71% of Spam Servers are Located in China

aspelling writes " We all know that majority of consumer electronics and other goods sold in US stores is produced in China. But China specialty extends beyond consumer electronics, clothes and automotive components. According to Commtouch Software research 71% of all spam servers are located in this People Republic. "Since Jan. 1, we've seen probably a 30% to 40% increase" in spam traffic" Commtouch CEO says. BusinessWeek reports about this issue."

Obligitory....

Isn't 71% of everything made in China? I've always thought all spam, both meat and annoyance flavors, were made in China...

Re:Obligitory....

Meat-flavored spam? I might actually like it...

How Ironic

it is that 71% of a form of communication originates from a country that tries its damndest to stifle the voice of its people.

Re:How Ironic

China is not trying to stifle the voices of their people as much as it is trying to prevent them from reading certain things. Supressing speech inside of China is simply an easy way to limit what people can read.

They don't really care that much about what the outside world can read about China, as long as that information doesn't get back into the country.

Obligitory Spam, the food product, link....

Spam, the food, is made right in our very own third world city of Austin, Minnesota at the Hormel plant. (also Nebraska, Denmark, Korea and The Phillipines.) See the Spam museum [hormel.com].

(Funny on slashdot how I have to qualify Spam as a food product...)

Re:Obligitory Spam, the food product, link....

(Funny on slashdot how I have to qualify Spam as a food product...)

That might be because the food product is properly called SPAM. (Follow your own links!)

Re:Taiwan

That brings up an interesting point about the difference (or lack thereof) between Taiwan and the mainland PRC.

Does the story differentiate between the two?

Re:Taiwan

Taiwanese servers use the tw code, cn is used by the Reds. It's not technically hard to disambiguate the two countries-- so the question then becomes-- did the authors of the study at some point take the "One China" myth seriously?

Re:Taiwan

How about reading the story?

They are talking about the Peoples Republic (of China), captial Beijing, "China is notorious for its Internet censorship efforts".

This doesn't sound like they are talking about Taiwan/Republic of China, (provisional) capital Taipei.

Avoid the Noid, he ruins web experiences

The direct link want your e-mail address (*shudder*)
Go to the press release [commtouch.com] (it is listed on the page) and click on the link for the white paper

But surprise, surprise, the "best solution" is the one they sell, but it's still an interesting read.

Re:Avoid the Noid, he ruins web experiences

Question: How does "71% percent of spam servers are located in China" quoted in the article correlate with the whitepaper stating "Figure 1: North America and International Spam Messages Sent Daily" depicting 2005: North America 8.5 billion, International 11 billion?

Maybe it is in the subtle difference of spam messages sent, and servers used to send them.

Use blacklists...

If you don't know anyone in China (or Asia) you can use a blacklist for the whole region. My firewall with OpenBSD's awesome spamd [openbsd.org] autoupdates its tarpit blacklists every couple of hours. One good list for Asian IPs is here. [okean.com]

I love the idea of tarpitting, seeing spammers connections being tied up for ~3300 seconds (my highest) warms my heart. If more people did it that'd mean less overall spam traffic.

Re:Use blacklists...

No. This is a common misunderstanding. The majority of spammers are from the US.

here are proves:

http://sophos.com/spaminfo/articles/dirtydozen.htm l

Re:Use blacklists...

Doesn't matter. The source machine is all I care about. If it's in China I don't care if the spammer is American, Chinese or Martian.

Re:Use blacklists...

Just for other people's info... since I didn't know:
Tarpitting discourages spamming without permanently blocking an offending IP address. Tarpitting works by monitoring traffic and applying sluggish responses to remote IPs showing spam-like behavior. For example, if an IP sends too many messages to users during an email session, tarpitting starts slowing MDaemon's response. If the spam-like behavior includes excessive unknown addresses during a session, the remote server can be suspended from access for a user-specified amount of time.

Re:Use blacklists...

There's just something that seems fundamentally wrong about connecting to a global network and then blacklisting half of it.

It's like buying Lucky Charms cereal, then filtering out all the marshmallows and throwing them in the garbage because they're not healthy. Very true, but if that's how you feel, why bother buying Lucky Charms?

Surely it would be more effective to implement challenge-response, or simply boycott email in favour of IM or a secure messageboard/contact form, or whatever you prefer. The problem is with email, not with Asia.

Besides, I think this study is bogus. All the studies I've previously seen pointed squarely at the USA as the primary source of spam. Empirical evidence from my own email box bears this out. Most of the spam I receive tends to come from residential cable modem/DSL lines in various countries, predominantly the states. I suspect that these are either virus-hijacked boxes, or people being paid to send spam through their home connection (ie, the ads placed on telephone polls: "Have an internet connection at home? Make up to $4,000/month with no effort required! Call now!")

Re:Use blacklists...

Spam is all Bush's fault. I didn't get this much spam when clinton was president. And when Carter was president I didn't get any spam at all!

Re:Use blacklists...

Except, it's more like buying a box of lucky charms expecting to find marshmallows and the regular oats (or whatever it is) cereal and finding a bunch of dirty needles in it as well. SPAM is not supposed to be a part of the web. It's an unwelcome, criminal blight on it and it's being perpetrated by people who are actively trying to ruin a good thing for everyone else. I find it perfectly acceptable that these people be relegated to their own corner and thrown off the web.

That's fine

You are allowed to ban whomever you like. There are servers I control that are accessable from as little as one subnet (and others that are on a physically private network). That's my right.

It also could work to help force people to get their shit straight. Many ISPs (domestic and foriegn) are just non-responsive to SPAM/hacking complaints. One proven tactic that works is the threat of mass bans. Between a proposed UPD and a ban by the members of Nanog, UUNET was convinced to become more responsive to complains of network abuse.

The Internet does not have a police force so the community polices itself. If a group won't play by the rules, they shouldn't be supprised to find themselves excluded from a large part of it.

Re:Use blacklists...

That's not going to help too much. According to the article, 71% of the URLs appearing in spam messages point to websites hosted in China however 60% of spam messages are sent from the US. In fact, China (although second) is only the location of the mail servers sending about 6% of the spam messages that they analyzed. The post was not too clear on that but the source article is.

The Great (fire)Wall of China

If China can keep much of the rest of the internet inaccessable to their citizens, why can't the rest of the world block the polution that China is transmitting?

Great

Yet another IT service being outsourced overseas........

Write your congressperson and demand that SPAM jobs be kept at home!

blacklist the netblocks?

I have no reason to ever get traffic from china when I'm talkin about my own personal servers.

First question is what netblocks can I block to effectivley ban all of china?

Re:blacklist the netblocks?

Check out this site [okean.com]

That's the thing...

Hardly surprising, since as soon as you spam a million people, an hour later you're hungry to spam a million more. ;)

Re:So why not blackhole the entire country?

I can't speak for the accuracy of the assertion that the web servers linked to in spam messages are located in China 71% of the time.

But I can say that of 3413 spam messages I received only 185 of them came from China.

Old Joke

Me Chinese, me play joke, me send ads for erectile disfunction drugs, marital aids, sites with farm animals, septic tank cleaning, unlimited monthly income potential, hot stock tips, offers to meet girls in your area, and tiny little remote control cars to your inbox.

remember what Russia used to say

It was along the lines of "the capitalist countries will sell us the rope the hang them with". Those driven to financial gain eschewing possible ethical concerns will at best impose a lot of friction and drag on the system. They may end up poisoning the internet sufficiently to end a lot of net freedom we take for granted. I am sure China is more than happy to take our money as we bury ourselves.

blackholes

there was a tip posted to NANOG this morning. you can use china.blackholes.us as a RBL (look at their page, they have other lists) to effectively block all mail from china's IPs

Re:Word to that...

>I [...] run my own mail server on my domain.
>Not everyone can run their own email servers. What about my mom or grandmother

Why don't you give them e-mail accounts on your domain and they'll get spam-free e-mail.

Why block China?

Several people have mentioned blocking all of China, but what good will this do? Okay, most of the spam originates from there, but this wouldn't be an interesting study if most of the spam were obviously from China. I would imagine that most spammers are using relays of some sort and have a pretty good idea what they are doing. The country-wide blacklist may not be a bad idea but I question its effectiveness.

Re:Why block China?

Reply to you and the 10 other people saying this -- it's not a question of moral blame, it's a question of a technical solution. If you have no reason to expect mail from a .cn domain, then blocking all .cn mail makes a huge dent in your spam problem. The fact that the spammer might be your next-door neighbor is irrelevant.

I face a *huge* spam problem, mostly from .ru, and dumping everything from that domain makes an enormous difference.

But most of my email...

lately seems to originate in Africa. Nigeria to be exact.

Grump

That's funny because...

... most of my email seems to be coming from these hot, single, girls that all want to meet ME! I blush everytime!

Where are the banks?

If you put a credit card number into a site, what bank gets the transaction? That's how to track spammers.

Another source

Strange, because USA is still #1 in all 3 categories listed (scroll down) on spamhaus.org [spamhaus.org]
Besides - who cares where the exploited servers are? Soon (my guess is - less than 6 months) the majority of spams will be sent via zombies taken over by some worm or virus. These computers will be spread all over the world. The only solution is to nip it in the butt. Make spam illegal (as it is in Europe) and sue the pants of the spammers. Enough of those stupid atempts [slashdot.org] to pretend something is being done. We all know that the spammers are from Gods own country - hijacking machines whereever it's easiest.
/me sets mode -rant

Bullshit

75% of spam is american. American lowlifes selling american products..

At least according to my own experience, and according to research conducted outside of america..

I don't believe for a minute that the spammers are actually chinese.. You can recognize the writing of a typical american "internet entrepeneur" in most spam mail..

And the servers? Sure, but most spam servers are innocent infected computers anyway...and if you look at the number of american computers in the world compared to the number of asian numbers..it would surprize me if the majority of servers aren't american..

I have never seen a single spam email with chinese letters..why?

Don't jump so quickly on the Chinese

Spam may be coming from Chinese _servers_, but I doubt 71% of the spammers are Chinese. Everyone in this thread seems to think that actual Chinese people are doing the spamming. I don't think this is the case.

Its a small business

"Since Jan. 1, we've seen probably a 30% to 40% increase" in spam traffic" Commtouch CEO say"

This accurately mirrors what I've noted, I run the mail sweeper for a medium-sized enterprise and analyse spam to improve the quality of our filtering.
I note a lot of the spam has similar formats (apart from the 419 scammers, but they're easy to filter out), leading me to suggest that spamming is dominated by a relatively small clique of big-time mailers

This does at least make it easier to write rules to stop it. We don't use Bayesian filtering, a human-monitored system can be more efficient if done right.

just say NO

I would be perfectly willing to not receive any e-mail from China, or even all of Asia for that matter. Unfortunately, not running my own mail server, I can't block their addresses direcly, but it would be nice if someone mapped out the IP addresses to block and came up with some good mail server rules. Clearly this would have to be done as an option on an acount-by-acount basis, so it has to be done in the mail server and not the firewall, but I expect enough people would opt-out of Chinese oriinated e-mail to make it worth while for any system that supported such an option and coul long-term have a significant impact on this source of spam.

Re:just say NO

www.blackholes.us has zone files to block, by country, all the major sources of spam (except the US, and there is has the major spamhaus ISPs).

Implementing it by mailbox would be up to your ISP. The tools they need are readily available.

ahhh...so clear now...

Well, that explains why so much of spam is for penis enlargement products... :-p

How nice of them to block-list my ISP then!

Our Chinese clients started complaining that they no longer had access to our US based FTP server and e-mail addresses just last week. Turns out, China blocked the DNS servers that our ISP uses! Great... yippee.

We are switching ISPs anyway, so I am not terribly concerned, I just think this is wildly hypocritical.

RTFA!

Doesn't anyone read the article?

It said that 71% of the URLs in spam go to web servers in China, not that 71% of spam comes from China!

The vast majority of spam that hits my mail server comes from the US (comcast, rr.com, etc) machines that have been compromised.

Tools like bigevil.cf (SpamAssassin plugin) help me to filter those spams with Chinese URLs.

What's really happening out there ...

... is that those servers are used by spammers as open relay, not that those spams are originated there.

There're just too many clueless email admins over there. They lack the skills of configuring a well behaved MTA (it's a pretty tough job these days indeed), and the language barrier is just making things worse. Most of the people are just configuring their mail servers according to howto-like articles written by some clueful guys, and those articles are mostly just laying out the steps, no how and why things should work that way. If you hop to any of the tech forums' email section, you'll find it's full of questions like:

"Help, I just configured my email server according to XXX but things didn't work out ..."

"Help, why my smtp auth doesn't w