SpamDB FAQ

• Am I a spammer?
• Am I an Internet Marketer conforming to CANSPAM, but not the Australian Spam Act (2003)?
• Are any of the mailing lists I run NOT Confirmed Opt-In? (As defined by MAPS and Spamhaus)
• Will any of my customers or employees (if any) continue to have Internet access or other services from me if they answer 'yes' to any of the above questions regarding their use of any of my services?

If you got this far, and answered honestly, you may be in a position to get out of the database.

Second, answer the following.

• Am I an end-user with a standard residential-class ISP account?
• Am I an end-user at my company, as opposed to a systems, networks, or accounts administrator or a supervisor to such a person?
• Is my IP address on a shared server, on my ISP's outgoing mail server, or otherwise shared with others?
• Is my IP address in the neighborhood of a spammer?
• Is my IP address in a huge listed block?

Third and finally, if you are really not a spammer, or you are truly reformed, de-listing is relatively easy, and you can choose one of two options:

• Donate US$50 to a charity or trust approved by, and not connected with, SORBS for each spam received related to the listing. This is referred to as the SORBS 'fine'.
• Wait for a period of 1 year for each spam received related to the listing (e.g. if 3 spams were received, wait 3 years).

If you got this far, and answered honestly, go to the bottom of this page for further details. If you got this far, and answered honestly, go to the bottom of this page for further details.

• The IP address that you use for your outgoing mail was used to send spam to a SORBS spamtrap or administrator. There are multiple possibilities for how this could have happened:
• • You spammed directly.
  • • Either you are a dedicated spammer, or
    • you operate an insecure mailing list to which the address of a SORBS spamtrap or administrator was added without their knowledge or consent.
  • It is a shared server and some other user on the same server spammed directly.
  • The machine was illegally taken over via vulnerabilities in software and abused for spamming. This includes vulnerabilities on servers as well as viruses and trojan horses on end-user computers.
• You are an ISP who provides supplementary Internet services (DNS, web hosting, mail exchanger) or a credit card operator who provides credit card processing services to a domain advertised in spam that was received by a SORBS spamtrap or administrator.
• You are an innocent party whose IP address is listed as part of a larger range of blocked IP addresses because your Internet service provider is not taking action against other customers of theirs that engage in spamming. Please see the Listing Overview document, where the spam database section is second at the bottom.
• You inherited a listed network after your provider moved the previous tenant, who was a listed spammer, elsewhere. They may have simply moved them around in their own IP address space, or they may have terminated the spammer. At any rate, it would have been kind of the ISP to double-check whether the address block was blocklisted anywhere before reallocating it.

There is one exception to the "previous tenant" rule: When a netblock is returned to the appropriate Regional Internet Registry and reallocated, SORBS may waive the fine.

In the old days, it used to be that putting an unpatched, unfirewalled Microsoft Windows® machine on the Internet was the worst thing you could do. It still is irresponsible in the highest degree, of course. Installing a proxy server and leaving it open for the world to use is both foolish and irresponsible, yet people are doing these things every day, and no one is telling them they can't or that it is wrong.

The current craze is spamming through webmails - this is most popular with the West African advance fee fraud industry - as well as through ISP mail servers, which is hardly surprising given that spamware has had to adjust to Port 25 blocking on consumer connections. Spamhaus informed the world of this phenomenon coming on already in February 2005. What they aren't saying in that article is that SMTP AUTH is also not a solution. The hijacker already has complete control over the zombie - what makes anybody think that SMTP AUTH passwords stored in the registry, on disk, or simply captured through keylogging techniques wouldn't be fair game to them?

If you represent an ISP, or a webmail operator, please be prepared to hear SORBS ask you to implement content-based spam filtering on the outbound mail queue if the above is what's happened to you. It has been claimed that this will be impossible in some jurisdictions. That may or may not be the case. However, even if it is, it does not follow that SORBS is forced to accept spam from you - you're quite welcome to seek delisting through the 'fine' route in that case. But if you do choose to implement a method of spam control that prevents your mail server from delivering the spam your customers are trying to send because they've been infected (or anything), then the 'fine' requirement can be waived.

The 'fine' is US $50.00 and is designed to be small enough to so that the home user will think twice about getting listed a second time, and small enough to be a 'right royal pain in the butt' to any large company, the idea being that whether you are a multi-national company or a single home user, you will think twice about getting relisted for any reason.

Needless to say, the 'fine' policy has proved controversial, particularly with those listed. It has also received negative press from several large U.S. ISPs (surprisingly enough, ones who are affected by listings). SORBS will not delist you simply because you happen to disagree with SORBS listing policies. You should also understand that SORBS volunteers will not engage in debates over SORBS listing policy in a delisting request. If you disagree with SORBS policies please read on and send feedback as indicated below.

SORBS will also accept nominations for good causes and charities to act as recipients instead. This can be on a case by case basis or on a larger scale, in which case the name and details of the recipient would appear here. If you wish to suggest a recipient, please consider the following issues:

• Does the charity have an online donation service?
• Does the charity accept donations by credit card?
• Is the charity a registered charity?
• Is the charity capable of confirming donations made because of a SORBS listing?
• Does the charity have low administrative overheads?

The one place the 'fine' will never go is to a SORBS admin or project. Comments have been made that SORBS should setup a trust and periodically donate the 'fines' to the nominated charities. This is currently not an option, pending legal advice, as it is likely this would cross the legal boundary of extortion or blackmail. This is also the reason for the delay in allowing 'fines' to be paid to charities, as all SORBS has spoken to so far cannot handle online payments/donations with notifications.

What will it be replaced with? That is the question SORBS has for you.

Suggestions may be made by mail to Matthew Sullivan. The address has been deleted from this web page because it was becoming clogged up with support requests that should have been sent to the support system instead.

You can take a look at the suggestions made so far.

If you do not know what your IP address is, please read the Support Request FAQ because you cannot be delisted without knowing it. This is simply because we are not mind readers. Any requests that do not contain the IP address(es) involved have to be ignored and deleted unread. Sorry.

If your listing has a mask of /32 (eg: 127.0.0.1/32 <- /32 = mask of /32) then there are two ways in which it can be delisted.

1. Send a support request to: payments@support.sorbs.net to request the total number of spams. Then donate US$50 per spam to one of the charities or good causes listed below, or,
2. Pay US$50 to the charities or good causes listed below, and then submit a donation notification to: paid@support.sorbs.net

Payment may be made via PayPal to: joey@vtgts.com

For those unfamiliar with PayPal:

• Go to http://www.paypal.com/
• Click the 'Send Money' tab.
• Create an account (if you don't already have one)
• Make a donation of US$50 to joey@vtgts.com, stating the IP address in the information field.

Note: Joey McNicol has no connection with SORBS, he has no control over who is listed or delisted. Complaining to him about an entry will not get you anywhere.

SORBS is aware of the fact that PayPal is not available everywhere. If you are in such a position, we suggest that you find a suitable charity in your own country and have us agree to it before you donate.

The Joey McNicol Legal Defense Fund is a good cause that SORBS supports.