How to use TrustedSource.org for online reputation management

Learn how to use TrustedSource and other sites are used to answer questions such as – is someone sending spam that looks like it is coming from my domain, called spoofing? Has my Web site been compromised recently? Do I have an open relay email server that I don’t know about? The Internet is a nasty place, and the idea that a service can be watching globally for exploits is a good one. TrustedSource.org Secure Computing Inc. 55 Almaden Boulevard, Suite 500 San Jose, CA 95113 408.494.2020

Video Transcription

Hello and welcome to another episode of WebInformant.tv. I am David Strom your host and reviewer. Today we look at the area of online reputation reporting and management and review secure Computing’s TrustedSource.org and compare the information you can gleanfrom this site with a few of its competitors. Let us first go to the TrustedSource.org and look up a random domain, say Fidelity.com and see what they report. You will see this nice graphical display that shows you whether or not spammers have taken over the domain and what the overall reputation of the site is. In this case, they can be trusted and they are in the banking category. If you are checking your own site and you disagree with the categorization, you can click here and make suggestions on this page. Going back to the summary, you can see a list of the name servers based on information from top level DNS data. Below that is another chart that shows you the volume of e-mail messages and e-mail servers that are sending e-mails on hourly basis. This up and down variation is what should expect from a legitimate business is mostly 9-5 workers in North America. Below this chart, additional information that can help you verify the authenticity of the domain including when the domain was first registered and started sending e-mails. Spammers like to set up domains more recently and variation in traffic from yesterday and whether the site uses one of the number protective measures for its e-mails such as domain keys and sender Id. Finally is a list of sending IP addresses the servers has logged. You will know that the server has found more than four hundred IPs for this domain. These are all IPs in the fidelity.com domain and could be machines that are not intended to send e-mail. There is a second tool called TrustedSource Intelligence that allows us to also search for spoofers. If you administer this domain, you can use both reports to track down any servers that should not be sending e-mails here. There are links on the left side bar to other resources including recent secure computing blog entries, links to the latest Malware threats and these link to the top sending IP addresses for the last 24 hours which I liked. There is also a lot of information about the storm worm in the special series of pages here. This worm is very much active and continues to morph into new exploits that involved thousands of zombie PCs. What is a suspicious site look like? Let us take a look at nealandnikki.com. Here you see several things that indicate that this is probably a spammer. First, they have this flat line graph that peaks in a day. The domain is relatively new. It just started a few days ago. And this is why TrustedSource has flagged them as suspicious. Now, let us show you fro some of the other sites that offer similar servers or so they claim. We go over to senderbase.org which is run by Cisco's IronPort group. Here you see some of the same information including sending IP addresses and some indication of the mail volume that originates from these IPs. Sender base found 26 e-email servers and also shows you whether any of these are presently listed in the real time black hole data base which can be an issue if you own this domain as someone has flagged your server for sending spam. Senderbase also has real time analysis of the top sending IPs, 90% of the worlds e-mail traffic is spam right now. This gives you an idea of who is sending most of it. You go over here and click on the IP addresses on the left and it brings up this report. A third site, has a small amount of information is Blue Coat’s site review that is shown here. We type in the domain that we are interested in looking for. Get the briefest information about the type of business that the domain owner is in without any of the sending IPs or traffic volume data that the other two services offer. Interestingly, when we submitted one of our own websites, strom.com to their service, they characterized it as a shopping site despite the fact that we do not sell anything on that site. Here is the e-mail that we got ba