Today on the Spamhaus Blog an Announcement appeared discussing a new classification to the SBL – Spamhaus CSS (Composite Snow-Shoe). This is a new classification that will be making it easier to identify and combat an old yet rapidly growing problem – the Snowshoe Spammer.
Don’t know what Snowshoe spamming is? Here is the Spamhaus description: Like a snowshoe spreads the load of a traveler across a wide area of snow, snowshoe spamming uses many frequently-changing IP addresses, domains and aliases to spread out the spam load in order to dilute recipient reputation metrics and evade filters.
This looks like it will be a quick listing type service, with volunteer research tying the source back to known spam organizations (ROKSO), tied to an automated removal process, after a number of days, built in to help identify these rapidly moving targets of spam.
Are you already using the SBL/ZEN lists then you should review how your rules are flagging the different types of listings. CSS listings will return a different code during the DNS lookup on an IP in this case, 127.0.0.3 will be shown instead of the traditional SBL record of 127.0.0.2. This return code change will allow you to adjust the way your treating listed IPs, maybe for the CSS list you want to Gray list the mail and force the sender to return at a later time, or maybe you will adjust your spam scoring differently (not as high or higher?) and on the SBL/Zen lists you want to outright reject the mail… The choice is yours but now you have more choices and choices are good 😉
* image thanks to the Spamhaus Project
