Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it safe to assume that most, if not all, emails from a *.ru domain may be considered spam? From a log of 30000 emails from *.ru, its all been spam (over two months).

share|improve this question
    
I would personally blacklist only the spamming domains with the .ru first level. –  PsyStyle Jul 18 '12 at 14:22
1  
It depends. I've had for a long time 100% working spam filter that everything in English was spam. –  Donaudampfschifffreizeitfahrt Jul 18 '12 at 14:56
1  
@lechlukasz - that filter would cause me problems - I could effectively use the reverse of that as my first pass, as I don't get any useful email that is not in English :-) –  Rory Alsop Jul 18 '12 at 15:13
1  
Have you considered using DNSBL and URIBL? –  Matrix Jul 18 '12 at 18:14
1  
Worth pointing out that a .ru domain does not mean a Russian IP, nor vice-versa. –  tylerl Jul 19 '12 at 1:58

4 Answers 4

up vote 10 down vote accepted

No you cannot safely assume this. Maybe according to your mail servers you can assume this but overall only 4.9% of total spam comes from Russia according too Trustwave.

According to Securelist the numer is as low as 1.7% for January 2012.

See this picture for how far down Russia places on the spam list: enter image description here

Edit: additional info.

If you sometime have to do business with a Russian you would have a bug that may be hard to identify later on, perhaps in a couple of years when you forgot about this configuration. Russia is the 9th largest country population wise in the entire world so it may be quite a big deal to block it.

I would look at the spam designated to you and see if you can identify any common denominators in the headers or content of the spam. It may very well be other ways to distinguish between the spam and no spam than blocking everything.

share|improve this answer
10  
To be sure...although only 4.9% of spam comes from Russia, it may well be that 99% of Russian mail is spam. Your chart doesn't show that aspect of it. –  Mark Beadles Jul 18 '12 at 14:38
9  
-1 for propagating mathematical illiteracy. The percentage we're interested in is the percentage of Russian mail that is spam (though even that might be irrelevant). However, the percentage of spam that is Russian mail has absolutely nothing to do with anything. –  BlueRaja - Danny Pflughoeft Jul 18 '12 at 17:20
6  
@Karrax: You still don't seem to get it: this has nothing to do with language vs origin. OP is asking if most mail from Russia can be ignored as spam. Your answer tells us whether most spam is from Russia. That is the answer to a completely different question, and does not help at all in answering OP's question. It could very well be the case that most spam comes from Russian mail, but most Russian mail is not spam; or, it could very well be that comparatively little spam comes from Russia, but most mail from Russia is spam anyways. This answer has nothing to do with the question!! –  BlueRaja - Danny Pflughoeft Jul 18 '12 at 18:26
6  
+1 to @BlueRaja-DannyPflughoeft and mathematical illiteracy. The answer to "is drowning fatal?" has nothing to do with "only 0.01% of deaths are due to drowning" –  Jimmy Jul 18 '12 at 18:38
1  
i would downvote this answer if i had enough rep on security.se –  jasonk Apr 2 '13 at 2:17

Server-side filters for mail are a much better solution. Start with a couple of really good DNSRBLs and then add SPF checking. Also, make sure your host isn't an open relay using the various tools around the Internet. Finally, set up a system (e.g. 'fail2ban') that will automatically block IP addresses at the 'iptables' level for a deterministic amount of time when they attempt to log into hosted services and fail repeatedly. This approach lets automated software handle blocking of bad mail at the originating source that you never really wanted to get in the first place - and will block the *.ru spam in the process while letting legitimate mail through.

After doing these things on my server, I saw a 99% drop in my incoming spam for my e-mail client. The rest of the inbound spam is dealt with by setting up a few simple client filters. You can, again, choose to block *.ru at this level but that is up to you. If you don't care about Russia or know anyone there, then block away but spammers always find new ways around generic blocks like that, so you'll be fighting a losing battle.

share|improve this answer

It might be that 99.99% of your mails from a .ru domain.

However wether you can block it depends on the 0.001% that are not spam. What do you want to do with them and most importantly what does it cost you to lose that message.

If this is a local site for a are in another country far away from Russia then it might be a small inconvience to you and you lose contact with someone. However if you are a site covering a more widespread are and say need to do business in Russia losing these emails might have a measurable cost in reputation if not money. In this case I think you have to ask the business owner how much it would cost to lose that contact and also tell them how much it would save to filter out the .ru domain an let them make a business decision.

share|improve this answer

I would assess based on where and how you conduct your business communication. If you NEVER conduct business outside of the united States then I would block all other traffic. I have doen this for several small and medium sized companies and I've yet to be called back on having to make an exception for an international address.

share|improve this answer

protected by Community Jan 7 at 9:10

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.