By John S. Quarterman, Markus Sammallahti, Huaxia Rui, and Andrew B. Whinston, July 2009.
Can we see any effects in anti-spam blocklists of Verizon requiring use of port 587 instead of port 25 for outbound mail? For mail outbound through port 587, Verizon requires the sender to use username and password authentication first. This change got slashdotted on 17 Feb 2009 due to an article by Brian Krebs, which said,
Verizon spokesman Clifford Lee said within the next few months, the company plans to shift to using Port 587 for e-mail originating on the Verizon network.
We examined 31 ASNs owned by Verizon. Most of them showed nothing unusual. However, two of those ASNs showed very similar curves, which could plausibly have been caused by Verizon requiring use of port 587.Our IIAR Project (NSF Award #0831338 CT-ISG: Collaborative Research: Incentives, Insurance and Audited Reputation: An Economic Approach to Controlling Spam) records in a database daily data from half a dozen anti-spam blocklists. This Verizon policy change apparently occured after 9 February 2009, when we first started collecting data for Spamhaus and PSBL blocklists. Using our web interface to the blocklist data in our database, we selected 31 ASNs owned by Verizon (listed at the end of this report) and examined them to produce the results below.
SpamHaus
The SpamHaus blocklist we have from 9 February 2009 is Spamhaus SBL.One Month
Since SpamHaus didn't list any Verizon ASNs from 9-24 Feb, there was nowhere to go down. On 25 Feb, AS-701, UUNET - MCI Communications Services, Inc. d/b/a Verizon Business, jumped up to 3 hosts listed, and slowly decreased from there. Also on 25 Feb, AS-19262, VZGNI-TRANSIT - Verizon Internet Services Inc., jumped up to 37 and stayed there. This is not the effect we seek.
Two Months
Looking two months out on SpamHaus, we see more of the same. UUNET continues to decrease, and VZGNI-TRANSIT continues to increase. Still not the effect we seek.
Three Months
Looking three months out, AS-701, UUNET, gets caught up in the 18-30 April artifact, and AS-19262, VZGNI-TRANSIT also does, to a lesser extent. Still nothing that looks like what we would expect from a change to port 587.
PSBL
PSBL tends to have many more listings than SpamHaus, so there's a better chance of finding something in PSBL.One Month
AS-19262, VZGNI-TRANSIT drops from 1145 on 9 Feb to 332 on 22 Feb, a 70% decrease. That is the kind of curve we're looking for. But if that was the effect of VZ switching to port 587, it was short-lived, because PSBL's listings for AS-19262 quickly go back up to more than double where they started.
Omitting AS-19262, it is possible to see a similar effect for AS-701, UUNET, from 25 on Feb 9 to 3 on Feb 22. That's an 86% decrease. But whatever caused it was soon overwhelmed by an increase up to 76 by March 9.
Two Months
A similar curve occurs in the second month. AS-19262, VZGNI-TRANSIT peaks at 2,729 on March 10, starts down on March 13, reaches a bottom of 2,053 on March 19, a decrease of 25%. It stays in that range for a week, then starts back up on March 31, reaching 3,142 by April 9.
Without AS-19262, we can see that AS-701 shows a similar pattern, starting to drop on March 13, reaching a bottom of 54 on March 26, a decrease of 28%. It heads back up on March 30, and reaching 76 again on April 9.
Omitting both AS-19262 and AS-701, we can see the other two VZ ASNs that show up: 14551, UUNET-SA - MCI Communications Services, Inc. d/b/a Verizon Business, and 22385, VZ-AVENUE - Verizon Avenue Corp. These never have more than 4 hosts listed during this period, and it's hard to see any pattern to correlate.
Three Months
AS-19262 just keeps going up on PSBL.
AS-701 also just keeps going up on PSBL.
The other two VZ ASNs continue to stay in the 1-4 range.
Other Blocklists
No other blocklists were recorded early enough to see what happened in February and March.Looking at AS-19262 for all blocklists (omitting APEWS to avoid the 18-30 April artifact), once their data is available, the other blocklists reflect the same increase that PSBL shows.
Looking at AS-701 for all blocklists (omitting both APEWS and SpamHaus to avoid the 18-30 April artifact), UCE and UBL show some increase, but CBL does not.
Conclusion
If we saw anything related to Verizon requiring port 587, it was in PSBL, and probably either between 9 and 22 Feb or between 13 and 19 March, or both. It is curious that the curves for AS-19262 and AS-701 are so similar. Here they are side by side:
Even the one-day decrease to zero on Feb 18 is the same for both ASes. Even the percentage decreases in March are similar. Since these ASes are owned by the same company, these listing changes could be the result of a policy change, such as requiring port 587.
Whatever it was, it didn't last long either time. If it was requiring port 587, apparently spammers adapted fairly quickly. This may explain why no other ISP has publicly admitted requiring port 587 since Verizon did. Despite many inquirires, no other ISP has confirmed making such a requirement since. This makes confirmation of what we may have seen for these two Verizon ASNs difficult, since there are no other examples to compare. Nonetheless, it is clear that Verizon requiring use of port 587 did not stop increasing spam coming from Verizon ASNs.
The 31 Verizon ASNs
These are the 31 Verizon ASNs examined in this study.
701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 703 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 705 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 813 UUNET-CANADA - MCI Communications Services, Inc. d/b/a Verizon Business 2256 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 3114 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 3477 VZGNI-TRANSIT - Verizon Internet Services Inc. 3845 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 4012 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 6066 VERIZON-BUSINESS-MAE-AS6066 - Verizon Business Network Services Inc. 6236 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 6715 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 6950 VZGNI-TRANSIT - Verizon Internet Services Inc. 6984 NYNEX-AS - Verizon Data Services LLC 7046 RFC2270-UUNET-CUSTOMER - MCI Communications Services, Inc. d/b/a Verizon Business 7934 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 8050 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 11004 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 14015 VZGNI-TRANSIT - Verizon Internet Services Inc. 14551 UUNET-SA - MCI Communications Services, Inc. d/b/a Verizon Business 17004 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 17650 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 19262 VZGNI-TRANSIT - Verizon Internet Services Inc. 20171 UUNET-SA - MCI Communications Services, Inc. d/b/a Verizon Business 22385 VZ-AVENUE - Verizon Avenue Corp. 25104 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 27307 VZGNI-TRANSIT - Verizon Internet Services Inc. 30536 VERIZON-FIRN2 - Verizon Network Integration 58070 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 72640 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business
Acknowledgement:
This material is based upon work supported by the National Science Foundation under Grant No. 0831338. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation.
Can we see any effects in anti-spam blocklists of Verizon requiring use of port 587 instead of port 25 for outbound mail? For mail outbound through port 587, Verizon requires the sender to use username and password authentication first. This change got slashdotted on 17 Feb 2009 due to an article by Brian Krebs, which said,
Verizon spokesman Clifford Lee said within the next few months, the company plans to shift to using Port 587 for e-mail originating on the Verizon network.We examined 31 ASNs owned by Verizon. Most of them showed nothing unusual. However, two of those ASNs showed very similar curves, which could plausibly have been caused by Verizon requiring use of port 587.
Our IIAR Project (NSF Award #0831338 CT-ISG: Collaborative Research: Incentives, Insurance and Audited Reputation: An Economic Approach to Controlling Spam) records in a database daily data from half a dozen anti-spam blocklists. This Verizon policy change apparently occured after 9 February 2009, when we first started collecting data for Spamhaus and PSBL blocklists. Using our web interface to the blocklist data in our database, we selected 31 ASNs owned by Verizon (listed at the end of this report) and examined them to produce the results below.
SpamHaus
The SpamHaus blocklist we have from 9 February 2009 is Spamhaus SBL.One Month
Since SpamHaus didn't list any Verizon ASNs from 9-24 Feb, there was nowhere to go down. On 25 Feb, AS-701, UUNET - MCI Communications Services, Inc. d/b/a Verizon Business, jumped up to 3 hosts listed, and slowly decreased from there. Also on 25 Feb, AS-19262, VZGNI-TRANSIT - Verizon Internet Services Inc., jumped up to 37 and stayed there. This is not the effect we seek.
Two Months
Looking two months out on SpamHaus, we see more of the same. UUNET continues to decrease, and VZGNI-TRANSIT continues to increase. Still not the effect we seek.
Three Months
Looking three months out, AS-701, UUNET, gets caught up in the 18-30 April artifact, and AS-19262, VZGNI-TRANSIT also does, to a lesser extent. Still nothing that looks like what we would expect from a change to port 587.
PSBL
PSBL tends to have many more listings than SpamHaus, so there's a better chance of finding something in PSBL.One Month
AS-19262, VZGNI-TRANSIT drops from 1145 on 9 Feb to 332 on 22 Feb, a 70% decrease. That is the kind of curve we're looking for. But if that was the effect of VZ switching to port 587, it was short-lived, because PSBL's listings for AS-19262 quickly go back up to more than double where they started.
Omitting AS-19262, it is possible to see a similar effect for AS-701, UUNET, from 25 on Feb 9 to 3 on Feb 22. That's an 86% decrease. But whatever caused it was soon overwhelmed by an increase up to 76 by March 9.
Two Months
A similar curve occurs in the second month. AS-19262, VZGNI-TRANSIT peaks at 2,729 on March 10, starts down on March 13, reaches a bottom of 2,053 on March 19, a decrease of 25%. It stays in that range for a week, then starts back up on March 31, reaching 3,142 by April 9.
Without AS-19262, we can see that AS-701 shows a similar pattern, starting to drop on March 13, reaching a bottom of 54 on March 26, a decrease of 28%. It heads back up on March 30, and reaching 76 again on April 9.
Omitting both AS-19262 and AS-701, we can see the other two VZ ASNs that show up: 14551, UUNET-SA - MCI Communications Services, Inc. d/b/a Verizon Business, and 22385, VZ-AVENUE - Verizon Avenue Corp. These never have more than 4 hosts listed during this period, and it's hard to see any pattern to correlate.
Three Months
AS-19262 just keeps going up on PSBL.
AS-701 also just keeps going up on PSBL.
The other two VZ ASNs continue to stay in the 1-4 range.
Other Blocklists
No other blocklists were recorded early enough to see what happened in February and March.Looking at AS-19262 for all blocklists (omitting APEWS to avoid the 18-30 April artifact), once their data is available, the other blocklists reflect the same increase that PSBL shows.
Looking at AS-701 for all blocklists (omitting both APEWS and SpamHaus to avoid the 18-30 April artifact), UCE and UBL show some increase, but CBL does not.
Conclusion
If we saw anything related to Verizon requiring port 587, it was in PSBL, and probably either between 9 and 22 Feb or between 13 and 19 March, or both. It is curious that the curves for AS-19262 and AS-701 are so similar. Here they are side by side:
Even the one-day decrease to zero on Feb 18 is the same for both ASes. Even the percentage decreases in March are similar. Since these ASes are owned by the same company, these listing changes could be the result of a policy change, such as requiring port 587.
Whatever it was, it didn't last long either time. If it was requiring port 587, apparently spammers adapted fairly quickly. This may explain why no other ISP has publicly admitted requiring port 587 since Verizon did. Despite many inquirires, no other ISP has confirmed making such a requirement since. This makes confirmation of what we may have seen for these two Verizon ASNs difficult, since there are no other examples to compare. Nonetheless, it is clear that Verizon requiring use of port 587 did not stop increasing spam coming from Verizon ASNs.
The 31 Verizon ASNs
These are the 31 Verizon ASNs examined in this study.
| 701 | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business |
| 702 | AS702 Verizon Business EMEA - Commercial IP service provider in Europe |
| 703 | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business |
| 705 | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business |
| 813 | UUNET-CANADA - MCI Communications Services, Inc. d/b/a Verizon Business |
| 2256 | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business |
| 3114 | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business |
| 3477 | VZGNI-TRANSIT - Verizon Internet Services Inc. |
| 3845 | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business |
| 4012 | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business |
| 6066 | VERIZON-BUSINESS-MAE-AS6066 - Verizon Business Network Services Inc. |
| 6236 | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business |
| 6715 | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business |
| 6950 | VZGNI-TRANSIT - Verizon Internet Services Inc. |
| 6984 | NYNEX-AS - Verizon Data Services LLC |
| 7046 | RFC2270-UUNET-CUSTOMER - MCI Communications Services, Inc. d/b/a Verizon Business |
| 7934 | AS702 Verizon Business EMEA - Commercial IP service provider in Europe |
| 8050 | AS702 Verizon Business EMEA - Commercial IP service provider in Europe |
| 11004 | AS702 Verizon Business EMEA - Commercial IP service provider in Europe |
| 14015 | VZGNI-TRANSIT - Verizon Internet Services Inc. |
| 14551 | UUNET-SA - MCI Communications Services, Inc. d/b/a Verizon Business |
| 17004 | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business |
| 17650 | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business |
| 19262 | VZGNI-TRANSIT - Verizon Internet Services Inc. |
| 20171 | UUNET-SA - MCI Communications Services, Inc. d/b/a Verizon Business |
| 22385 | VZ-AVENUE - Verizon Avenue Corp. |
| 25104 | AS702 Verizon Business EMEA - Commercial IP service provider in Europe |
| 27307 | VZGNI-TRANSIT - Verizon Internet Services Inc. |
| 30536 | VERIZON-FIRN2 - Verizon Network Integration |
| 58070 | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business |
| 72640 | UUNET - MCI Communications Services, Inc. d/b/a Verizon Business |
Acknowledgement:
This material is based upon work supported by the National Science Foundation under Grant No. 0831338. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation.
| < Prev |
|---|
