Suomispam blog

Microsoft has decided to block any emails from Suomispam to any M365 domains. We have no idea why and Microsoft has not disclosed any information to us.

Therefore do not expect a response if you email us from any email domain hosted by Microsoft.

Major email providers such as Google have strict inbound spam filtering but appear to have very loose outbound filtering. Because they are so huge, it does not make sense to blacklist them outright, but spam originating from their service is getting worse.

So we decided to start a new experimental blacklist to cover that, the Suomispam email blacklist. The list can be queried by DNS at ebl.suomispam.net.

We receive a lot of delisting requests, some justified, most not. Of of the common justifications that will not fly is this one: “but it is an old listing”.

If you have had a rodent problem for a long time, is it no longer a problem?

Suomispam does have some very old listings because a lot of spammers are in it for the long haul. Sure, some spammers come and go and some use throw-away accounts, but a lot just keep doing it.

Suomispam listings can be removed once the spam issue has been dealt with. That is the path to delisting. Not waiting it out, not threats, not complaining that it was someone else who sent spam.

This blog is based on Tumblr. Therefore we automatically follow their conventions or how they organize discussion. Tumblr does not have old-school comments for posts. The Tumblr equivalent system is to reblog with a comment (caption), i.e. the arrows logo next to the post title.

This should not be a surprise, but yes, if you hire affiliate spammers, Suomispam will list you just as if you sent the spam yourself. 

Effortia Oy which runs www.asuntojenmyynti.fi has been reported to have been involved in spam at least since 2014. They have been listed by Suomispam as well for quite a while. 

A long time ago they approached us telling us that they have had a look at how they operate and made changes and promised to have mended their ways. We fell for the explanations (we do like to give people a bit of slack at first if there is any plausible explanation) and we did delist them. Unfortunately they did not mend their ways and the flow of spam did not stop.

So we did relist them. We have since refused to delist them without them first giving up affiliate spam. Effortia has now indicated that because our listing is bad for business, they will be filing an official complaint with the police. Unfortunately for them, something being bad for business is not illegal. Otherwise we would start putting restaurant critics in jail for causing bad business to bad restaurants.

There are a few lessons to this story:

Do not hire affiliate spammers, they will destroy your service’s reputation. They will try to scam the end users any way they can and they are very good at hiding their own identity.

If you get listed, the only way to get delisted is to cease spam. Not threats, not bogus explanations, nothing. We always recommend stopping spam. It will actually help with listings.

If you invoke official complaints to police or courts, you do have to go all the way through. There is no point in having several concurrent processes, i.e. both a court process and our own private delist request process going on at the same time. Therefore we suspend our own delisting process until there is a valid court order. There has never been a court order against Suomispam.

No, we do not delist addresses just because someone threatens us with bad reviews. A payday loan spammer, omalaina.fi, got the IP address and later the network listed over a year ago and to date Linode has not done anything to the issue. We check these things. Unfortunately webkonsulenter.dk has their facts completely wrong and yet they try to use publicity to pressure us to delist. Hosting providers often have several customers and it is an unfortunate but unavoidable fact that just a few persistent spammers can cause major collateral damage. I would have thought a web consultant would know that.

D-Fence is a fairly old Finnish spam filtering company. They have provided filtering MX service for years for deploying in front of regular mail servers. Last year they started to migrate to new areas of business and attempted to monetize on the GDPR. Unfortunately they partnered with vine.eu to advertise their new service using spam. I.e. a spam filtering company chooses to use spam for their own marketing. Just because you sell spam filtering services does not give you a free pass to send your own spam, and they of all people should know this. Also just because you have two products and you only try to sell one of those with spam does not get you a free pass.

D-Fence has publicly admitted to buying business contacts (and we would guess email addresses) from Asiakastieto as well as collecting them from other sources. Vine is also known to sell address lists so we do not reliably know who sold them the address lists they actually use. Buying 3rd party address lists and/or harvesting them from other sources is by definition spam. There is no way they could have permission from the recipients of their marketing emails.

Their spam campaigns landed them listings on both Suomispam and Spamhaus lists. Apparently they did not consider getting listed as a sign that they really should reconsider their business methods. Instead they have threatened to file criminal complaints against Suomispam with made up reasons. It has already been established that Suomispam is perfectly legal, but D-Fence apparently feels it is in their interest to try to shut Suomispam down with bogus charges anyways.

Finally it happened. 

Suomispam does get people upset pretty often. Especially spammers really do not like it when we list their domains or IP’s. Every now and then they threaten to either sue us or file criminal complaints against us. Those are almost always empty threats. We know our legal basis pretty well so we do not feel particularly threatened by them. All those threats do is block the possibility of reëvaluation of the listing in the near timeframe.

However, finally someone actually did file a criminal complain due to Suomispam listing them. This “brave” spammer in question was toimistotarviketukku.fi (Owela Oy) whose chairman of the board Tero Ojala filed a criminal complaint with the police. He asked the police to investigate if Suomispam is guilty of interfering with electronic communications. Unfortunately he apparently did not know that the statute does not cover what reputation databases do. (It covers only unlawfully interfering with communications). 

The admins of email servers are perfectly in their right to filter emails using blacklist information and Suomispam absolutely has the right to distribute reputation information to user organisations. It is basically the same legal principle of it being lawful for restaurant critics to tell everyone how certain restaurants serve terrible food. Even if it may be bad for business for the restaurants to get bad reviews.

It is surprising and sad that this needs to be mentioned.

Someone from Middle-East approached us and escalated their demands for delisting by offering us a bribe in exchange for delisting. Let’s make this absolutely clear. Our listings are cleared when and only when we feel confident that the situation no longer merits a listing. We do NOT accept any kinds of bribes. You can NOT buy yourself out of a listing. An attempted bribe will lead to the exact same result as will baseless legal threats: processing that delist request immediately stops. If you try to force our hand by either bribery or threats, the issue gets moved to the end of the queue along with other cases that require more time spent monitoring.

Unfortunately OVH today became the first operator with over one thousand Suomispam BL listings. Soltia has the second place at less than 300, which is also a mighty big number. Each listing can cover either just one IP or a larger netblock if that netblock has a significant number of spam hosts in it.

Most of OVH’s listings are caused by a single spamming entity. This is indicative of the current state of spam. Blacklists are pretty good at catching single spamming IP’s. That is why quite many spammers employ the so called snowshoe spamming tactic i.e. they obtain huge amount of hosts to spread the spam. Each single IP sends only a fraction of the total number of messages and that makes them more difficult to notice. We put a lot of effort into listing as many IP’s used by the spammers as possible, but in the end it is more or less playing whack-a-mole.

That is what has happened with OVH. It is so easy and cheap to buy thousands of hosts from OVH that the spammers do just that. And we follow and list those hosts and those networks. If the operator can keep up and do due diligence on their abusive customers, the number of listings typically stays under control. Unfortunately it looks like OVH is too easy and too cheap for spammers to deploy and thus the spam situation has gotten out of control. Such spam contamination is bad for honest OVH customers because they are bound to get hit by collateral damage from the thousand listings.

Roughly a third of all Suomispam BL listings are in OVH networks.

We get plenty of delist requests. Some come from ISP’s, some come from hosting customers and some from 3rd parties. Some result in delisting and some do not.

Sometimes we get requests that are either totally unintelligible or ones that do not seem sincere. Not sure what to think of this one we got recently:

We have suspended the suspicious account from server and we have also scanned the whole server for any malicious file, so kindly please delist the ip.i am not sending any spam. i am only doing simple marketing mailingi didn't get any date and time i don't use spamming, i am added in the list mistakenly

We ended up sending this reply:

Are you serious?

So you are in effect claiming all of the below arguments:

That you did not do it but a customer, who was kicked out, did it

That it was a virus or something like that and you cleaned it up

That you are only doing simple email marketing (also called spam), but it is not spam

That you don't know time or day ?!?

That there was some mistake and no spam whatsoever

And you have the nerve to make such claims for an IP that has a reverse name of edc1.bitcoin-gratis-free.com and is used to host a bitcoin scam site.

Request denied.

People, when sending us delist requests, please give us something to work with and do not try to scam us. We check things out. There have been lots of days when we delist more than we list, but we only delist when there is cause.

There are quite a few comments that come up regularly when one operates a blacklist for a while. One of them is the complaint from someone demanding delisting of an IP because no other blacklist has it listed. Typically this comes up from Mxtoolbox users who check their hosting provider’s IP against the close to hundred blacklists that they search.

Typically people think there must be something wrong with Suomispam because we are the only ones who pick up something. In our opinion it is actually the opposite. If Suomispam picked up all the same spammers as everyone else, there would be no point in us doing all the work of listing and delisting. We would be redundant.

Suomispam exists because there is a lot of spam in Finland (and Nordic countries) that often flies under the radar with regard to large global blacklists. A lot of global spam, at least in English, is targeted at hundreds of millions of users and is quite often sent through hacked servers. Finnish spam targets five million users and the only type of Finnish spam that is typically sent through hacked servers is phishing spam. Large portion of Finnish spam is sent by affiliate spammers through cloud servers that they actually pay for. Magazine subscriptions, online casinos, payday loans, office supplies, courses and electronics are among the top items spammers try to sell to Finnish email users.

Suomispam sometimes gets various threats from spammers whom we list. Usually they either threaten to sue us or to report us to someone.

In December Heikki Holvikari of onestop.fi and victoria.fi sent out a spam campaign advertising business gifts.