Spamhaus has announced their new domain block list (DBL). The DBL is a list of domains that have been found in spam.

The DBL is managed as a “zero false-positive” list, safe to use by production mail systems to reject emails that are flagged by it. The DBL includes URIs (domains/hostnames) which are used in spam including phishing, fraud/”419″ or domains sending or hosting malware/viruses.

[...]DBL has a monitored automated self-service removal system.

There are more changes over at AOL. Annalivia has announced she is leaving AOL.  Anna has done an immense amount of work with senders over the years and her departure is definitely going to leave a hole. Drop by her website and wish her luck.

What this means to you: escalation paths and such are still being worked out, but the India Postmaster team and I have spent a lot of time working together in the last couple months; they’ll take care of you. The AOL postmaster website and reputation tool should also be useful. I’ll provide any further information as I get it.

Via Al Iverson, there’s a new informational source at anonwhois.org. This provides a list of domains registered behind privacy protection services.

Recently at MAAWG I had the opportunity to listen to a talk by Joseph Menn author of Fatal System Error: The Hunt for the New Crime Lords Who are Bringing Down the Internet. He was a very engaging and entertaining speaker who really seemed to understand the interplay between organized crime and spammers.

[I]f convicted, the conspiracy charge carries a maximum statutory sentence of 30 years in prison and a $1 million fine. Each of the obstruction charges carries a maximum statutory sentence of 20 years in prison and a $250,00 fine. If a defendant is convicted on a felony and also on false registration of a domain name, the penalty for that felony conviction is doubled, or increased by seven years, whichever is less. Restitution could be ordered.

False registration of a domain name will add up to 7 years onto any sentence. This is probably one reason so many spammers are now hiding behind domains by proxy. That won’t add to their jail time if they end up convicted of a felony.

This description from the FBI press release sounds very familiar:

The conspirators created, purchased and used  shell companies to hide the true identity of the owners or operators of the companies, or the relationships between the companies. They also established P.O. Boxes, commercial remailer services, shell offices, apartments, or other physical locations to hide owners’ or operators’ identity or the relationships between the companies. They assumed multiple fake identities to hide true ownership of the shell companies and made materially false representations to their victims, by mail, fax, telephone, e-mail, or other communications, to obtain goods and services from them.

I know a number of spammers who have a series of shell companies in order to hide the relationships between their various websites. They have one shell that’s used for their advertisers. They have another shell that’s used for their affiliates and they have lots of shell companies and domains that are used in their emails.

Look, a company sending any commercial email is required by law to provide a physical postal address in every email they send. What point is there, then, to hiding addresses in whois records? The only thing it does is make a sender look like a spammer. If a sender is a business, then they need to have a real business address anyway, and that address should be available in their domain registration.

It may seem like a trivial point, it may seem minor, but spammers use domain privacy services to hide the various tendrils of their businesses. They don’t want anyone to be able to tell that domain A is related to domain B is related to domain C. Proxy services let them trivially hide their identities. This is the major business use of privacy protection. Real companies don’t need to hide behind privacy services.

Using domain privacy services make senders look like spammers. One trivial thing that ISPs can do is stop providing FBLs or whitelistings to domains behind privacy services. This will weed out spammers without doing harm to real senders. Certification services can refuse to certify companies that hide their identity. My small contribution to the cause is to refuse to represent any company to an ISP if their domain is behind a privacy service.

Just to be clear, I have no problem with personal, non-business domains using privacy services. There are valid reasons individuals may want to hide their physical location. But businesses? Step up and quit hiding.

On the subject of privacy services, Mickey recently reviewed a court ruling that commented on the legality of using privacy services. The court says:

private registration for the purpose of concealing the actual registrant’s identity would constitute “material falsification.”

Is this really something a legitimate business would do?