we have our own in-house RBL list that we created recently. Our RBL list was created by doing a couple of different methods, but our most common method is to use mail logs to see IPs sending mass amounts of e-mails to our clients. We then manually audit the list, and throw the highest spamming IP's on the RBL list.

***GatorDaveC*** · #19 03-18-2010, 04:32 PM

I'm wondering if any of you have noticed less e-mail spam in the past 24 hours or so? Using some new techniques we've dropped over 500,000 spam e-mails in under 24 hours across our server farm.

Please give us some feed back on the amount of spam you are receiving.

Keith W · #20 03-18-2010, 05:27 PM

As I said on 01-14-2010:

Quote:

Originally Posted by Keith W

I don't know if this is related to this spam thing your working on but I find it strange that since this I have gone form having no spam to loads every day now

***GatorDaveC*** · #21 03-19-2010, 01:39 AM

Quote:

Originally Posted by Keith W

As I said on 01-14-2010:

We haven't removed anything in place, so I don't think its related at all. Could you PM me the e-mail address getting a lot of spam so we can look into it?

Pitrow · #22 03-19-2010, 05:39 PM

me and some of my clients are getting notices that facebook thinks our HG hosted email addresses are invalid now. Any chance they're getting caught up in the new spam filters? I have facebook whitelisted in spam assassin, but still getting the notification.

I submitted a ticket earlier today (going on 4 hours now), but haven't heard anything yet.
IAK-13206985

***GatorDaveC*** · #23 03-19-2010, 06:03 PM

Quote:

Originally Posted by Pitrow

me and some of my clients are getting notices that facebook thinks our HG hosted email addresses are invalid now. Any chance they're getting caught up in the new spam filters? I have facebook whitelisted in spam assassin, but still getting the notification.

I submitted a ticket earlier today (going on 4 hours now), but haven't heard anything yet.
IAK-13206985

I looked through the logs on the e-mail listed in the screen shot. It looks like your Mailbox quota is exceeded.

Pitrow · #24 03-19-2010, 06:32 PM

not according to my cpanel it's not.

it shows I'm using 1.2 MB of 19MB quota

????

***GatorDaveC*** · #25 03-19-2010, 06:59 PM

Quote:

Originally Posted by Pitrow

not according to my cpanel it's not.

it shows I'm using 1.2 MB of 19MB quota

????

I updated your ticket. It looks like Spamcop blocked them.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
max_user_connections errors :: Prevention Tips	GatorShashank	Shared Hosting Support	105	12-24-2011 11:00 PM
Procedure of Spam Suspension / Define SPAM	davidb2002	Webhosting	15	05-04-2006 03:35 AM