Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Tech Reporter Pursues Spammer

michael posted more than 9 years ago | from the idle-hands-do-the-devil's-work dept.

Spam 183

girish writes "Technology reporter extrordinaire, Mike Wendland, is at it again tracking down spammers. Wendland conducted the infamous interview with Alan Ralsky, the alleged mega-spammer, a few years ago. That article spawned a lively discussion on Slashdot and eventually resulted in hundreds of pieces of junk postal mail flooding Ralsky's million-dollar home. Now Wendland is using a new tool from a service called Project Honey Pot to track email address harvesters. He posted on his technology blog this morning about catching a company that is holding itself out as a legitimate bulk mailer, but appears in fact to be sending to harvested addresses and conducting on the side some other seemingly seedy businesses. Interesting stuff."

cancel ×

183 comments

The honey is everywhere (2, Insightful)

bigberk (547360) | more than 9 years ago | (#10879624)

Honeypots are lurking all over the net... spammers don't have a chance. They are so indiscriminate and stupid with their harvesting that they are just announcing their presence through a digital loudspeaker, "I AM A SPAMMER".

There might even be some on slashdot! Who knows?!

Re:The honey is everywhere (5, Funny)

commodoresloat (172735) | more than 9 years ago | (#10879629)

There might even be some on slashdot! Who knows?!

That's crazy talk. This place is spam free. And your website can be spam free too! I'll show you how for just $19.95!!

Re:The honey is everywhere (4, Funny)

Phattypants (469233) | more than 9 years ago | (#10879664)

What do you mean? Since I started reading my webmail, I've put all my company's mail-security needs into these miraculous services called hotmail and or yahoo! Why, it was but ten years ago that my penis was two inches shorter! Not only that, but now all of my debt has been consolidated! I can just pass on the tab to my next of kin! I decided contact you, Because I believe you are a reputable person and I feel You can help me and my mother over this confidential matter.

Re:The honey is everywhere (1)

s4m7 (519684) | more than 9 years ago | (#10880278)

That's crazy talk. This place is spam free.

I was spam free until I followed the lst three article links, where the pages promptly scanned my gmail and yahoo cookies and added me to their list.

Oh wait; I pressed "insightful" when I meant to press "funny" on my /. comment generator. here's what I was going for:

No, that's my brother, crazy talk.

darn! (0, Redundant)

xhispage (809513) | more than 9 years ago | (#10879633)

f*ck the spammers! They will ruin the best part of the internet or render it useless!

Re:darn! (1)

drg55 (409730) | more than 9 years ago | (#10879806)

There is one turkey who sends a picture of a guy spreading the cheeks of his ass to posters at a migraine forum (http://s-2000.com/bam/). This turkey continually creates new logins and sends the same picture over and over.

I guess he's just an a**hole!

Unfortunately the administrator seems to be on stress leave.

The spammers also send 100 junk mail per day to an email address of mine which has been rendered unusable.

Personally I think it is not regarded seriously enough as a criminal offence.

Re:darn! (1)

aussie_a (778472) | more than 9 years ago | (#10879953)

I agree. It's people like them that gives porn a bad name.

That's nothing... (0)

cmowire (254489) | more than 9 years ago | (#10879636)

One of my honeypot email addresses has received several trojan horse messages from our friends at the spamhausen.

Re:That's nothing... (-1, Flamebait)

Anonymous Coward | more than 9 years ago | (#10879697)

Way to post stuff that's been posted to one of the linked articles you karma whore

Does it really take that much effort? (1)

Propagandhi (570791) | more than 9 years ago | (#10879637)

Seems to me that this kind of thing should be fairly straight forward. I mean, sending millions of e-mails can't exactly be done "quietly" can it?

Re:Does it really take that much effort? (5, Informative)

Beryllium Sphere(tm) (193358) | more than 9 years ago | (#10879681)

>Seems to me that this kind of thing should be fairly straight forward. I mean, sending millions of e-mails can't exactly be done "quietly" can it?

Sure it can.

Creepy spammer approaches creepy trojan writer. Creepy trojan writer rents creepy spammer access to 10,000 compromised PC's on DSL and cable. Creepy spammer commands each compromised PC to send three emails per minute from 11PM to 7AM. Creepy spammer has now sent 1.44 million pieces of email without an obvious flood anywhere and without an obvious IP address to block.

Re:Does it really take that much effort? (2, Insightful)

Anonymous Coward | more than 9 years ago | (#10879708)

But, with a honeypot address(es), you know it's been harvested, and who the mail was sent for. If you can keep track of all of the people that used the spammer, you may eventually find the spammer through his own ineptitude.

Re:Does it really take that much effort? (1, Funny)

Anonymous Coward | more than 9 years ago | (#10879799)

Creepy slashdot poster unwittingly reveals his creepy plan for spamming...

Re:Does it really take that much effort? (1)

jokumuu (831894) | more than 9 years ago | (#10879989)

But repeat this across a few sites that check the sender, and ith crosscorrelation you can very fast get the addresses of those 10000.

Re:Does it really take that much effort? (1)

Secrity (742221) | more than 9 years ago | (#10880061)

Creepy spammer approaches creepy trojan writer. Creepy trojan writer rents creepy spammer access to 10,000 compromised PC's on DSL and cable. Creepy spammer commands each compromised PC to send three emails per minute from 11PM to 7AM. Creepy spammer has now sent 1.44 million pieces of email without an obvious flood anywhere and without an obvious IP address to block.

After a while this activity develops a pattern that shows which broadband providers to block because they allow this to happen. This causes the IP addresses of the broadband providers who allow this to happen to be place in rbl's for blocking.

Re:Does it really take that much effort? (1)

imsabbel (611519) | more than 9 years ago | (#10880169)

haha. "which broadband provider so block". LOL
How about ALL? Or do you think all people with vulnerable machines are grouped with one ISP, and the crackers only target one?

Re:Does it really take that much effort? (2, Funny)

AndroidCat (229562) | more than 9 years ago | (#10880711)

Don't forget the creepy port scanner who looks for installed trojans and exploits them to install his own software. For months now, every morning at 7:42 & 8:42 EST a port scanner checks ports 5554, 9898, 1023 and 445 using several zombies per scan, mainly from Korean and Japanese IP addresses. (There are plenty of other scanners but none so damned punctual as :42 Zombie Charlie!)

Re:Does it really take that much effort? (0)

Anonymous Coward | more than 9 years ago | (#10880726)

Well, they certainly do put forth some effort due
to the $$$ lost from failed business ventures...

The fellow who owns Seattle Laptop tried to
recruit me to write some scripts and whatnot for
him when he overheard me in his store trying to
buy a laptop sans windows. I chatted him up and
he openly told me he was running a spam server or
three running Linux and he wanted to update and
expand his "business".

I can only guess he needed the money because of
his shite laptop shop...

Oh yeah: http://www.seattlelaptop.com/

I have no fear of spammers (4, Interesting)

MichaelCrawford (610140) | more than 9 years ago | (#10879638)

Harvest this, infidels: A long time ago I decided I wanted to make it as easy as possible for potential clients to email me, so I have never spam-protected my email. It's all over a lot of different websites. It's all over Usenet too.

On the other hand, I get a lot of spam. It's only just beginning to bother me. I have a friend, she gets maybe ten spams a day, and she gets so outraged that she reports them all to the abuse@ addresses and so on. Me, I get a few thousand spams a day. I read my email with elm because it's the only email client that can handle the huge mailboxes I get.

What's getting me down though are the viruses. At one point I was getting 400 MB a day of viruses. Now I've decided I'm going to set up a virus filter on my home linux box, and use fetchmail and spamassassin and clamav and what have you to filter it, and serve it with imap to my other computers.

My hosting service tried to filter all the viruses with clamav, but they got so many viruses that it was too much of a CPU load, so now they do only very simple virus filtering, to catch the most obvious viruses without much CPU consumption.

Re:I have no fear of spammers (4, Informative)

bigberk (547360) | more than 9 years ago | (#10879668)

My hosting service tried to filter all the viruses with clamav, but they got so many viruses that it was too much of a CPU load
This is why renattach exists [pc-tools.net] . You run that baby in kill mode, and you can handle millions of viruses a day without breaking a sweat (load average wise). This filter just drops mail when certain types of attachments (by file extension or file names inside a ZIP attachment) are found. Not as proper protection as a virus scanner, but coupled with spamassassin it will do the job.

Harvesting? (0)

Anonymous Coward | more than 9 years ago | (#10880292)

bgates@microsoft.com bgates@microsoft.com bgates@microsoft.com
bgates@microsoft.com [mailto] Don't harvest me! [mailto] Bill Gates [mailto] E-mail [mailto] email [mailto]

I also have no fear (3, Funny)

Pseudonym (62607) | more than 9 years ago | (#10879996)

Spam this:

ajb@spamcop.net [mailto]

I figure anyone who spams SpamCop [spamcop.net] deserves what they get.

Re:I also have no fear (0)

Anonymous Coward | more than 9 years ago | (#10880222)

By now, most of the address harvesters probably just add the address ajb@cop.net when they encounter that address.

Re:I have no fear of spammers (1)

jokumuu (831894) | more than 9 years ago | (#10880000)

Well, my "public" email box gets about 5000 spam/virus messages a day having been active for 16 years. But ony a few get through the filters I was forced to setup three years ago. I think that address must be on every spammers list.

Address hiding (3, Interesting)

Craig Ringer (302899) | more than 9 years ago | (#10880234)

I'm in a similar situation - a search [google.com] for 'craig@postnewspapers.com.au' on Google returns a fairly hefty number of hits. Slightly more than your address, in fact :-P

I get massively less spam than you - around 300 a day, though most of it gets stopped dead at the mail gateway by ordb.org and dsbl.org checks. I get about 100 or so spam actually delivered, and SA (set to be pretty forgiving) filters out all but 10 or so per day. I don't envy being in your position.

Viruses, however, are another story. I haven't seen one in six months - it's fantastic. A combination of some postfix rules and ClamAV on the internal (sendmail) mail server did the trick. If you run postfix at your mail gateway, you can get it to check incoming mail for suspicious filenames before it even accepts the mail:
main.cf:
-----
mime_header_checks = pcre:/etc/postfix/maps/mime_header_checks_pcre

mine_header_checks_pcre:
----
# Try to kill common Windows executables early, and give a useful message
/^Content-(Disposition|Type):.*name="?([^ >;]*)\.(exe|bat|com|pif|vb|lnk|scr|reg|chm|wsh|js| inf|shs|job|ini|shb|scp|scf|wsc|sct|dll)"?/ REJECT Microsoft Windows Executables (like suspect file "$2.$3") not accepted here. If you were sending a self extracting zip file, please send a non-self-extracting version instead.
(note: the regexp and message are all on one line, though I should move to an extended regex and split it up).

*blam*. There goes 99% of your incoming virus mail. ClamAV gets the rest, so I just don't get viruses anymore. Best of all, you're not generating bounces for virues, you're rejecting them instantly - so unless they're using some dumb bastard to relay, there won't be any mess of bounces to falsified addreses to worry about.

What about the new waves of self-zipping viruses, you ask? Yeah, that's an issue. I cheat and quarantine all zip files. I rarely have to retrieve one, and it's well worth the saved fuss.

As for mail programs, I'm happily using Evolution with IMAP over a 512k/256k effective link to work's Cyrus IMAPd server (all this stuff is set up for work). It works great, and I'm able to use 20,000 message mailboxes without noticable stress. Sieve (the cyrus IMAPd filter language) filters everything into the right mailboxes server-side, so if I'm in a hurry I just read my (always small and managable) INBOX without worrying about my lists.* folders, the (server-side filtered) Junk folder, or anything else.

It's great.

Re:I have no fear of spammers (1)

elgaard (81259) | more than 9 years ago | (#10880442)

>What's getting me down though are the viruses

I can recommend running VirusSnag (http://www.spamless.us/vsnag) before spamassassin.

I know if I had the physical address (-1, Flamebait)

ModernGeek (601932) | more than 9 years ago | (#10879642)

I knew if I had the physical addresses of these spammers, my friends and I would gladly take a road trip and hunt down these spammers. We would break into their homes/offices, and destroy any equiptment that they own, and be sure they aren't able to start back up. Lawsuits aren't going to work, and have proven worthless. There is only one real way to stop such an issue, and that is by physically destroying these peoples property that they earned by exploiting society. I would slash their tires, break their windows, and give the owner of the corparation an old-fashioned ass kicking. I don't see anything unethical about it, I just see the law as the main problem.

Lex Talionis is a morally bankrupt code (-1, Offtopic)

Anonymous Coward | more than 9 years ago | (#10879677)

Why should we be happy when the spammers get spammed? Ponder this.

Lex Talionis, the principle of an eye for an eye, is a morally bankrupt code of law we've been moving away from for the past few thousand years, thankfully. It can't deal with the complexities of the modern legal order, and it ignores all proper justifications for systems of punishment: rehabilitation, prophylaxis, etc. It makes an assertion of rigid judgment in an attempt to avoid judgment itself. We can't live in a world without judgment.

Ask yourself this: should we rape the rapist? If not, why not? (Ignore for a moment that we essentially do rape rapists by committing them to so-called "maximum security" prisons where they get systematically brutalized and raped by guards and other inmates.) It's not a morally tenable position to lower ourselves to the level of brutes just so we can vindicate some idea of retribution.

Therefore, ask yourself why we should be happy when the spammer gets spammed? No one should have to endure the pain and annoyance of spam: it's the scurge of the online world. Not even the spammer, who may be in his business because of factors outside his control like debt or bills for an illness in the family, etc. We should be outraged when anyone is spammed, and we should put the full force of the state and the law against the perpetrator no matter who the victim! Picking and choosing among which victims to protect is something the legal order of former barbaric times did. I'd be disgusted if our government returned to those days.

Spam == bad. Victimization == bad. Why do people conflate the two? What kind of giddy moral superiority to you get from seeing anyone hurt?

Not "Offtopic", but wrong anyway... (0)

Dogtanian (588974) | more than 9 years ago | (#10880256)

Whilst I disagree with much of what you say, I disagree more with the mods who declared this "Offtopic". It's more on-topic than half the comments in your average Slashdot discussion. Anyway...

An individual imprisoning someone else without cause has done A Bad Thing, and should be punished.

Does this mean the state shouldn't imprison someone who has committed a serious crime (including the person just mentioned)?

In general, this means we can't punish anyone because it'd be unfair for anyone to have that happen to them without having done anything wrong.

No one should have to endure the pain and annoyance of spam: it's the scurge of the online world. Not even the spammer, who may be in his business because of factors outside his control like debt or bills for an illness in the family, etc.

Personally, I don't think spamming a spammer would be appropriate punishment, because it doesn't have the same effect as spamming a *large* number of *separate* people. But I disagree with the logic used in your argument against it (see above).

I also disagree with "poor spammer" argument; this could be used to justify all manner of crimes. If the spammer is poor and desparate, this should be taken into account by the courts when sentencing.

And if they're sitting on their lazy ass in a luxurious house with four expensive cars bought on the proceeds of their business, this should also be taken into account.

Spam == bad. Victimization == bad. Why do people conflate the two?

It's not victimisation. It's a punishment "appropriate" to something wrong being done. As mentioned above, I don't think it's as appropriate as it appears at first, but that's beside the point.

Re:I know if I had the physical address (1)

Vash_066 (816757) | more than 9 years ago | (#10879700)

I'd be more than game for this, let me grab my pitchfork and torch!

what does work... (4, Insightful)

bani (467531) | more than 9 years ago | (#10879744)

...is forfeiture laws.

any property used in the commission of a crime (in this case, relay rape, botnets, spamming, etc) is seized and auctioned off to the public.

it's even better than destroying their property -- its taking their property away from them altogether. their home, their car, their computer, everything.

Re:what does work... (1)

ModernGeek (601932) | more than 9 years ago | (#10879787)

Yeah, that idea sounds less illegial, and allows for us to benefit. Think: Cheap servers and cars for all!

Re:what does work... (1)

jokumuu (831894) | more than 9 years ago | (#10880037)

But the problem is, a singl low end PC can send out quit many Spam messages. So the loss of such dos not hurt them a lot.

Re:what does work... (1)

bani (467531) | more than 9 years ago | (#10880659)

im quite sure their house and car will make up for it.

ill gotten gains and all that. all forfeit.

Re:what does work... (1)

Dorsai65 (804760) | more than 9 years ago | (#10880755)

There's currently no penalty for being stupid/careless enough to let a machine be zombie-fied. Why not impound the zombie machines, too, for a while (say a couple months) for "investigation" before returning them. A few stories in the press about how umpteen hundred zombie machines were seized might accidentally motivate more folks into securing their systems.

Re:I know if I had the physical address (1)

sheapshearer (746106) | more than 9 years ago | (#10879749)

I hate spam too, but publically stating that you are pre-meditating a crime is surely one way to ensure you never get spam again.

(Or have access to a computer for that matter).

Re:I know if I had the physical address (-1, Flamebait)

Anonymous Coward | more than 9 years ago | (#10879907)

You're a fucking imbecile who simply can't control himself.

Re:I know if I had the physical address (1)

JaredOfEuropa (526365) | more than 9 years ago | (#10880277)

That's what I miss on the Project Honeypot site statistics! It lists nr. of spams received, servers identified, etc, but I want statistics on the follow-through as well!
- Nr of scumbag spammers identified.
- Nr of bookclubs, cooky sects and mail order firms these spammers have been signed up with.
- Nr of spammers served/sued.
- Nr of spammers drawn & quartered by angry mob.
Come one... inquiring (and vengeful) mind wants to know.

Re:I know if I had the physical address (0, Offtopic)

djdavetrouble (442175) | more than 9 years ago | (#10880470)

I knew if I had the physical addresses of these spammers blah blah blah, links his moderngeek.com website, /me does a quick google or 2, hilarity ensues
Slashthugz. Listen, bad boy... I don't think that you [heathfbla.com] , or your friends [heathfbla.com] have the spammers quaking in their proverbial boots. I would be more scared of getting pwned [aglar.ath.cx] , or molotov cocktailed [jamierector.com] from your types. Nice macquarium [applefritter.com] , though.

OMFG - typical spammer art (-1, Offtopic)

Anonymous Coward | more than 9 years ago | (#10879649)

Check out that typical spammer's site [buy-email-list.com] , they always have these damn images of chumps [buy-email-list.com] in suits [buy-email-list.com] . You're supposed to think to yourself, "damn, it looks like this is the web site of a very professional company". You might wonder if they're damn dirty spammers, but you brush that worry aside because the people in the clipart are dressed so friggin sharp. Fucking marketers 101, they can pester each other in hell for the rest of eternity. Greasy bastards.

spamtraps... (4, Informative)

mmThe1 (213136) | more than 9 years ago | (#10879657)

An relevant note here would be to mention Spamikaze [linux.org] system (intro here [linux.org] ).

In a nutshell, it sets up spamtrap e-mail addresses, and any IP that sends mail to that address is automatically added to the blacklist, and further mails from it are rejected at SMTP level. A false positive can be easily removed from the blacklist manually (example, PSBL [surriel.com] ).

Re:spamtraps... (0)

Anonymous Coward | more than 9 years ago | (#10879680)

In a nutshell, it sets up spamtrap e-mail addresses
We've got something similar here [pc9.org] , if you get lots of spam on a UNIX account (with procmail and cron available), and if you have a very accurate filter, you can submit periodic (e.g. hourly) reports of spammers' IP addresses to our server. This doesn't eat up any additional bandwidth, but really helps out the Internet as a whole by locating new spammers. Contact us if you would like to turn your spammed address into a spamtrap/honeyput :)

The joys of large-scale filtering (4, Interesting)

Anonymous Coward | more than 9 years ago | (#10879684)

the university where I work has some fairly effective spam-killing filters set up.

We frequently see the following interesting fun:
a) People emailing us from blacklisted domains asking what's up. We inform them to complain to their ISP or use a different one.

b) spammers wanting through our filters so they can spam the 20k folks on our network. These are the most fun. I got to watch as the senior network engineer composed a 4000 word message to totally demolish any sort of hope the spammer had, and actually locate the physical address of the spammer. We got an "oh, sorry" reply, and heard nothing since.

Re:The joys of large-scale filtering (3, Interesting)

weijiao (749614) | more than 9 years ago | (#10880300)

To some extent this is delusional thinking that suits the sysadmin - not business.

We, unfortunately, have this situation happen to us from time to time. In the worst cases the email is just dumped (not bounced) and we only find out about it when the client complains.

We are unable to change our ISP because they "own" the building but the real problem is further up line - again it cannot be changed by us or our ISP. Up-line they are presumably too busy running spam for US based spammers to care.

We just explain to our clients that their IT staff are probably not savvy enough to set up a system that detects spam but allows business email through. We refer them to people who are savvy. :-)

Once they realise that their IT person is actually preventing incoming business reaching them, things change.

Universities, of course, remain isolated from commercial pressures.

Hmmm (0)

Anonymous Coward | more than 9 years ago | (#10879689)

Then again Mail providers aren't do as much to stop the proliferation of trojans, let alone spammers. How about not-permitting the sending or receiving of .exe and .vbs attachments. I bet this would cut down nearly 50% of infected computers since many people I know get a virus/trojan through their hotmail or yahoo account because of their ignorance. And if people bitch...read the modified TOS, gotta love those :p

Re:Hmmm (0)

Anonymous Coward | more than 9 years ago | (#10880405)

.exe is scanned by yahoo, I am not sure about .vbs. However, vbs and exe's dont run on my system. They just get passed along.

Re:Hmmm (1)

nolife (233813) | more than 9 years ago | (#10880604)

Hotmail uses Mcafee and Yahoo uses Norton to scan attachments for viruses. I know those scans are not 100% effective but orders of magnatude more effective then your claim of 50% infection from them. I think the people you know that are blaming Hotmail and Yahoo should be blaming themselves or the software on their own computers.

Postfix can help, even with no Spamassassin (2, Informative)

gtoomey (528943) | more than 9 years ago | (#10879716)

I recently changed to Postfix as my Mail Tranfer Agent.

The Postfix Spam Controls [postfix.org] have reduced my spam by 95% without using compex spam filters like Spamassassin.

Re:Postfix can help, even with no Spamassassin (0)

Anonymous Coward | more than 9 years ago | (#10879733)

Then you don't get much spam in the first place.

It's a percentage (1)

Craig Ringer (302899) | more than 9 years ago | (#10880279)

Minor problem: A percentage stays the same if you multiply the base quantity it refers to.

5% is still 5%, whether over 100 messages or 100,000.

I can personally attest to good results with a wee bit of work on my Postfix config. I was unwilling to be as draconian in my policy as this poster must've been, so I was only able to block about 60%.

Re:Postfix can help, even with no Spamassassin (0, Flamebait)

Seraphim_72 (622457) | more than 9 years ago | (#10879773)


Uh...huh ....You let me know when postfix is easier to config than SpamAssassin ... I am betting that you will never call.

Sera

Re:Postfix can help, even with no Spamassassin (1)

gtoomey (528943) | more than 9 years ago | (#10879796)

With Postfix, you just configure the spam controls once. It works straight away. Postfix is VERY easy to install/configure from sourfce.

With Spamassassin, you need to train/fiddle with rules after installation.

Re:Postfix can help, even with no Spamassassin (0)

Anonymous Coward | more than 9 years ago | (#10879904)

Comparing Postfix and Spamassassin is like apples and oranges. Postfix can stop lots of things spammers do but not everything. Those of us with any decent sized domains do use filters, simply because no type of basic checking the SMTP server does can cut it. This is coming from someone who does know what they are tlaking about, and I can assure you postfix alone isn't the end-all solution you make it out to be.

Doesn't make much sense (1)

Craig Ringer (302899) | more than 9 years ago | (#10880295)

It'd be nice if Postfix was as simple as SpamAssassin. Unfortunately, MTAs are complex - mostly because the Internet and eMail are complex, and because of all the ugly hacks and workarounds required to actually get mail to and from lots of the the utterly broken garbage that claim they're mailservers.

Postfix can, however, be a fantastic front line of defence for people who get so much spam that SpamAssassin alone can't cope, or who want to reduce the considerable system loads imposed by running SpamAssassin on a large volume of mail.

If SpamAssassin does the job well enough that learning advanced Postfix configuration isn't worth your time, that's fine. It _is_ worth it for some, though, and those people don't much care that it takes a wee while - they want to make sure they don't lose mail, and they want to save time in the long term by cutting down spam. Those goals are worth a bit of short-term time cost.

Few mail installations are the same, as few sites have the same requirements and make different choices on trade-offs like false positives vs block rates, and compatibility with broken mail servers. This means that Postfix needs to be configurable.

Given just how configurable it is, I think it does a good job of being fairly easy to configure.

Just use a Whitelist (0)

Anonymous Coward | more than 9 years ago | (#10879727)

No spammer is going to authenticate individual messages to get them through a whitelist. Whitelists eliminate 99.9% of spam!

Re:Just use a Whitelist (1)

Eric Giguere (42863) | more than 9 years ago | (#10880249)

True, but if you're in a business (like book writing) where you want people you don't know to contact you, it's far from ideal. That's why whitelists don't appeal to me.

Eric
Palm Database Programming: The Free Electronic Edition [ericgiguere.com]

Spam from Media Dreamland, now from Big Time Fiber (2, Informative)

Serious Simon (701084) | more than 9 years ago | (#10879732)

During the past months I have been receiving on average 3 to 4 spams per day from the IP range of Media Dreamland. These spams are cleverly constructed so that they are difficult to filter out automatically, and as they use a whole range of IP adresses and varying domain names, these are not likely to wind up on a blacklist.

I added rules in my .procmailrc file to block all e-mails from the IP range of this company, this has worked very well for me (100%/0% positives/negatives)

Interestingly, since a few days I was again receiving quite similar spams, and this time they originate from the IP range of a company called Big Time Fiber. It turns out that the spams from Media Dreamland abruptly stopped after 10 november (spammer kicked out?) and after a few weeks the spammer apparently found a new hosting service.

I put the following lines in my .procmailrc:

:0 H
* ^Received:.*\[204\.9\.24[0-7]\.
{
LOG = "[!!!! Big Time Fiber] "
:0
/dev/null
}
and just this morning I found the following entries in my procmail log:

[!!!! Big Time Fiber] From rolffarris@newssign.net Sun Nov 21 00:16:08 2004
Subject: Would you like to stop smoking?
Folder: /dev/null 1550
[!!!! Big Time Fiber] From benniemilburn@minisaver.net Sun Nov 21 01:55:43 2004
Subject: Apple 17" iMac G5 Desktop!
Folder: /dev/null 1705
[!!!! Big Time Fiber] From rhettsmallwood@bigtopsavings.com Sun Nov 21 03:36:04 2004
Subject: Mortgage interest rates are at their lowest point ever.
Folder: /dev/null 1739
[!!!! Big Time Fiber] From bruce.tillery@e-goodstuff.com Sun Nov 21 05:20:55 2004
Subject: Women, something to rock your world
Folder: /dev/null 1565
[!!!! Big Time Fiber] From donovanragland@e-goodstuff.net Sun Nov 21 07:06:03 2004
Subject: Test & Keep an IBM Laptop - Product Testers Wanted
Folder: /dev/null 1623
[!!!! Big Time Fiber] From gilcolvin@bigfoodsavings.com Sun Nov 21 08:46:04 2004
Subject: You can be smart! Folder: /dev/null 1563

As you can see from the type of domain names these spams are probably from one spammer.

In the past I have received spams using the same trick from Webhostplus, Pharmakon and Aphrodite Marketing, but the spammer (now) operating from Big Time Fiber IP range appears by far the most active.

See also http://ws.arin.net/cgi-bin/whois.pl (fill in "204.9.240.164" in the search box)

Re:Spam from Media Dreamland, now from Big Time Fi (2, Informative)

Pathwalker (103) | more than 9 years ago | (#10879789)

As far as I can tell, bigtimefiber is media dreamland.
www.bigtimefiber.com resolves to 69.42.98.5 which resolves to host-98-5.approvednews.com.

A lookup on approvednews.com shows that it is owned by:

Media Dreamland Inc
5546 Camino Al Norte #2-278
N. Las Vegas, NV 89031

Re:Spam from Media Dreamland, now from Big Time Fi (1)

MntlChaos (602380) | more than 9 years ago | (#10879848)

::snip:: Folder: /dev/null ::snip::

::snip:: Folder: /dev/null ::snip::

::snip:: Folder: /dev/null ::snip::

::snip:: Folder: /dev/null ::snip::

::snip:: Folder: /dev/null ::snip::

::snip:: Folder: /dev/null ::snip::


Wow! I think that bit bucket might need to be emptied soon!

Re:Spam from Media Dreamland, now from Big Time Fi (0)

Anonymous Coward | more than 9 years ago | (#10880240)

What? Why?

You work far to hard. Just use Spamhaus' sbl-xbl DNSBL zone and you'll never see this spam from Bill Waggoner.

Oh, if you were in Atlanta last week at the Inboxer show, you could have thanked Bill in person.

What if... (1)

Christopher_Hansen (808762) | more than 9 years ago | (#10879734)

we just ignore spammers, will they go away?

Re:What if... (1)

ForestGrump (644805) | more than 9 years ago | (#10879835)

if "we" as in the slashdot crowd...no. We're peons when it comes to "the world".

If "we" as in the entire world...yes

Re:What if... (0)

Anonymous Coward | more than 9 years ago | (#10880219)

No. There's always some morons that buy crap and spoil it for everyone.

Whois is useless in .AU (1)

MavEtJu (241979) | more than 9 years ago | (#10879741)

Unlike the harvester, there's lots of information about the outfit behind the spam. The whois information points to an Illinois-based direct marketing company, Expedite Marketing Corporation.

Look at the output of "whois foo.com.au". It has absolutely no information at all. Yes, it gives two email addresses, but for the bulk of the domains the information of incorrect or outdated.

Ab-so-lu-te-ly useless if you're chasing problems.

Idea for big honeypot (1)

bigberk (547360) | more than 9 years ago | (#10879746)

What if you find some old domain that used to get substantial mail traffic, but hasn't been used in like 5 years or something (expired). Spammers don't stop sending spam when addresses disappear (contrary to intuition), so if you purchased that domain you would start getting a huge amount of spam, using a wildcard. Also, it would be virtually guaranteed pure spam! Would be neat... anybody know of any old domains like this?

Re:Idea for big honeypot (0)

Anonymous Coward | more than 9 years ago | (#10879774)

That's actually similar to what Brightmail does now (and has actually received a patent [uspto.gov] on).

While that works to get a lot of spam, what seems to be unique about Project Honeypot is that they are actually tracking down the IPs of the harvesters that are stealing addresses. What they could do at some point after they get enough data is create a new kind of RBL. Instead of blocking SMTP traffic they could block HTTP of known harvesters.

Imagine a day when you could safely put your email address back online. Maybe a pipedream, but seems like this service is the first step if it's possible.

Re:Idea for big honeypot (1)

iphinome (810750) | more than 9 years ago | (#10879870)

sure just pay attention to myownemail.com the're bad about renewing, I bought one domain they didn't want because I wanted my email address back. Tons of spam. And tons of complains about spam from people who don't read headers and don't know there's ZERO outgoing mail from the domain

I read the article. (2, Informative)

bs_02_06_02 (670476) | more than 9 years ago | (#10879748)

Curious, I punched up the IP address (69.6.66.17) in my web browser, and I get the default IIS page, telling me there is not a default web page... blah-blah-blah.

So this clown is either stupid and someone really has hacked his box and it's a zombie, or he's playing dead, and has set up the box to appear hacked, and is happily harvesting email addresses anyway. Either way, boxes like these should be shut down. Who leaves an unprotected IIS box exposed to the internet?

I'm curious if anyone is able to resolve that IP address to a street address. It has to be static. Get someone over to that address, see what's going on with this clown.

Ignorance of HTTP 1.1 vhosts (0)

Anonymous Coward | more than 9 years ago | (#10879751)

more than one website can be hosted on a single server with one IP address, so its not at all unreasonable to have a default page when you visit the IP address as the URL.

Re:I read the article. (1)

Christopher_Hansen (808762) | more than 9 years ago | (#10879765)

The default page on my IIS server does not look like that, someone has made it. The line break is grey on mine (not blue) and the 'i' image is much smaller. Not to mention the content is different.

Re:I read the article. (5, Insightful)

Anonymous Coward | more than 9 years ago | (#10879804)

They have a gateway page to keep prying eyes out. I've seen it quite a few times in recent spam. For example, the spammer can include links like:

spamsite.com/?code=A2LKJ34AOD012LNVLA9OO38

The codes can be generated in such a way that they are unique to each message sent (for example, they could be a hash of the TO address). Without a valid code, you get a page like that one you saw. Lets the spammers track who's visiting their sites, and block the prying eyes of anti-spam activists.

I bet there's a good chance that's what's happening here.

Re:I read the article. (1)

hackstraw (262471) | more than 9 years ago | (#10880484)

Whats even worse are spam mails advertising URLs that dont even have a working forward DNS entry (or at least yet).

Fuckers.

Re:I read the article. (1)

Technician (215283) | more than 9 years ago | (#10879813)

Anybody run a trace route to the IP address 69.6.66.17? My pings are stopped at my ISP border. Routing information may give hints to the physical location.

Re:I read the article. (1)

hdparm (575302) | more than 9 years ago | (#10879846)

21 papa.emcmailserve.net (69.6.66.17) 228.349 ms 227.518 ms 227.642 ms

21st hop from Auckland/NZ through AT&T

Re:I read the article. (1)

hdparm (575302) | more than 9 years ago | (#10879857)

Forgot this:

Registrant:
Expedite Media Group
(DOM-1307088)
245 West Roosevelt Rd West Chicago
IL
60185 US
Domain Name: emcmailserve.net
Registrar Name: Alldomains.com
Registrar Whois: whois.alldomains.com
Registrar Homepage: http://www.alldomains.com

Administrative Contact:
Expedite Media Group
(NIC-1586933)
Expedite Media Group
245 West Roosevelt Rd West Chicago
IL
60185 US
abuse@expeditemg.com +1.6308768066 Fax- +1.6308768146
Technical Contact, Zone Contact:
Expedite Media Group
(NIC-1586933)
Expedite Media Group
245 West Roosevelt Rd West Chicago
IL
60185 US
abuse@expeditemg.com +1.6308768066 Fax- +1.6308768146

Created on..............: 2004-Sep-07.
Expires on..............: 2005-Sep-07.
Record last updated on..: 2004-Sep-07 10:20:30.
Domain servers in listed order:
NS.X-DNSSECURE.NET 69.6.66.8
NS.Z-DNSSECURE.NET 69.6.66.2

Re:I read the article. (0, Offtopic)

russint (793669) | more than 9 years ago | (#10879948)

user@localhost:~ $ traceroute -i eth0 69.6.66.17
traceroute to 69.6.66.17 (69.6.66.17), 30 hops max, 38 byte packets

[.....]

7 ge4-2.mpr2.ams1.nl.above.net (195.69.144.122) 23.186 ms 23.444 ms 20.389 ms
8 pos8-0.mpr1.ams1.nl.above.net (208.184.231.181) 137.125 ms 137.798 ms 134.662 ms
9 pos2-0.cr1.ams2.nl.above.net (208.184.231.54) 134.566 ms 148.010 ms 138.338 ms
10 so-5-0-0.cr1.lhr3.uk.above.net (64.125.31.153) 26.930 ms 27.398 ms 27.490 ms
11 so-7-0-0.cr1.dca2.us.above.net (64.125.31.186) 100.744 ms 103.763 ms 107.792 ms
12 so-5-1-0.cr2.ord2.us.above.net (64.125.30.226) 140.395 ms 135.336 ms 134.762 ms
13 so-3-0-0.mpr1.ord7.us.above.net (64.125.30.141) 139.674 ms 135.197 ms 137.216 ms
14 64.125.129.237.available (64.125.129.237) 132.196 ms 128.587 ms 127.335 ms
15 papa.emcmailserve.net (69.6.66.17) 127.711 ms 128.309 ms 129.021 ms

Re:I read the article. (1)

eric1207 (822927) | more than 9 years ago | (#10880531)

the domains Dmkworld.net and E-mrktng.com are hosted off of 69.6.66.17 [according to whois.sc]

whois.sc also traces to like United States - Illinois - Bloomington - Expedite Marketing Corporation or something...

Distributed Harvesting (2, Interesting)

tmk (712144) | more than 9 years ago | (#10879753)

Why should a spammer harvester mail addresses by himself? There are so many viruses, trojans etc out there: The Army Of Lamers can do it for him.

Have a look at this. [sans.org]

This can easily be defeated (2, Informative)

Ge10 (803950) | more than 9 years ago | (#10879812)

All the spammers have to do is to filter out the domains of known honey pots. Even with the donation of additional IP's by vounteers, this would be trivially easy to do.

Re:This can easily be defeated (0)

Anonymous Coward | more than 9 years ago | (#10879849)

In which case, if YOUR domain is one of them, you won't need to worry about spam anymore, will you?

Re:This can easily be defeated (0)

Anonymous Coward | more than 9 years ago | (#10879865)

yep - which is exactly why i just donated an mx entry on the site....

The stakes are getting higher... (1)

Chordonblue (585047) | more than 9 years ago | (#10879820)

You know, I think it's really cool that this guy is getting his jollies going after these scum but he may want to tone down his direct involvement with these people or at least do it more quietly. Why? Until recently, jail time wasn't even discussed as a possible punishment - now it's a harsh reality.

Faced with jail time I wouldn't be surprised to hear of some spammer tracker getting killed (or beat up) for his efforts to report them. We already know the kind of people that are mixed up in spam so it doesn't seem like to far a stretch...

Re:The stakes are getting higher... (2, Interesting)

mOdQuArK! (87332) | more than 9 years ago | (#10880188)

Frankly, I suspect it might be easier to find people who would do that to the spammer...

Education? (3, Interesting)

miyako (632510) | more than 9 years ago | (#10879889)

What I don't understand is, with all of the negative publicity that spam gets, why do people still buy stuff from spammers? Although everyone claims to hate spam, I recall reading an article on /. a while ago that said as many as 10% of people buy stuff from spam, this just seems ridiculous to me. If I were walking down the street and I saw what looked like a delapedated, possible condemned building, and as I walked by 50 guys with crudely made signs ran outside surrounded me screaming "buy our product" I sure as hell would do whatever I could to get out of the situation, spam is the digital equivilent of this, yet people still buy into it. I guess it's that too many people think GIGO means Garbage In Gosple Out. As long as there are people buying the products though, there will never be a technological solution to the problem of spam.
I guess stories like this could help by showing what creeps spammers are, but the only people who are going to read articles like this already know the evils of spam. Perhaps we need to get a bunch of donations and run a commerical during prime time reality tv equating spam to terrorism?
Anyway, sorry for the somewhat offtopic rant, just been rather upset with spam more than usual lately, an email address that i've had for almost 4 years that never got a single spam has finally been getting inundated with it because some fucktard had to go and put my address in a CC with 100 other people for some stupid chain letter, and then one of those machines got pwnd and now the address is out there (BCC PEOPLE, IF YOU HAVE TO SEND THOSE DAMNABLE CHAIN LETTERS TO SO MANY PEOPLE LEARN TO USE BCC FOR $diety SAKE).

Re:Education? (4, Insightful)

adzoox (615327) | more than 9 years ago | (#10880307)

The interesting thing is Slashdot seems to be the #1 place (that I have seen) that readers regularly bash SPAM, but that also participate in one of the the MOST MASSIVE email campaigns I have ever seen - the FREE iPOD DEALS.

Look in just about any thread here on slashdot - you'll see a dozen signatures with people linking to THEIR free iPod link so they can get their required 5 people to join.

What happen is your email is INSTANTLY sold to OptInRealBig when you sign up for this page. OptInRealBIg in turn - is also a harvester - but they can legitimately prove they buy email addresses. So, if quetioned by novice understanding authorities - they can prove they are legit.

Point is - the very people that complain about it [slashdotters] - as far as I can see - are the main contributors to it.

People also fall for these emails from websites like wotch.com that have little funny flash cartoons. People forward these sites to dozens of their friends - which in turn - each of those emails are harvested.

It kinda is like the election scenario - the people that complained the most either didn't vote or couldn't vote!

Re:Education? (2, Informative)

hugesmile (587771) | more than 9 years ago | (#10880431)

There are some SPAM's that will continually entice people, regardless of the amount of education. And unfortunately, I think that there are reputable companies that are unwittingly behind them.

Spammer sends out millions of emails touting an unbelievably low "m or tga ge | r ate". Are you interested in a 30 year, no points fixed 1% interest rate? If you're shopping for a loan, then absolutely.

Suckers check it out. "Want information? Someone will be contacting you shortly. Just give us a little information.. name, phone number." The average person on the street - even SPAM haters - will think "This is probably too good to be true, but I'll check it out with a critical eye... I probably won't finance through this scum, but I better know what the going rate is, so I don't get screwed by my local bank...", and they submit their personal information

Now spammers have a huge list of people shopping for a mortgage. This list is transferred to a semi-legit shell company, who sells it to a completely legit Fortune 500-sized major banking institution. The major banking institution has no idea that these names are collected via SPAM. Under inquiry, the semi-legit company can claim that they "purchase lists of people shopping for mortgages and aggregate them".

Customer gets a call from some Fortune 500 size bank coincidentally asking if they are shopping for a loan, which they are. The Fortune 500 Bank has no clue that there was an offer of 1% 30 year loan, and the sucker has no idea how the major bank got their name. No one's pissed except the 99,999,999 people that were annoyed by the email. And the system continues.

You'll never rid yourself of that problem with education, unless we educate the major companies to consider their sources when buying lists! And even then, since the lists tend to work for the big companies, the problem won't go away anytime soon!

Re:Education? (2, Informative)

fdiskne1 (219834) | more than 9 years ago | (#10880677)

I was giving someone help with their email, saw a spam in their mailbox and commented that if they sent it to me, I'd adjust the filters so it doesn't get through in the future. This was most definitely from a spammer. They said, "No, I ordered something from them. I expect their email." When I told them the reasons they should never, ever buy anything from spam, they said, "But that's where I get the best deals." I re-iterated the reasons against it, but they didn't care. As long as they got a good deal, that's all that mattered to them. I suppose they won't learn until they get taken on one of their "good deals".

Yuhu! (1, Funny)

Anonymous Coward | more than 9 years ago | (#10879911)

That particular spammer offers a newsletter on his homepage. Please wait, I will just sign in...

Contract in the email address (0)

subterranean (22331) | more than 9 years ago | (#10880001)

Timestamped ip addresses will get you closer to the email address harvester, but I have another solution that targets the business claiming that you opted in to their spam. Make contracts in the email address enforceable by law. If you send a message to sender.agrees.to.pay.me.500.usd.for.processing@mys ite.com, I have the option to collect $500 from you.

"hundreds" ? (0)

Anonymous Coward | more than 9 years ago | (#10880139)

resulted in hundreds of pieces of junk postal mail flooding Ralsky's million-dollar home.

So what you're saying, is he gets just as much junk snail mail as the rest of us do? Doesn't sound like we made much impact, to me.

Tracking down a spammer in my home state (4, Informative)

adzoox (615327) | more than 9 years ago | (#10880284)

I have been doing a little tracking down of a Spammer myself from my state.

A few months back, when the free iPod craze started - a company in my state started sending out emails from:

Product Test Panel
Consumer Research Corporation
Subscriberbase.com

Saying, "Product Testers Wanted". They would go from hot product to hot product. Sometimes, not even released products - like the Nintendo DS was advertised almost 2 months ago - claiming immediate shipment.

I found that they were in my state by reading the actual email and seeing a location in my state and then by confirming it with whois information.

I then sent off an email to the contact. I got an email from a guy named Brian Benehaley. In typical fashion, all of my accusations were denied.

Turns out, if you Google this guy's name - he has written a well respected piece [respected amongst bulk emailers] about how the Can Spam Act will bring a new renaissance in email marketing.

I have since written the Better Business Bureau about him, found the record for the company is now in the 1000's of complaints

I have contacted my state attorney general which is conducting thorough investigation

I contacted the host ISP - Exodus - they have over 12000 complaints lodged against Subscriberbase.com

I have written a piece that has gotten into Google searches [blogspot.com] - that receives a few emails and comments each week.

More info about Product Test Panel [adzoox.com]

It has been quite fun to research this guy and put various internet tools to my disposal.

This was a good story to see what techniques Mr. Wendland used.

Google, Whois, MY BLOG, The BBB online, My attorney general all helped me ...

Re:Tracking down a spammer in my home state (1)

hackstraw (262471) | more than 9 years ago | (#10880475)

I used to get spams ALL THE TIME from SubscriberBase. Fortunately, they are located in the US, and after MANY calls to them I convinced them that it was in their best interest to stop sending me spam.

If you get spam from these guys give them a call at:

803-790-8381

Re:Tracking down a spammer in my home state (2, Interesting)

AndroidCat (229562) | more than 9 years ago | (#10880644)

Their history [google.ca] goes back 4 years. Currently on iWay Broadband [spews.org] at 64.119.200.36. Spamhaus has iWay listed [spamhaus.org] , ROKSO for Dan and Rosalee Young / JDR MEDIA [spamhaus.org] , and friend Scott Richter [spamhaus.org] .

Bleh!

How I stay spam free (5, Informative)

Examancer2 (606336) | more than 9 years ago | (#10880325)

This is how I keep spam from ruining my email while also catching spammers in the act:

I have a domain (examancer.com) and a cheap hosting company that allows unlimited email accounts. Every time I give out an email address I make up one that will remind me why I gave it out (like slashdot@examancer.com, nytimes@examancer.com, someotherservice@examancer.com, etc...). I don't actually have to set up each account because I have all undeliverable mail sent right to my main account. If I start receiving spam, I just look at which address its sent to and I know right away which company sold my address or which online forum my email was harvested from. If the spam gets too bad, I actually go and create a real mailbox for that address and route it to a black hole... viola, no more spam.

Re:How I stay spam free (0)

Anonymous Coward | more than 9 years ago | (#10880356)

But there is still spam flowing to someotherservice@examancer.com which is waiting your or your ISP's bandwidth.

Re:How I stay spam free (1)

colin_n (50370) | more than 9 years ago | (#10880399)

I also do this. Sometimes it is tough when spammers spoof the recipient address. How do you know which address it is going to when the header is spoofed? Sorry if that sounds stupid, but I have never been able to figure it out.
By the way - here is a great quote from the spam website:


"I've got one thing to say about Expedite Internet Marketing, WEBTASTIC!"
-- Merry Black

Re:How I stay spam free (1)

Spazzz (577014) | more than 9 years ago | (#10880715)

I do something similar: When I go to a site that requires a valid email address for "confirmation" or whatever, I append the site name to my email address with a + like this: username+slashdot.org@domain.com The email will go to usernam@domain.com and I can tell right away which site sold my email address to spammers. Doesn't keep me spam free, but certainly helps me track it. Alternately, if you run your own email server, you can just set up a one-time alias that's valid long enough to get your confirmation email. -J

Unfortunately (1)

Bloke in a box (781163) | more than 9 years ago | (#10880467)

Unfortunately it's the computer-illiterate people who are are the target of spammers.

They are the ones that don't know how to set up proper spam filters, they are the ones who are stupid enough to give another website their banking details despite having been told by all their friends / family / news reports and other websites never to give their password out.

While there are stupid people with access to a computer out there, spammers will always make a fortune.

Alan Ralsky, the alleged mega-spammer (1)

AndroidCat (229562) | more than 9 years ago | (#10880582)

What's with the alleged part? When Al Ralsky alleges it, and so does everyone else, and there's massive proof that he did, you can skip alleged.

Don't make the mistake that if it's not covered by the U.S. CAN-SPAM law, that it isn't spamming, or that someone has to be convicted in a court of law before they can be called a spammer. He hasn't been convicted of being a major asshole, but it's quite safe to call him that.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...