Slashdot Mirror
Attacking the Spammer Business Model
Stephen Samuel asks: "Spammers spam because it's an 'easy way to make money'. They send out millions of spams knowing that 99.995% of them will be ignored, but the other 0.005% of responses are pure gold (Andrew Leung at Telus has an excellent report on the economics of spam). Responses to mortage spams are reportedly worth $50.00 each. What would happen if, instead of technical and legal approaches, we simply started attacking their business model? If people
started responding to just 1% of the spam we received, spammers would drown in the responses, and the mortage spam responses wouldn't be worth an email, much less $50. The Nigerian Sweet Revenge is an example of this. The nice thing about this sort of statistical approach is that it would start to reward spammers for sending out -fewer- emails. (fewer emails -> fewer bogus responses). What other ways can people think of to attack the spammer business models, and what are the expected downsides of such approaches?" Of course, the one major drawback to this is the likelihood of more spam, since you'll be giving them a valid email address. However, many of you may be receiving increasing amount of spam as it is (even through your filters) so might an organized spam-the-spammers movement work?
The top 1% of spammers who can afford the bandwidth and the hardware could still theoretically handle the volumes of email they would receive. Then they just have to expand their operations to go after the potential business contacts.
Now what about sending them bogus email addresses and phony information? That would send them on a wild goose chase.
Homestarrunner.net -- It's Dot Com!
They work by flooding us with crap, hoping that they get one in a million to answer. We could fight them by flooding them so they have to look through a million emails to find the one legit order. Hmmm...
Sorting through a pile of junk to get the stuff you're looking for. Sound familiar email junkies?
Refuse to make a statement in your sig!
Those are usually just spams sent out to verify valid email address and filter out bounces, etc so they have a "cleaner" (I use that term in a very loose fashion) list to use for their actual "real" spamming operation.
How long will people pay spammers $50 a referral once it becomes clear that 99% of said referrals are for non-existent names and addresses?
It feels good to cost the spammers some money, even if it does waste your time to do it.
...is that the majority of spam I receive has forged headers, so I would in effect be sending the bogus replies to some poor sucker who had no idea their email address was being used as the "From:" header in a major spam operation.
The number of spam emails that get through SpamAssassin because of forged "From:" headers is ridiculous. And worse is the number of bounce messages I get because someone has used my email address as the "From:" header in a massive spam mailout.
Most of the spam I receive doesn't ask me to reply to purchase anything. They simply direct me to a web site of some sort. This eliminates mass-email replies as a possibility. If they use web forms, they can easily tell legitimate orders from phony ones by verifying the credit card numbers, phone numbers, addresses, etc.
It doesn't distinguish between good guys and bad guys. In fact none of the "automatic" schemes mentioned do. Say the spammers decide they hate Paul, they can very easily deliver several spams pointing to his web site/email address/phone number. Remember that the cost of sending extra emails by a spammer is pretty much zero.
The spammers are already picking on the anti-spam people.
So how will your auto-responders etc tell the difference between bad guys and good guys?
Wow, what an easy way to DDoS. Just send out a bunch of Spam with a link to your least favorite website. The spam filters take care of the work for you.
If we all used anonymous remailers, they could simply filter them out and then they would have the legitimate responses. The only way this would work, (and it probably woulnd't unless everyone id it), is for the responses to be as real as possible, from real email addresses. That way they have to spend the time and effort to follow up on the leads. All 10 trillion of them.