Vetting customers

MAAWG has published a BCP for vetting new customers. This is the culmination of much work by a lot of people.
One of the best things about the document is the discussion of how spammers attempt to hide their identity. All too often I’ve been called in by ESPs to help them identify how a spammer got on their network and where their process failed. As filtering gets better at blocking spam, spammers are spending more and more time trying to steal good reputations to get their unwanted mail through.
Providers who follow these rules may still find themselves with spammers as customers, but the spammers will have to work harder to get on clean networks.

Related Posts

Gathering data from PACER

I had someone ask on Facebook about getting some documents off of Pacer. I thought the information may be of use to other people out there.
PACER (public access to court electronic records) provides access to public documents filed in the Federal court system. Each court has their own website, but there is one login and the search and document display are the same. Documents cost 8 cents a page, capped at $2.40 for a single document.
Access to PACER isn’t always immediate. When I signed up there was a 7 – 10 day delay as usernames and passwords were sent by mail. There does seem to be a way now to get a password faster, for those of you who want data NOW!
Once you’ve got a username and password now you’re in business and can start digging up all these documents.
The first step is determining which court website to check. Generally, I’m looking for details because I saw a news report that does mention what court the case was filed in. So I just plug the court name (Northern District of California) in a search window and go from there. PACER also provides the facility to look up where a case is on their website. This wasn’t an option when I signed up for PACER so I’ve never used it, but it is there.
The court websites are often not very flashy (Web 0.5!) but there will be a link to retrieve documents or view documents through PACER. This is the link that will take you to the login page.  Put in your username and password and click go. If you’re not filing, you don’t need to bother with the checkbox for the Notice of Redaction Responsibility to get in, nor do you need to add a client code.
Once you’re logged in you’ll notice a blue bar across the top of the page. This is your (web 0.5!) navigation bar. Click on Query to bring up the case search window. If you have the actual case number, you can put that in the top box and hit search. Otherwise, you can enter in a party name. For my recent research, I just enter “holomaxx” in the box marked Last/Business Name and click Search. Being web 0.5! you have to actually click the button, pressing enter doesn’t work.
That will take you to the Select a Case window. In this case, Holomaxx is a safe search because it brings up exactly the two cases I’m interested in: Holomaxx v. Yahoo and Holomaxx v. Microsoft. Clicking on the case number brings up a window with some basic information (the judge, last filing date) and a number of links.
The link that will show you documents is, unsurprisingly, History/Documents. Click there, and click again on All events to bring up a list of documents filed with the court.
The first column is a clickable link that lets you look at the document. The second column is that date it was filed. The third column is the title of the document. Generally when I’m looking at a new case I grab something that looks like “complaint” or “motion” to orient myself.
When I’m looking at PACER I tend to download everything I look at on a case, just so I only have to pay for it once. I also make extensive use of tabs and new windows, so I don’t have to reload the case page.
Download names vary by the actual court. For instance, the Northern California court gives me all the documents with the same name: show-temp.pl. But other courts give names like 384972395.pdf. In either case, you’re going to want to rename the documents to something useful before you have a disk full of show-temp-*.pl files. In some cases, there are documents and exhibits in a single filing. You will be asked if you want to download everything as a .zip file. I suggest you do this.
For a while I was trying to name things intuitively but then gave up because it gets too confusing. My current organizational technique is to set up a directory with the case name HolomaxxvYahoo_4926 and HolomaxxvMS_4924. The numbers are the last 4 digits of the case number and are there to make it easier to file and sort documents.
If you download a zip file, it opens up a directory containing all the files. The courts name these pretty simply: documentnumber-main.pdf, documentnumber-1.pdf, documentnumber2.pdf. The document numbers correspond to the order the documents were filed with the court. Once the file is unzipped, I copy the files into the directory I’ve set up for that case.
Now that you have the documents somewhat organized, you can shut PACER down and go read at your leisure. If you spend more than $10.00 on documents in a quarter, then you will get a bill from the Federal court system. If you haven’t spent that much, the court doesn’t bother billing you that quarter.
Some state courts have similar systems, but not all of them do and you can’t use a PACER login to access them.
In the course of writing this, I discovered new documents filed in the Holomaxx case filed by the defenands. Tune in tomorrow. Same bat-time. Same bat-blog.

Read More

Holomaxx status

Just for completeness sake, Holomaxx did also file an  amended complaint against Microsoft. Same sloppy legal work, they left in all the stuff about Return Path even though Return Path has been dropped from the suit. They point to a MAAWG document as a objective industry standard when the MAAWG document was merely a record of a round table discussion, not actually a standards document. I didn’t read it as closely as I did the Yahoo complaint, as it’s just cut and paste with some (badly done) word replacement.
So what’s the status of both cases?
The Yahoo case is going to arbitration sometime in July. Yahoo also has until May 20 to respond to the 1st amended complaint.
The Microsoft case is not going to arbitration, but they also have a response deadline of May 20.
I’m not a legal expert, but I don’t think that what Holomaxx has written fixes the deficits that the judge pointed out in his dismissal. We’ll see what the Y! and MSFT responses say a month from today.

Read More

MAAWG: Just keeps getting better

Last week was the 22nd meeting of the Messaging Anti-Abuse Working Group (MAAWG). While I am prohibited from talking about specifics because of the closed door nature of the group, I can say I came out of the conference exhausted (as usual) and energized (perhaps not as usual).
The folks at MAAWG work hard and play even harder.
I came away from the conference feeling more optimistic about email than I have in quite a while. Not just that email is vital and vibrant but also that the bad guys may not be winning. Multiple sessions focused on botnet and crime mitigation. I was extremely impressed with some of the presenters and with the cooperation they’re getting from various private and public entities.
Overall, this conference helped me to believe that we can at least fight “the bad guys” to a draw.
I’m also impressed with the work the Sender SIG is doing to educate and inform the groups who send bulk commercial messages. With luck, the stack of documents currently being worked on will be published not long after the next MAAWG conference and I can point out all the good parts.
There are a couple specifics I can mention. One is the new list format being published by Spamhaus and SURBL to block phishing domains at the recursive resolver. I blogged about that last Thursday. The other bit is sharing a set of security resources Steve mentioned during his session.
If your organization is fighting with any messaging type abuse (email, social, etc), this is a great place to talk with people who are fighting the same sorts of behaviour. I do encourage everyone to consider joining MAAWG. Not only do you have access to some of the best minds in email, but you have the opportunit to participate in an organization actively making email, and other types of messaging, better for everyone.
(If you can’t sell the idea of a MAAWG membership to your management or you’re not sure if it’s right for you, the MAAWG directors are sometimes open to allowing people whose companies are considering joining MAAWG to attend a conference as a guest. You can contact them through the MAAWG website, or drop me a note and I’ll make sure you talk with the right folks.)
Plus, if you join before October, you can meet up with us in Paris.

Read More