The Spam Prevention Early Warning System (SPEWS) was an anonymous, volunteer-operated service that maintained a list of IP address ranges belonging to internet service providers (ISPs) that hosted spammers, were considered spam-friendly, or hosted websites advertised in spam. Internet sites could query the list and use it as an additional source of information when deciding whether to block or filter incoming email. Unlike blocklists that targeted only individual offending addresses, SPEWS deliberately listed wide blocks of address space around a spam source. This caused "collateral" blocking of unrelated customers and was intended to pressure ISPs into removing spammers from their networks. The combination of that tactic, the anonymity of its operators, and the absence of any way to appeal a listing made the service both influential and contentious. A Florida attorney who sued its operators called them "vigilantes of the Internet". For a time, the list was distributed through Joe Jared's Osirusoft service. In August 2003, after months of distributed denial-of-service (DDoS) attacks, Jared closed Osirusoft, although mirror sites kept SPEWS available. The SPEWS database was last updated on 24 August 2006, after which the resource dnsbl.com listed its status as dead. It was succeeded by the service called the Anonymous Postmaster Early Warning System (APEWS) in January 2007.
Operation SPEWS distributed its data as a DNS-based blocklist, so a mail server could check a sending address with an ordinary Domain Name System query during an incoming SMTP connection. A listing typically began with the addresses directly tied to a spam operation and could be widened to a larger surrounding block of address space, with the wider range meant for use in scoring filters rather than outright rejection. Because the maintainers stayed anonymous, listed parties had no one to contact and no formal way to appeal, an arrangement the operators said protected them from harassment and litigation. As SPEWS could list address space pre-emptively and expand entries to whole netblocks, mail from customers with no link to spam was sometimes blocked, and users of the list were generally advised to combine it with other checks rather than treat it as definitive.
Reception and disputes
Criticism Supporters credited SPEWS with pushing negligent providers to act against spammers, while critics argued that pre-emptive listing of large netblocks punished innocent users. The Electronic Frontier Foundation was among those wary of blocklists in general, citing concerns about inaccuracy, while still condemning attacks aimed at shutting them down.
Legal action In June 2002, SPEWS listed the Australian direct-marketing business T3 Direct, run by Wayne Mansfield, together with its ISP, which then suspended the company's access. Mansfield sued Perth anti-spam campaigner Joey McNicol, alleging that McNicol had reported the company's address to SPEWS, but the case was dismissed in October 2002 after Mansfield could not show that McNicol had contacted the list. In April 2003, EMarketersAmerica.org, a Florida non-profit corporation represented by attorney Mark Felstein, sued several anti-spam organisations, among them SPEWS, The Spamhaus Project and SpamCop, along with nine associated individuals, alleging restraint of trade and interference with their members' contracts. Anti-spam activists widely viewed the suit as a SLAPP and as an attempt to identify the anonymous operators of SPEWS. The plaintiff later moved to drop the action, and in October 2003 U.S. District Judge Donald M. Middlebrooks dismissed it with prejudice, although the defendants still had to cover their own legal costs.
Telewest listing In May 2005, SPEWS listed a large amount of address space belonging to the British cable operator Telewest, affecting around 900,000 of its Blueyonder broadband customers after many of their computers were hijacked to send spam. Telewest said it was contacting affected customers to help clean infected PCs and was preparing a security-software package and further network protections, while maintaining that customer email was not in practice being blocked.
Denial-of-service attacks and shutdown From the summer of 2003, several anti-spam blocklists, including SpamCop, Spamhaus and SPEWS, were intermittently knocked offline by DDoS attacks launched in part from networks of compromised "zombie" computers. Joe Jared, who hosted SPEWS data at Osirusoft, said he was hit with floods of up to around a gigabyte of data per second and closed the service in late August 2003. As Osirusoft was shut down, it briefly returned a match for every queried address, which caused mail servers that relied on it to reject all incoming email until administrators reconfigured them. The same wave of attacks forced the closure of other lists, including Ron Guilmette's Monkeys.com. SPEWS itself remained reachable through mirror sites and continued to be updated for several more years.
Successor The SPEWS database has not been updated since August 24, 2006. A successor service calling itself the Anonymous Postmaster Early Warning System (APEWS) appeared shortly after in January 2007, using similar listing criteria and a closely matching website maintained by anonymous operators.
See also News.admin.net-abuse.email (NANAE) The Spamhaus Project DNSBL
References
External links SPEWS.org at the Library of Congress Web Archives (archived 2002-12-02) (Last good archive. Domain is now owned by another entity.) APEWS official website
