Re: More sorbs blacklisting

[Craig Sanders <cas@taz.net.au>]

On Mon, Jul 10, 2006 at 10:59:15AM +0000, Andy Smith wrote:
> I have been told directly by SORBS staff that a given listing will
> not be removed despite RDNS and WHOIS records being updated and the
> contact in question certifying it is not dynamic and servers are
> allowed.  The reason given was that the TTL was set too low.  This
> has also been given as a reason for not removing listings of other
> IP ranges.

i would guess that's because the SORBS people, having a lot of contact
with spammers and related vermin, tend to be suspicious of what people
SAY and look for confirmation and contradictions in what they actually
DO.

it's easy enough for a spammer (or a spamhaus ISP) to say "these IPs are
not dynamic" and assign them a reasonable looking PTR record, but set a
low TTL for the PTR records so that they can be reassigned quickly. i.e.
they could be lying, and a low TTL indicates that possibility.

spammers always lie.  telling the difference between a lying spammer and
anyone else is difficult.

craig

-- 
craig sanders <cas@taz.net.au>           (part time cyborg)