3 ms·
Some hosting providers have a very negative IP reputation. They seem to be unable to stop their users from sending out spam. They don't seem to react to abuse r
by rlpb 4y ago
Some hosting providers have a very negative IP reputation. They seem to be unable to stop their users from sending out spam. They don't seem to react to abuse reports, let alone take action to stop abuse from their ASN generally. So I block their entire netblocks, IP-wise. I'm not aware of any legitimate emails being caught up in this. If somebody is unfortunately caught up, my response is that they should use a more reputable provider.
According to your previous post, I shouldn't do that for DKIM/SPF -valid emails by IP, but I do. I hope this explains I do, and why purely domain-based reputation doesn't work.
- mrb 4y agoBig spammers own multiple ranges of IPs just as easily as they own multiple domains. When you block only 1 of their range, they can re-use their same domains to spam you from other ranges. If you blocked by domain, this would be effective across all their ranges of IPs. So, in your example, blocking by IP isn't necessarily superior to blocking by domain (and vice versa.) Once again: it's possible to have the tools and infrastructure manage domain reputation and do a job as good as (and arguably better than) IP reputation. Also to consider: IPs can be acquired by spammers for nearly $0 (eg: destroy+recreate VPS to get a new IP for free), whereas domain names have a fixed cost of ~$10 USD per year per domain. So if you have a system that manages domain reputation and has 1 million domain in the blacklist, you know for a fact that you are burning ~$10M/year of spammers' money.
- Avamander 4y agoI'm fairly sure all what you're desribing is and has been done. It's just not a simple problem and spammers do all that you've described as well, plus more. Recent trend I'm seeing is creating malicious Google and Microsoft account or hacking websites and using those to spew spam.