NZ Spammer Shutdown Makes Big Difference

lump writes "A notorious spammer, based in New Zealand, who had his name and other personal info released first in a national newspaper, and then on the web, has shut down his operation, citing harassment. What interests me about this case is that, in the 5 or 6 days since he has supposedly stopped operating, I personally have had one (1) spam email, to an address which had previously averaged around fifty per day. Colleagues report a similar reduction in spam. All I can say is 'excellent.' Hate to say it, but in this case, vigilante type action seems to have had the desired result. This needs to be publicised, as anything which slows down spam can only be a good thing."

Comments

Me too

[Anonymous Coward]

I really have noticed a dramatic decrease in the amount of spam I've received in the past 4-5 days. I figured it was just due to my dilligence with unsubscribing myself to mailing lists but everything just suddenly dropped off.

Re:Me too

[John Seminal]

LOL.

I remember years ago when I responded to the footer "Click here to unsubscribe". Little did I know that was a way spammers varified email addresses. It must have taken me off the $20 for 1 million email addresses, and placed me on the $250 premium list.

Kinda like the footer that spammers had which cliamed their email complied with some HR#1342 blah blah blah. That is when I became suspicious, because I knew something that passed in the house alone was not law.

Are we sure?

[RT Alec]

I have noticed a sharp drop in spam the past few day, too. I attributed that to the recent SoBig.F craze sweeping the nation (and beyond). Is there any definative evidence?

While I am skeptical, I am also hopeful. If he has indeed been the cause of so much of the spam I have seen recently, then this ought to serve as a wake up call to anyone looking to fill his shoes.

Re:Are we sure?

[andrewski]

I have a feeling that the large-time spammers don't really sit around r00+ing boxes to spam with. These guys are transfering gigabytes per day of spam. They are doing so with the blessings and services of hosting companies. The only reason a hosting company has for shutting down a spammer is that they've been blackholed. This is the only thing that works. I have NO pity for folks who also have hosting from these scumbags who are collateral damage. Find a new hosting or colo company or feel the wrath.

The different governments ESPECIALLY the US federal government feels that spam isn't their problem. The only recourse are semi-vigalante operations such as blacklists. God bless 'em.

(P.S. Don't say 'well, how did we know?' You learn when your clients can't get their mail or whatever. You then switch hosting co's to a less scummy operation. Vote with dollars people.)

Re:Are we sure?

[Shdwdrgn]

You have obviously never been on the receiving end of a blacklist. I look at the mailing lists and all I see are a bunch of jerks acting as if the provider is always at fault, and that everybody has a choice who their provider is.

In the past week, I've had some messages start bouncing. A lookup at http://openrbl.org/ shows 0 positives on my IP, yet for some reason I'm getting bounces claiming both SPEWS and Osirusoft are rejecting me. It would be nice to find out what's going on, but both of their websites are unaccessible. The only reference I could locate to others in my /24 block was the local Catholic School having an open proxy (NOT an open relay), but no reported spam.

So is my ISP being lax in their anti-spam policy? I could only find 1 report of a known spammer operating from my ISP's address block in the past year, and that one appeared to have been picked up from their purchase of another provider. Sounds to me like they are doing their job.

And don't give me any of this BS about 'well the ISP had their chance to shut down the troublemakers before they were blacklisted.' Where the hell was *MY* chance to do something before *I* got blacklisted?

I've been using ordb and spamhaus to filter incoming mail for the past severl months, but had never really read any of the mailing lists to see what was going on. Quite frankly I'm amazed at the attitudes. The scenario that comes to mind is this... On the block where I live, someone who I have never met gets a DUI while driving (someone spams). The court orders them to attend classes about drunk driving (send a message to ISP to get rid of the problem). The person never attends those classes, so the city takes away the driver's license of EVERYONE on the block (blacklisted). Of course, nobody on my block has any idea what was going on, and if we had, we may have been able to put some pressure on the individual to make changes, but no, the city doesn't care about that.

In my case (with the discovered open proxy), it's a little more incredible... A neighbor lends his car to someone else, and even though that person drove safetly and there were no reported incidents, our whole block has restricted anyway.

I'm going to keep using RBL's on my mail server, but I'm going to do a little more research into who I'm using. It's a great concept, but I've seen too many people on huge power trips now to explicitly trust what they are telling me should be restricted.

sounds like...

[Spytap]

Sounds like we're about to enter the times of the Wild Wild Web, where vigilantism and marshal law run wild....sounds like fun to me!

No wonder...

[TypoNAM]

... I haven't seen much spam in my inbox lately. But yet spam from my hotmail account is just the same, damn Microsoft for using their hotmail users as a spam whore for money. :P

Well,

[SweetAndSourJesus]

there's spam, egg, sausage and spam. That's not got much spam in it.

Anything?

[Anonymous Coward]

"Anything which slows down spam can only be a good thing."

Hardly. Without violating godwin's law, I can think of lots of ways to stop spam that would be a bad thing. Be careful, this is a slippery slope.

So it wasn't AOL's spam filter

[Anonymous Coward]

I was so naive.

I'm not sure about my results

[nocomment]

As I have this in /etc/postfix/body_checks /^Penis/ REJECT /^penis/ REJECT /^Pindick/ REJECT

Related to SoBig perhaps?

[shird]

I might be reaching a bit here, but perhaps the spammers are waiting for the current SoBig infestation to die down. Reasons being;

many people are getting flooded with the crap and where they may just get a few spams and be able to read them, now they are inundated and are trigger happy with the delete key.

Many peoples inboxes are filled and can't accept any e-mail

It also may be that your particular address just happened to be 0wn3d by that particular spammer but not any/many others. There are plenty of other people that are on many other spammers lists.

Just suppose....

[Alpha_Traveller]

...that this kind of thing continues. The same way that sex offenders lives are disrupted by having their names published in communities they move to, we could publish spammer's information here on slashdot.
Oops. we do that already I think...

Realistically though, is this something the US would want to adopt as a deterent? it seems to me way too open for abuse.

But let's suppose we could do that officially. Who is qualified to offically identify a spammer? How easy is it to detect a specific spammer (in terms of the skills required to get to right) and how easy is it to get the skills you'd need to do that? Not that Congress is going to authorize the establishment of an anti-spam unit...are they?

Hate to say it ?

[DeBeuk]

Hate to say it, but in this case, vigilante type action seems to have had the desired result.

Why do you hate to say this ? If governments fail to do anything about spammers, possibly because they don't know how, the only option is vigilantism.
If the only way to stop these guys is to put their names in the paper or mention them on television shows, so be it.

Personally I wouldn't mind seeing them being dragged down the street to be tarred and feathered.

A number of causes

[svvampy]

A much as a two-bit spammer in the South Pacific would love to think that he has such an impact upon the industry, let's be realistic. What about the South Canadian power outage? The various worms and virii that have been circulating? I'd say that maybe some of the filth spewing nodes of our beloved internet have been infected. Also likely is that the recent profusion has probably made some people take a closer look at their PCs and network, eliminating some spam-zombies, or spombies and other sploitz

Re:the "concerned father"

[nlangille]

Its not all bad. At least his children will never know the embarrasments of having a small penis.

NOT a dupe

[sbszine]

Attention Slashdotters! This is a follow-up story, not a dupe. It even links to the older story. This new article is not about the Kiwi quitting spamming. Rather, it's about the noticeable drop in spam since he quit, and speculates that his story might have scared other spammers.

Of course, just after he quit Blaster and SoBig hit the net, so it's more likely that the drop in spam is linked to them, e.g.

• People are more cautious about opening random mail because SoBig is on the lose
• Inboxes are stuff full of viruses and anti-virus autoresponder messages, so that there's no room left for spam
• Spammer's machine keeps mysteriously rebooting (my favourite)

NEEDING YOUR IMMEDIATE ATTN PLEASE

[bgeer]

DEAR SIR/MADAM,
MY NAME IS MOHAMMED YASSIN NGABE CURRENTLY PROVIDING INTERNET SERVICE TO SEVERAL WELL KNOWN SPAMMERS. I KNOW THIS LETTER MIGHT SURPRISE YOU BECAUSE WE HAVE HAD NO PREVIOUS COMMUNICATIONS OR BUSINESS DEALINGS BEFORE NOW.

DUE TO A RECENT UNFORTUNATE INCIDENT INVOLVING A GARDEN WEASEL AND MY LARGE BOWEL, I CAN NO LONGER PROVIDE ACCESS TO THESE UPSTANDING ENTREPENEURS. AS A RESULT I MUST REGRETFULLY DISPOSE MYSELF OF THE SPAMHOSTING BUSINESS AND GIVE THE ADDRESSES AND NAMES OF SEVENTY-TWO (72) SERIAL SPAMMERS TO A WORTHY REPLACEMENT HOST.

DUE TO THE SENSITIVE NATURE OF THESE ADDRESSES, AND THE SENSITIVE NATURE OF THE GROSSLY ENLARGED PENISES OF THE SPAMMERS THEMSELVES, I MUST EXCERCISE THE UTMOST DISCRETION IN GIVING AWAY THESE ADDRESSES.

TO ESTABLISH YOUR GOOD FAITH IN THIS TRANSACTION, YOU MUST FIRST SEND ME YOUR NAME, EMAIL ADDRESS(ES), SHAMPOO BRAND PREFERENCE, AND PENIS SIZE.

KINDLY TREAT THIS REQUEST AS VERY IMPORTANT AND STRICTLY CONFIDENTIAL. I HONESTLY ASSURE YOU THAT THIS TRANSACTION IS 100% LEGAL AND RISK-FREE.

MOHAMMED YASSIN NGABE, ESQ.
LAGOS, NIGERIA

Might be another reason

[mdinowitz]

During the last week, while SoBig was flying around, my spam level was exceptionally low. Now that SoBig is basically gone (for now) the spam level has increased almost back to its normal level. Remember the basic rule:
"correlation does not imply causation"
Just because spam levels went down when this guy said he was getting out of the game does not mean that his departure was the cause.

Re:back to the basics

[aXis100]

1) Menu's dont cost me bandwidth or server CPU time.
2) Menu's do not contain sexually explicit or illegal scam material.
3) Reading the menu doesn't cause me to be the permanent target of 100 other restaurants.
4) Menu's may even be usefull.

In concept, they are certainly similar, though junk mail is far less annoying. Here in Australia, you can even put a "No Junk Mail" sign on your letterbox - something you cant do for spam.

Re:back to the basics

[sssmashy]

Does anyone protest when the menu guys flood your doorstep? No... What about when Target or some other megaconglomerate sends bs in the mail that you didn't ask for? doubtable. Spam is no different.

No, I don't protest when the menu guys flood my doorstep... but I might if I got 50 - 150 menus/day.

Or I might protest if the junk mail wasn't just menus and credit card solicitations, but porno, confidence scams and penis enlargers.

Or I might protest if sending junk mail was actually illegal, as spam is.

Or I might protest if I had a sign on the mailbox marked "ABSOLUTELY NO JUNK MAIL" and the mailman or flyer guy went ahead and ignored it.

And I'd be especially ticked off if I couldn't protest: if I couldn't trace problematic junk mail back to an actual business or legal entity that could be held somehow accountable.

The list just goes on and on. The differences between spam and junk mail are obvious and have already been discussed extensively in this forum.

YRO

[black mariah]

Stories posted in the YRO section should have an option to moderate comments as "Paranoid".

Re:National Newspaper??

[cowlum1]

I live in NZ and read the original article. + the followups.

The original article was in the national paper The Herald, around two weeks ago. The original article was only a moderatly sized peice at the back of the paper (IT section). The author had simply had enough of the spam and was also worried for his daughters exposure to things such as viagra. So he went about tracking the spammer down. He eventually found him, rang him and organised an interview. Thus the spammers name appeared within the paper and thus harassemnt began.

So then the spammer become worried for his family .

Re:Leave the spammers alone

[Little Brother]

Ok, I'm going to "express" myself by playing trumpet (no I don't know how the to play according to the official way, I make my own way which I still think sounds good). Oh, and did I mention I was going to express myself outside your bedroom window. Oh, and if you move, I'm moving too and am going to continue "expressing" my self. Still think anything is ok, regaurdless of the effect it has on other people's productivity and happyness, so long is it can be considered, however loosly, expressing one'self?

Re:An idea...

[Little Brother]

Um, what about the people who use the internet anonymously as a form of political expression because they're afraid of retribution if it is known what they're saying? What about the people who want to express things about themselves that, while perfectly legal and healthy, are not in tune with their community's standards and if they were discussing openly could lead to loss of job or even a lynch mob? I think your cure is worse than the disease, although I agree it would cure it.

Re:Leave the spammers alone

[andrewski]

Spam isn't expression. It costs the recipient money. I have no problem with this guy shouting about penis enlargement, showing large penis-enlargement signs, or doing anything.

Besides, your freedom of expression ends where my property starts. Come to my house and start trying to tell me about my penis, and i'll give you about 10 seconds to get the fudge off my property, and after that you'd better hope i'm a bad shot.

Sounds like somebody's a spammer.

Watch the hyperbole

[brooks_talley]

This needs to be publicised, as anything which slows down spam can only be a good thing.

Things which would slow down spam, but which most of us would not consider to be "good things.":

• Massive DoS attacks against root name servers or other infrastructure that significantly impair the operation of the Internet
• "Upstream readers": a new policy where you are charged $1.50 per email sent. Funds go to a government organization which all mail must be routed through. Bureaucrats read your outgoing mail and decide if it's worthy of being on the Internet.
• More to the point: vigilante gangs start killing people who are rumored to be spammers. Thousands of innocents die, but possibly a few genuine spammers as well.

Come on, people. Aren't techies, of all people, smart enough to see that "the ends justify the means" is *not* a valid rationale?

Cheers
-b

Virii is a perfectly cromulent word!

[Medievalist]

There is no such word in either Latin or English. In Latin, "virus" is a collective noun, like 'butter.'

Certainly there is such a word in English - or at least in the Computerese variant; you can find it all over the websites of virus authors and script kiddies. Despite Bishop Berkeley, things don't stop existing just because you don't believe in them.

Why don't you substitute a word in Klingon? You'll still sound just as goofy, but at least you won't be flat-out incorrect.

Because the authors of virii call them virii, and not some Klingon word. The word "viruses" refers to biological organisms, and the distinction is valid and desirable.

Do you insist on calling eight-bit quantities "bites" since there was no English word "byte" before computer programmers decided to make one?

Re:Virii is a perfectly cromulent word!

[RobotRunAmok]

Computerese variant; you can find it all over the websites of virus authors and script kiddies.

We here on earth call that "slang." Every industry, culture, and sub-culture has it. All well and good. Sometimes a slang term gets to be so prevalent it will enter a dictionary and be noted as such (usually with sl.) If the term can really hang on, and/or enter into a mainstream culture beyond it's industry (as "byte" has) it may receive "official, formal" language status. The English language "benchmark" (to borrow the technologist's phrase for a moment) is the OED. I'm sure the folks who edit that are monitoring "virii" very closely *cough*

The word "viruses" refers to biological organisms, and the distinction is valid and desirable.

What, are you making this up as you go along? I give you credit for thinking on your feet. The OED cites several colloquial and figurative uses of "virus" as a rapidly spreading "poisonous influence." It's from this sub-text that computers are said to have viruses. No distinction between non- and biological use exists. Good one, though.

Now back on topic: The previous poster contended that "virii" was a Latin term. It's not. The plural of "virus" in Latin (if one fancies oneself as a dead Roman) is "virus." (I don't know what the plural is in Klingon.) Currently, "virii" is a *slang* term spottily popular among youthful script kiddies for the plural of virus. It is akin to "boxen," only several tiers more dorky as many of its users actually think it has some etymological legitimacy, and is not merely a made-up "play-on-words" word.

Happy to help. Glad you stopped by. First one's free.

Re:The SPEWS attitude (I use, I approve)

[fractalus]

The biggest problem with the blacklist is it cost-shifts, exactly what anti-spammers hate about spam.

Think about it. You are shifting the burden of pressuring an ISP into killing a spammer onto that ISP's non-spamming customers, and you're doing it without advance warning.

Those who blithely talk about "switching hosts" have never had to do it. It just ain't that simple, and it sure as hell isn't free. It means being off the net completely for days--not just e-mail down, but all your services, unless you've got the money for a complete duplicate set of servers.

I have no problem with blacklisting spammers, but I have a major problem with blacklisters who think collateral damage is a good thing or at least nothing to worry about.