Spamware Hiccups

Once again I find my mail server logs filled with crap from a broken spam spewer, illustrating the inner workings of the spam software. In this case it's a snowshoe spammer residing in 66.197.139.208/28

66.197.139.213 - drd309.savvywayze.com
66.197.139.214 - drd310.savvywayze.com
66.197.139.215 - drd311.savvywayze.com
66.197.139.216 - drd312.savvywayze.com
66.197.139.217 - drd313.savvywayze.com

For well over 24 hours, they have been attempting to send email from "<info@##domain_rotation##>" and each time they have been had a 4xx message returned stating that the domain is unrouteable as per the default Exim config.

This shows that the spam software they are using would normally be configured with a range of domains, one of which is used for every message sent out. These computers are obviously misconfigured - either without a list of domains to use, or some kind of stuff up with the token replacement.

These particular spammers have reached my limit of allowable behaviour and are now firewalled from contacting any servers I manage. The state these IPs will be tested once a month for 6 months, then every 6 months thereafter, and only delisted once they no longer host a snowshoe spammer.

Whois info

network:Class-Name:network
network:ID:net-66.197.139.208/28
network:Auth-Area:66.197.128.0/17
network:Network-Name:NET-66.197.139.208/28
network:IP-Network:66.197.139.208/28
network:Organization;I:org-139-8830208-0
network:Org-Name:DMEHosting.com c/o Network Operations Center, Inc.
network:Street-Address:PO Box 591
network:City:Scranton
network:State-Prov:PA
network:Postal-Code:18510-0591
network:Country-Code:US

Looking at the hostname, I decided to look around the other IP addresses in the area and was quite shocked to find EVERY IP address that wasn't assigned to a seemingly legitimate customer was assigned to a snowshoe spammer. Surely, no legitimate host would do this? If I was sent a request to provide rDNS with this kind of smell to it, I'd be telling the customer go take a long walk off a short pier.

The complete list of rDNS lookups for 66.197.139.0/24

66.197.139.0 - none
66.197.139.1 - 66-197-139-1.hostnoc.net.
66.197.139.2 - 66-197-139-2.hostnoc.net.
66.197.139.3 - 66-197-139-3.hostnoc.net.
66.197.139.4 - 66-197-139-4.hostnoc.net.
66.197.139.5 - drd101.powerservz.com.
66.197.139.6 - drd102.powerservz.com.
66.197.139.7 - drd103.powerservz.com.
66.197.139.8 - drd104.powerservz.com.
66.197.139.9 - drd105.powerservz.com.
66.197.139.10 - drd106.powerservz.com.
66.197.139.11 - drd107.powerservz.com.
66.197.139.12 - drd108.powerservz.com.
66.197.139.13 - drd109.powerservz.com.
66.197.139.14 - drd110.powerservz.com.
66.197.139.15 - drd111.powerservz.com.
66.197.139.16 - drd112.powerservz.com.
66.197.139.17 - drd113.powerservz.com.
66.197.139.18 - drd114.powerservz.com.
66.197.139.19 - drd115.majestywest.com.
66.197.139.20 - drd116.majestywest.com.
66.197.139.21 - drd117.majestywest.com.
66.197.139.22 - drd118.majestywest.com.
66.197.139.23 - drd119.majestywest.com.
66.197.139.24 - drd120.majestywest.com.
66.197.139.25 - drd121.majestywest.com.
66.197.139.26 - drd122.majestywest.com.
66.197.139.27 - drd123.majestywest.com.
66.197.139.28 - drd124.majestywest.com.
66.197.139.29 - drd125.majestywest.com.
66.197.139.30 - drd126.majestywest.com.
66.197.139.31 - drd127.majestywest.com.
66.197.139.32 - drd128.majestywest.com.
66.197.139.33 - drd129.majestywest.com.
66.197.139.34 - drd130.majestywest.com.
66.197.139.35 - drd131.majestywest.com.
66.197.139.36 - drd132.majestywest.com.
66.197.139.37 - drd133.majestywest.com.
66.197.139.38 - drd134.majestywest.com.
66.197.139.39 - drd135.majestywest.com.
66.197.139.40 - drd136.mileyfestz.com.
66.197.139.41 - drd137.mileyfestz.com.
66.197.139.42 - drd138.mileyfestz.com.
66.197.139.43 - drd139.mileyfestz.com.
66.197.139.44 - drd140.mileyfestz.com.
66.197.139.45 - drd141.mileyfestz.com.
66.197.139.46 - drd142.mileyfestz.com.
66.197.139.47 - drd143.mileyfestz.com.
66.197.139.48 - drd144.mileyfestz.com.
66.197.139.49 - drd145.mileyfestz.com.
66.197.139.50 - drd146.mileyfestz.com.
66.197.139.51 - drd147.mileyfestz.com.
66.197.139.52 - drd148.mileyfestz.com.
66.197.139.53 - drd149.mileyfestz.com.
66.197.139.54 - drd150.mileyfestz.com.
66.197.139.55 - drd151.mileyfestz.com.
66.197.139.56 - ns1.growmedia.net.au.
66.197.139.57 - ns2.growmedia.net.au.
66.197.139.58 - drd154.mileyfestz.com.
66.197.139.59 - drd155.mileyfestz.com.
66.197.139.60 - drd156.mileyfestz.com.
66.197.139.61 - drd157.morfeast.com.
66.197.139.62 - drd158.morfeast.com.
66.197.139.63 - drd159.morfeast.com.
66.197.139.64 - drd160.morfeast.com.
66.197.139.65 - drd161.morfeast.com.
66.197.139.66 - drd162.morfeast.com.
66.197.139.67 - drd163.morfeast.com.
66.197.139.68 - drd164.morfeast.com.
66.197.139.69 - drd165.morfeast.com.
66.197.139.70 - drd166.morfeast.com.
66.197.139.71 - drd167.morfeast.com.
66.197.139.72 - drd168.morfeast.com.
66.197.139.73 - drd169.morfeast.com.
66.197.139.74 - drd170.morfeast.com.
66.197.139.75 - drd171.morfeast.com.
66.197.139.76 - drd172.morfeast.com.
66.197.139.77 - drd173.morfeast.com.
66.197.139.78 - drd174.morfeast.com.
66.197.139.79 - drd175.morfeast.com.
66.197.139.80 - drd176.morfeast.com.
66.197.139.81 - drd177.morfeast.com.
66.197.139.82 - drd178.jilseyaves.com.
66.197.139.83 - drd179.jilseyaves.com.
66.197.139.84 - drd180.jilseyaves.com.
66.197.139.85 - drd181.jilseyaves.com.
66.197.139.86 - drd182.jilseyaves.com.
66.197.139.87 - drd183.jilseyaves.com.
66.197.139.88 - drd184.jilseyaves.com.
66.197.139.89 - drd185.jilseyaves.com.
66.197.139.90 - drd186.jilseyaves.com.
66.197.139.91 - drd187.jilseyaves.com.
66.197.139.92 - drd188.jilseyaves.com.
66.197.139.93 - drd189.jilseyaves.com.
66.197.139.94 - drd190.jilseyaves.com.
66.197.139.95 - drd191.jilseyaves.com.
66.197.139.96 - drd192.jilseyaves.com.
66.197.139.97 - drd193.jilseyaves.com.
66.197.139.98 - drd194.jilseyaves.com.
66.197.139.99 - drd195.jilseyaves.com.
66.197.139.100 - drd196.jilseyaves.com.
66.197.139.101 - drd197.jilseyaves.com.
66.197.139.102 - drd198.jilseyaves.com.
66.197.139.103 - drd199.jinglesnaps.com.
66.197.139.104 - drd200.jinglesnaps.com.
66.197.139.105 - drd201.jinglesnaps.com.
66.197.139.106 - drd202.jinglesnaps.com.
66.197.139.107 - drd203.jinglesnaps.com.
66.197.139.108 - drd204.jinglesnaps.com.
66.197.139.109 - drd205.jinglesnaps.com.
66.197.139.110 - drd206.jinglesnaps.com.
66.197.139.111 - drd207.jinglesnaps.com.
66.197.139.112 - drd208.jinglesnaps.com.
66.197.139.113 - drd209.jinglesnaps.com.
66.197.139.114 - drd210.jinglesnaps.com.
66.197.139.115 - drd211.jinglesnaps.com.
66.197.139.116 - drd212.jinglesnaps.com.
66.197.139.117 - drd213.jinglesnaps.com.
66.197.139.118 - drd214.jinglesnaps.com.
66.197.139.119 - drd215.jinglesnaps.com.
66.197.139.120 - drd216.jinglesnaps.com.
66.197.139.121 - drd217.jinglesnaps.com.
66.197.139.122 - drd218.jinglesnaps.com.
66.197.139.123 - drd219.jinglesnaps.com.
66.197.139.124 - drd220.jinglesnaps.com.
66.197.139.125 - drd221.kensingtonaves.com.
66.197.139.126 - drd222.kensingtonaves.com.
66.197.139.127 - drd223.kensingtonaves.com.
66.197.139.128 - drd224.kensingtonaves.com.
66.197.139.129 - drd225.kensingtonaves.com.
66.197.139.130 - drd226.kensingtonaves.com.
66.197.139.131 - drd227.kensingtonaves.com.
66.197.139.132 - drd228.kensingtonaves.com.
66.197.139.133 - drd229.kensingtonaves.com.
66.197.139.134 - drd230.kensingtonaves.com.
66.197.139.135 - drd231.kensingtonaves.com.
66.197.139.136 - drd232.kensingtonaves.com.
66.197.139.137 - drd233.kensingtonaves.com.
66.197.139.138 - drd234.kensingtonaves.com.
66.197.139.139 - drd235.kensingtonaves.com.
66.197.139.140 - drd236.kensingtonaves.com.
66.197.139.141 - drd237.kensingtonaves.com.
66.197.139.142 - drd238.kensingtonaves.com.
66.197.139.143 - drd239.kensingtonaves.com.
66.197.139.144 - drd240.kensingtonaves.com.
66.197.139.145 - drd241.kensingtonaves.com.
66.197.139.146 - drd242.lesterfeld.com.
66.197.139.147 - drd243.lesterfeld.com.
66.197.139.148 - drd244.lesterfeld.com.
66.197.139.149 - drd245.lesterfeld.com.
66.197.139.150 - drd246.lesterfeld.com.
66.197.139.151 - drd247.lesterfeld.com.
66.197.139.152 - drd248.lesterfeld.com.
66.197.139.153 - drd249.lesterfeld.com.
66.197.139.154 - drd250.lesterfeld.com.
66.197.139.155 - drd251.lesterfeld.com.
66.197.139.156 - drd252.lesterfeld.com.
66.197.139.157 - drd253.lesterfeld.com.
66.197.139.158 - drd254.lesterfeld.com.
66.197.139.159 - drd255.lesterfeld.com.
66.197.139.160 - drd256.lesterfeld.com.
66.197.139.161 - drd257.lesterfeld.com.
66.197.139.162 - drd258.lesterfeld.com.
66.197.139.163 - drd259.lesterfeld.com.
66.197.139.164 - drd260.lesterfeld.com.
66.197.139.165 - ablate.centpinch.com.
66.197.139.166 - able.centpinch.com.
66.197.139.167 - abye.centpinch.com.
66.197.139.168 - acoustic.centpinch.com.
66.197.139.169 - aegean.centpinch.com.
66.197.139.170 - drd266.questnorth.com.
66.197.139.171 - drd267.questnorth.com.
66.197.139.172 - drd268.questnorth.com.
66.197.139.173 - drd269.questnorth.com.
66.197.139.174 - drd270.questnorth.com.
66.197.139.175 - drd271.questnorth.com.
66.197.139.176 - drd272.questnorth.com.
66.197.139.177 - drd273.questnorth.com.
66.197.139.178 - drd274.questnorth.com.
66.197.139.179 - drd275.questnorth.com.
66.197.139.180 - drd276.questnorth.com.
66.197.139.181 - drd277.questnorth.com.
66.197.139.182 - drd278.questnorth.com.
66.197.139.183 - drd279.questnorth.com.
66.197.139.184 - drd280.questnorth.com.
66.197.139.185 - drd281.questnorth.com.
66.197.139.186 - drd282.questnorth.com.
66.197.139.187 - drd283.questnorth.com.
66.197.139.188 - drd284.questnorth.com.
66.197.139.189 - drd285.questnorth.com.
66.197.139.190 - drd286.questnorth.com.
66.197.139.191 - drd287.questwest5.com.
66.197.139.192 - drd288.questwest5.com.
66.197.139.193 - drd289.questwest5.com.
66.197.139.194 - drd290.questwest5.com.
66.197.139.195 - drd291.questwest5.com.
66.197.139.196 - drd292.questwest5.com.
66.197.139.197 - linux.bigmidia-safira.com.br.
66.197.139.198 - drd294.questwest5.com.
66.197.139.199 - drd295.questwest5.com.
66.197.139.200 - drd296.questwest5.com.
66.197.139.201 - drd297.questwest5.com.
66.197.139.202 - drd298.questwest5.com.
66.197.139.203 - drd299.questwest5.com.
66.197.139.204 - drd300.questwest5.com.
66.197.139.205 - drd301.questwest5.com.
66.197.139.206 - drd302.questwest5.com.
66.197.139.207 - drd303.questwest5.com.
66.197.139.208 - drd304.questwest5.com.
66.197.139.209 - drd305.questwest5.com.
66.197.139.210 - drd306.questwest5.com.
66.197.139.211 - drd307.questwest5.com.
66.197.139.212 - drd308.questwest5.com.
66.197.139.213 - drd309.savvywayze.com.
66.197.139.214 - drd310.savvywayze.com.
66.197.139.215 - drd311.savvywayze.com.
66.197.139.216 - drd312.savvywayze.com.
66.197.139.217 - drd313.savvywayze.com.
66.197.139.218 - drd314.savvywayze.com.
66.197.139.219 - drd315.savvywayze.com.
66.197.139.220 - drd316.savvywayze.com.
66.197.139.221 - drd317.savvywayze.com.
66.197.139.222 - drd318.savvywayze.com.
66.197.139.223 - drd319.savvywayze.com.
66.197.139.224 - drd320.savvywayze.com.
66.197.139.225 - drd321.savvywayze.com.
66.197.139.226 - drd322.savvywayze.com.
66.197.139.227 - drd323.savvywayze.com.
66.197.139.228 - drd324.savvywayze.com.
66.197.139.229 - server1.hireritesolutions.com.
66.197.139.230 - drd326.savvywayze.com.
66.197.139.231 - drd327.savvywayze.com.
66.197.139.232 - drd328.savvywayze.com.
66.197.139.233 - drd329.senicwest.com.
66.197.139.234 - drd330.senicwest.com.
66.197.139.235 - drd331.senicwest.com.
66.197.139.236 - drd332.senicwest.com.
66.197.139.237 - drd333.senicwest.com.
66.197.139.238 - drd334.senicwest.com.
66.197.139.239 - drd335.senicwest.com.
66.197.139.240 - drd336.senicwest.com.
66.197.139.241 - drd337.senicwest.com.
66.197.139.242 - drd338.senicwest.com.
66.197.139.243 - drd339.senicwest.com.
66.197.139.244 - drd340.senicwest.com.
66.197.139.245 - archie.makemeweb.com.
66.197.139.246 - ns1.makemeweb.com.
66.197.139.247 - ns2.makemeweb.com.
66.197.139.248 - drd344.senicwest.com.
66.197.139.249 - drd345.senicwest.com.
66.197.139.250 - drd346.senicwest.com.
66.197.139.251 - drd347.senicwest.com.
66.197.139.252 - drd348.senicwest.com.
66.197.139.253 - drd349.senicwest.com.
66.197.139.254 - drd350.senicwest.com.
66.197.139.255 - none

Thunderbird, Outlook and SSL Certificates for SMTP AUTH

This doesn't have much to do with spam directly, but more to do with running SSL protected SMTP AUTH and webmail servers.

I've been paying $70 to $240 a year for SSL certificates for a long time. Each year, going through the annoying task of validating it with tests that seemed to defy the amount of money I was throwing at them. How on earth can it cost $140 to send an automated email to a role account with a link to click on? Admittedly, sometimes is 2 or 3 emails! How could a blurry set of faxed identification papers possibly be considered enough to prove the non-domain email address was authoritative?

So how does that compare to the free Certificate Authorities? I can sign up for free server and client certificates with CACert or StartSSL and get the exact same level of guarantee that the certificate is legitimate. I get an email to a role account, click on a link and as a result, I can create a base level certificate that prevents 3rd parties from eaves dropping and clients can be relatively secure in thinking that they're connected to the correct host.

Actually, most users wouldn't even think about it that much, but more on that in a second.

Unfortunately CACert still haven't got their Root Certificate included in (m)any operating systems or browsers which means that I would still have to get people to manually installed the Root CA before they can get rid of any warnings. StartSSL however, has been included in Mozilla products and MacOS for a few years (2006?) and Microsoft finally came on board around 22nd September 2009 with a non-security update that included it. (You keep your client computers up to date right?) Opera is the final stickler. Finally, a free CA with some penetration that has a chance to rid us of warnings.

After all, warnings are the only things that users notice! Most end users wouldn't even notice the difference between an insecure connection, normal certificate secured connection and an extended validation certificate connection. People don't notice the little padlock at all, but the thing they do notice is if they get a warning they have to click on every time they visit a site. Removing the warning with a proper rooted certificate is the only thing the end user cares about and you'll be beating your head against a wall until it bleeds to get any more than that out of them.

By reducing the need to pay for every certificate, we can increase the amount of things being encrypted across the internet and hopefully start making things a bit more secure. As demonstrated by the FireSheep plugin for Firefox, everything is in the open on WiFi unless you are using some kind of encryption! Even StartSSL has more highly validated certificates, but at a hugely cheaper rate than a normal provider.

At another provider, every single certificate is validated and charged at a set rate. If you have 20 servers, that's 20 separate charges! When you start heading up the levels of validation at StartSSL, you are charged once for the validation after which you can create multiple certificates for multiple domains under your control. The exception being for Extended Validation certificates since they have different requirements. Overall, certainly a better way to run things than the price gouging of the more mainstream Certificate Authorities.

Given all that, I recently swapped SSL cert providers[1] to StartSSL who use an intermediate signing certificate to separate out the classes or levels of validation. Having never used one configured like this before, I simply installed the certificate like I had for all the previous ones by placing just the certificate content they gave me into a file and restarting everything. Alas, the following errors popped up in Thunderbird and Outlook which had me completely baffled. At least in Thunderbird I could accept the exception and that would be that, but Outlook insisted on popping up a message every time it was opened leading to quite a few complaints.

Thunderbird Error

Certificate Status
This site attempts to identify itself with invalid information

Unknown Identity
Certificate is not trusted, because it hasn't been verified by a recognized authority.

Outlook Error

The SSL Certificate failed one or more certificate validation checks

After much searching around the internet, I found vague mentions of chained certificates and needing to send not only the server certificate to the connecting client, but all Intermediate Certificates as well. I had presumed that because the Root CA was already installed on the client computer, that any Intermediate Certificates would also be installed. After a quick look on a Window 7, Windows XP and Ubuntu 10.x computers, not one of them had the Intermediate, but at least they all had the Root Certificate. Checking with some of the other CA's certificates, this turns out to be rather normal.

Without a local copy of the Intermediates and the hint that I could send more than one in the connection, I simply used cat (or copy in the Windows command line) to create a file that listed each of them in the chain, one after the other. Downloading and including the Root CA isn't necessary here unless you know you will have clients that do not already have it. It is much easier to have a message pop up in a mail client than stepping through downloading and installing a Certificate from scratch.

The StartCom Root CA: https://www.startssl.com/certs/ca.pem
The StartCom Class 1 Intermediate Server CA: https://www.startssl.com/certs/sub.class1.server.ca.pem

Once downloaded, combine them into the one bundle, ready to be served out to connecting clients.

cat server.pem ca.pem sub.class1.server.ca.pem > server-combined.pem

On windows, the copy command the command line is just as fast.

copy server.pem + ca.pem + sub.class1.server.ca.pem server-combined.pem

After adjusting the configuration files of all the services to use the new combined certificate file and restarting the services, all the errors when away. I hope this helps someone else having the same problem I did without the hours of trawling the internet looking for tidbits of information to stitch together.

Webmasters! Web Developers! Heed this call!

Stop making your stupid contact forms use whatever random email address the user puts in as the FROM address of the email!

It's been a common spammer tactic for months now to send mail FROM an account TO an account. Most servers have been rejecting these emails for years anyway but it seems that Contact Form developers haven't heard the word yet.

When they try to use a filtering mail service that knocks out these blatant forgeries, as dictated by their carefully thought out SPF records, or because what the spammer entered into their web form was 100% spam, they of course BOUNCE! This bounce then become collateral spam to the innocent 3rd party who had their email address entered into the form, and now all a spammer has to do is use an automated script from his thousands of compromised machines to bounce storm his spam out to the world and ruin your web servers' reputation.

If you have a contact form on your website, please follow these simple guidelines and help make the world a saner place.

• DO NOT TRUST USER INPUT - EVER. Take whatever they entered and sanitise it by only allowing known characters. A person's name should not need to have <script> tags in it. Don't forget about "Bobby'); DROP TABLE students;". For PHP, check out filter_var() which will even validate an email address in one call.


• Use a WORKING email address to send the email FROM and do not allow the user to influence this. Bounces to this address should go to a human so problems can be spotted quickly, or at least some processing script that alerts a human if something is fishy.


• If you can, do not allow the user to influence the TO address ..


• Or if that's the whole point of the form, do not allow users to enter both content AND an email address that the form will send to. This is just asking for abuse.


• DO NOT TRUST USER INPUT - EVER! I'm hoping that has sunk in by now. When using the PHP mail() function, look out for users including the characters "\r\n.\r\n" followed by their own email headers and content. It is a common mailform exploit which should have been weeded out 10 years ago. Keep in mid that the \r\n is not literally, but a single Carriage Return character followed by a single New Line character.
  

Now, if only there was some sort of qualification or test you needed to pass before you were allowed to program on the internet.

Silly spammers

Some of the spam that turns up in my traps stands out from the rest. Not only are they completely useless because they are spam, they are completely useless to the spammer because they screwed up the settings in their spam software. These screw ups give some insight into the working of their spam software.

Over the past few months the abuse of .cn (China) domains has been at pandemic levels[1]. There are several different styles of spam containing these domains differentiated by their template or structure. Some have simply the raw domain name, others include a random page, yet others have a random hostname and a page. While the text content of the email changes dramatically (randomly) between spam runs, the domain structure remains the same.

Spam that enters my traps is usually processed auto-magically by a parsing and checking program. Anything that doesn't fit a previously seen pattern is flagged so that I can have a look and see what has changed. Just the other day I got one that included the following curious looking URI.

http://{symbol[4-6]}.{_2cndomains}/?/{SYMBOL[4-6]}.html

As you can see, this is not a valid URI but instead the raw template text from the spam software. From this we can see why all their URI look the same. The {symbol[4-6]} would normally be substituted for a 4 to 6 letter word (in all the emails I have seen from this group/bot/template) even though it says "symbol". The two instances are evaluated at different times and the word is usually different. {_2cndomains} implies they have a list of .cn domains from which they choose one randomly. Since this URI string occurs anywhere from once to 10+ times in the a single email, we get to see multiple domains in every email.

The end result of all this - If they're using repeating pattern to send out millions (billions?) of spams every day, that pattern can be recreated and used to fight it. Even random characters are a pattern.

[1] http://garwarner.blogspot.com/2009/06/spam-crisis-in-china.html

And the answer is .......

No. Yes, it's no. Not yes, but no. Yes, indeed, email addresses just sitting around in blogspot pages (well at least this one) do not get picked up by the email harvesting spiders. The email addresses on the very poorly linked atarandomdotcom.com website were picked up inside a few months but none of the ones posted in here.

And now, a small update on hunting the best way to get spam. Warning - non-sensical semi rant inbound.

Signing up for all the scams from googling well known anti-malware, and clicking on the ads on facebook has given me a huge stream of "opt-out" & "CAN-SPAM compliant" spammers. They all dutifully provide unsubscribe links but I only have 3 working traps from the hundred or so signups I did so I'm loathe to see if any of them work lest I lose all this wonderful spam, although there is always the possibility it would promote further spams. There are several distinct groups that have somehow ended up with the addresses, most likely through the affiliate agreements that I was never given the opportunity to choose opt-into let alone opt-out.

Each group cycles their postal and main domain every couple days to several months, providing a seemingly endless supply of places I am required to opt-out. If I did start opting out, I'd have a lot of clicking to do. There are ethical qualms with getting spam this way - Is it really spam? Should I be trying to unsubscribe since I do not want this stuff (yet, I really do)?

Quite frankly, the crap I'm getting from those signups is completely and utterly useless. No one in their right mind would ever use any of the "products". Most seem to either be companies that made a poor decision on who to pay to market their product for them, some poor shmucks affiliate program being abused, or further scams. If they were arriving on my normal email account, I'd be pissed off. Someone got my email address in good faith for something I was interested in, and now it's being flooded with things that are not. To that end, I declare it is spam. Not a legal definition, but that's where the line has to be drawn.

If I gather all the information I can from these email addresses and use that information to block emails going to real users, am I doing something wrong? Some user has been silly enough to enter their email address into part 1 of a 2 part web form (part 2 is where you find out that this is going to cost money and that you've just been signed up for the affiliate program with your previous click because it's in the terms of service which you can read here) and they are now going to get flooded with all the same crap as my seeded addresses. Should that user have to try to unsubscribe from all the groups that are now going to be sending him crap? In a perfect world they should be able to go back to that original website and say that they no longer wish to participate and that would be that. Don't laugh - that's how it should be. Alas, that user will now come to me and want it all to stop thank you.

I don't unsubscribe because I want a current list of all the domains and servers in use by those spammers (I really do seem to have gone off trying to call these people anything but spammers regardless of their actual status) so that the user above never has to come to me. When they signed up for whatever it was, they will never get the first email, nor any of the others. If someone really wants it, I can allow that group through to their email address only and still keep everyone else safe and sane.

Is it spam? By definition probably not. Is it wanted? Hell no. Should I unsubscribe? No. I'm just collecting it all without rejecting it and collating information from it. Am I doing something wrong by blocking users from getting this crap in the first place? Hell no! Accessing my mail servers is not a right given to everyone on the planet. It is a privilege extended to those people trusted not to abuse it.

Are spammers data mining the spamtraps and troublesome addresses?

A while back blogspot became a major headache for spam filtering. Spammers were using the free accounts to redirect hapless victims to their scam/pills/phising sites, bypassing the URIBL by using this whitelisted domain.

Thankfully, the URIBL added blogspot to the Grey list and allowed submitters to include the sub-domains in the Black list. The problem subsided, but the spammers had discovered a new source of really annoying URI and they were not going to give up that easily.

The spammers have since spread out to a number of free hosters, the most annoying for me is livefilestore.com. A unique sub-domain turns up in one of my spamtraps at the rate of around 1 per 5 minutes. Most of the domains or emails that turn up in my traps have already been submitted to the lists so I don't have to do much, however these livefilestore domains are always unique and no one else seems to submit the same ones as me.

This brings me back to a previous thought I had regarding these unilimited, unique sub-domains. Back when blogspot spams where at their peak, I noticed that within a day of submiting a sub-domain to the URIBL, the amount of spam received by that trap was reduced to a crawl.

I conducted an experiment at the time of only submitting blodpost sub-domains on a subset of the total spamtraps and was gobsmacked at the fall in the spam load on only the addresses from which I had reported. Just to make sure I wasn't seeing things, I submitted all the domains from all the spamtraps and observed the same dramatic fall on them all.

As a result of this, I stopped submitting blogspot domains to the URIBL for a while and wrote a script that clicked the "flag" button in the navigation bar instead. Spammers being what they are, the spam load on all the spamtraps (and quite a few new ones that still have me scratching my head) increased to the previous load over the next few months. The blogspot staff were relatively swift at removing the offending sites, and I still got my spam to train filters with ;)

Warp forward to the current day and the livefilestore sub-domains (the main domain of which has been listed in Black for over a month now). I seem to have an unlimited supply of spamtraps over quite a few domains since some moron decided to pick up the message ids in my posts to mailing lists and newsgroups as email addresses! For every email I have ever sent to a public forum, I get at least 5 distinct traps. I ended up configuring my mail server to just trap anything sent to an address that looks like a message id. They aren't even close to any legitimate email addresses on the domain so there is no possibility of a typo finding its way into a spamtrap.

The end result of which is that I have a lot of unique traps. Over the past few weeks, those traps have been getting mostly unique livefilestore sub-domains delivered to each of them. There have been a few repeats, but they mostly happen when an email is dilvered to more than one address in a single connection. Upon submission of these sub-domains, there was an increase in the spam load over all, but to different traps. By now, most of the addresses I had seen already, had a reported URI on them. It almost seemed like a systematic delivery to every single address to feel them out.

Following the weekend lull, the livefilestore domains started comming thick and fast across all the traps again. They still seem to end up in traps that have never seen spam before, but there are a larger quantity heading to previously well known addresses too. Tentatively probing further addresses while dumping crap on known "working"#1 addresses.

If only they knew that I only get a daily summary and everything else is handled by computer, never to be read by a human and hopefully helping countless humans from seeing their crap :P

So are spammers using unique sub-domains to data mine the location of the email addresses that report them? Are they using this to help increase the effectiveness of their spam runs by avoiding those who would report them? I probably haven't put my story forward well enough to tell, especially since I don't provide raw figures to play with (I don't have the metrics in place to gague things properly). Hopefully, I've put enough of an idea forward for someone to have a think about this and look at their data to see if the same idea fits there too.

... of course, that only works if someone reads this ;) As if!

#1 I permanently reject all messages sent to spamtraps

The crawlies have found my hooks

The seeded address that I lost back in March (Lost in the ether) turned out to be hidden in the most straightforward place - on my home page for the first domain I ever registered.

It has turned out to be one the most successful spamtrap seeds, considerably out-doing the dynamically generated email address present on the same page.

The dynamic address includes a static component as well as the day and IP address of the computer that accessed the page encrypted with a simple Caesar cipher to make it look like a long english address. Enough information to find the all related accesses in the web server logs. Every different host getting a different email address must make it look too fishy for the spammers as I've only recieved one spam on that type of address, while the static address has been getting progressively more emails as the months go on.

Since starting this adventure, only 4 of 50 seeded addresses have given any results at all and only one has received multiple messages. The email addresses I have actually used in the past to subscribe to published mailing lists, bug trackers, and forums have been a consistently strong source of spamtraps. The best ones have always been on well indexed on a number of sites, or included in the source code.

There are a number of other locations I have considered planting seed addresses that I haven't had the opportunity to explore yet, but I expect to play with them in the coming months. They should provide a significantly better success rate.