Spamholes Fighting Spammers

mike9010 writes "A person named I)ruid has come up with an ingenious way to combat those spammers. His program, spamhole, creates a false 'open relay' that the spammer thinks he/she can send messages through. The messages then get sent nowhere, and the spammer has no idea. "spamhole is an open project. Hopefully, through user's and developer's contributions, we will amass a collection of spamhole implementations spanning all commonly used platforms, programming languages, etc. Ease of configuration and use are the primary objectives, for the easier to use by the non-techical layperson the implementations are, the more widely adopted and used spamhole will become.""

Comments

How can this work?

[corebreech]

Spammer will just send email to himself to make sure relay works. The author claims that the defense against this is to allow the spammer limited access in the beginning, but there's no way to uniquely identify the spammer, and in any case, the spammer can just continue to include himself in the mailings, so he'll know when the relay has been configured to deny him access.

This system will only increase the number of open relays out there.

The story of the hare and the briar patch comes to mind. Is this the idea of a spammer who is pleading with us to please not create all these open rel..., er, um, spamholes?

Re:How can this work?

[Amiga Lover]

As the article says


When an SMTP client connects to our spamhole, we note the number of times it has connected before. If this number is below a configurable threshold, we simply redirect it's connection through the spamhole to a real SMTP server and allow it an unmodified session. This provides for any potential 'test' email the spammer may attempt to send through the 'open relay' to verify successful delivery to successfuly pass through the system and be delivered. Many spammers do this to validate their open relays prior to attempting bulk mailings. The downside to this is that a few SPAM emails may actually be delivered by your spamhole. Such is the price to pay for tricking the spammer into continued use of your 'open relay'.


So it's not quite just a dumb smtp receiver, but acts as a real one until the spam starts being sent.

Re:How can this work?

[B1ackDragon]

They're been relying more and more on trojan'd XP machines as well, they'll probably just stick to this method because they can have more machines than they ever wanted, and they can be sure it works (for some time at least.)

It makes me sort of sad. I'm in a unix sysadmin class, and we had a guest speaker in from a major ISP the other day, and to quote him "we've seen our email traffic quadruple over the last year, all spam" "spam is killing the internet."

Doubt if its as bad as all that, but again, the internet would be a heck of a lot better without it.

Re:How can this work?

[Anonymous Coward]

Spammer will just send email to himself to make sure relay works.

Most spammers use automated tools to fire off a huge amount of messages. They wouldn't likely bother with sending a message to themselves.

But if the spammer did decide to validate the server, it means he has to find another open relay. If there are a ton of spamholes out there, and few real open relays, then the spammer will have to waste an enormous amount of time searching for a relay he can use.

This system will only increase the number of open relays out there.

How is that? The spamhole isn't relaying anything... that's sort of the point.

Re:How can this work?

[kinnell]

but acts as a real one until the spam starts being sent

Yes, but if the spammer sends test emails alongside the spam, they won't get through, and he will know it's a spamhole. This system will likely work well until the spammers realise that it is being used, after which it will be easy for them to hack their way around it.

Re:How can this work?

[Anonymous Coward]

Sophisticated spamware sends periodically control messages to a dropbox in hotmail/yahoo/whatever and alerts user if the open proxy appears not really working.

Open relay isn't the problem of net anymore, sophisticated spamware uses open proxies.

Open relays are these days hard to find as most smpt software ave sane defaults these days. OTOH With idiots like analogX proxy authors creating proxies with "default open world wide, not even dangerous ports closed" configuration, there is no sortage of open proxies.

If you really want to blackhole/track open proxy/relay abusers, look at BuggleGum proxypot instead. And prepare to hack it as as spamware tries to adapt the traps setup by people.

Re:How can this work?

[arcanumas]

So, if it will allow a few "tests" to go through, i am afraid that if it were to become popular then a spammer could use many many different servers to send his spam. A few mails each.

Distriuted spamming of some kind :)

Re:How can this work?

[the_mad_poster]

Doubt if its as bad as all that...

I don't. Spam eats up bandwidth just being delivered, even if it gets filtered at the end anyway. Then, you have the idiots that sit and open it and wait for images to load in their HTML-enabled mail clients. Despite this, from a technological standpoint, although it chews up and wastes valuable resources, it won't bring the Internet to a complete screeching halt.

However, look at all the time and money AOL puts out trying to block incoming spam. People always talk about making spam unprofitable for the spammers and someone invariably bitches about the ideas put forth, but how long will it be until there's so much and so varied spam that it's unprofitable to allow users to use e-mail? Eventually, we may well need so many people and tools that it will chew away profits just fighting spam.

That's why I think spammers need to be treated exactly for what they are - a parasitic infection. They just chew up resources but provide nothing in return. They must be inoculated. Make sending unsolicited e-mail a crime (our illustrous guvmint morons took a step in the totally OPPOSITE direction with their "yea, let's legitamize spamming" bill yesterday). If you're convicted of sending mass, unsolicited messages (that is, you can't prove that you were given EXPLICIT permission to send them), make it a felony and make one of the required sentences that you're not allowed to ever tough a computer again. The trick after that, of course, is to get all the spammy Asian and S. American countries to go along and punish spammers as well.

Re:How can this work?

[Urkki]

• I don't. Spam eats up bandwidth just being delivered, even if it gets filtered at the end anyway. Then, you have the idiots that sit and open it and wait for images to load in their HTML-enabled mail clients. Despite this, from a technological standpoint, although it chews up and wastes valuable resources, it won't bring the Internet to a complete screeching halt.

Don't count on it. There are worms that spread to create spam relays, and then those relays send spam. Potentially this leads to exponential growth in traffic...

Re:How can this work?

[zerocool^]

This system will only increase the number of open relays out there.


Plus, for some of the more nazi-esque spam block lists, it can cause MAJOR havoc for your network. I can tell you that this will not be implemented on our network. We've delt with this already... One computer on our network had an open relay for a couple of days, and it caused *.rr.com (road runner cable, HUGE ISP on the right coast) to block ALL MAIL from our /24. It was horrible, we have hundreds of customers who could not get email from us or their clients.

And it was pulling teeth to get us off of that block list. Send email, get response "contact your ISP", sent email explaining we were the ISP, got email "contact your ISP", sent email madly declaring that we can fix it if they'd tell us what was wrong, but with more than 100 computers in that IP range, it was kind of hard to tell who was in trouble, got email "contact your ISP"... etc.

I'm NOT going to put anything on the network that deliberately sends spam, or even looks like an open relay. My business is too important to me.

Thanks, but, no thanks.

~Will

Re:How can this work?

[glassesmonkey]

Talk about arms race.. Now spammers will maintain blacklists for spamholes!

Re:How can this work?

[pipingguy]

Spam eats up bandwidth just being delivered, even if it gets filtered at the end anyway

Yeah, but just think of all the extra bandwidth we'll have once UCE, viruses and scammail are finally banished by the Spamish Inquisition (nobody expects the Spamish Inquisition)!

Re:How can this work?

[Anonymous Coward]

So if there are 9,900 spamholes out there and 100 true open relays, the chances of a spammer picking a spamhole on their first shot is 0.99. Now after a short while, they realize it's a spamhole so they move to another "open relay". Now they have 9,999 choices, of which only 9,899 are spamholes. Their chances of again picking a spamhole is 0.9899 (repeating) and so the chances of them hitting a spamhole on both of their first attempts is 98%.

Now consider a spammer who's hit 100 spamholes searching for the real open relays (this will happen about 36% of the time in this example -- still better than a third of the time.) They've wasted a decent amount of their time trying to send their spew through the spamholes, and they've still got a 0.98 (repeating) chance of hitting another on their 101st chance, assuming they continue.

This system would work not by making it impossible for spammers to find open relays, but by making it improbably for them to do so and therefore forcing them to do more work.

Re:How can this work?

[Marcus Brody]

This is a total Arms Race.

The initial test email would highlight the spammers test email address. All email to this address would then be allowed through the spamhole, giving the impression to the spammer that everything is hunky dory.

However, the spammer may use multiple test addresses, and the spamhole would not then be aware of these.

Therefore the spamhole could check for any addresses that were used frequently/periodically, and mark these as test addresses.

But the spammer could use a more complex set of test addresses.

The spamhole could use a combination of Bayesian filtering with Hidden Markov Models to renumerate potential test addresses with exponentially decreasing returns, such that the k-tuple value Z1 was never equal or above the Nth degree of reductionist SPAM (SPre). This would thus allow network strategist to implement a theory-based approach to network spam usage, thus continuing ad-infintum the ARMS RACE.

The result of this is that both spammers and anti-spammers remain in bussiness, spending exponentially increasing efforts attempting to thwart the efforts of the oposition.

Definition of a game: "A constructed conflict with quantifiable outcomes"

Ever get the feeling that the anti-spammers enjoy this whole malarky just as much as the spammers?

Maybe the answer to spam is this:

STOP wasting money and resources on using incresingly sophisticated anti-spam techniques. Re-direct this money into basic education for users, including short courses on:

1. How to identify a spam (People are proven to be far better at pattern recognition than Bayesian models).

2. How not to click on a spam.

3. How to delete a spam.

If AOL, MSN, and all other involved parties put a concerted effort towards this, then spam would soon get diminishing returns, and hence become increasingly unprofitable.

Re:How can this work?

[Syberghost]

Spammer will just send email to himself to make sure relay works.

Yes, and then when all the spamhole users compare the addresses attempted to send through them, they'll have a valid email address for the spammer.

Re:How can this work?

[FiloEleven]

How about redirecting money into the hiring of Hit Men to get at the root of the problem? After two or three spam queens get knocked off, I think it may dawn upon the rest that spamming isn't such a good idea anymore...

Re:How can this work?

[Morosoph]

Yes, it's an arms race, but each new level makes things pricier for the spammer, making the model less tenable.

IMO, we should ramp the race right up, and make email encrypted by default. Think of the CPU cycles required to send every recipient encrypted mail!

Okay, that seems excessive at present, but this is a "tax" that cannot be ducked. Naturally, the problem remains that such a solution would in fact be illegal in France, and so might be impossible to implement.

Re:How can this work?

[Marcus Brody]

Taking these thoughts further, 99% of spam bussiness is based around "Trolling for Newbies".

We have to think outside the box with the spam problem, and this fact may be a novel way to counter spam. Almost all people i know who have been "conned" by spam had been new and naive email users who had got excited becuase they had recieved email.

We may look down on such users, but we were all naive once, its just that spam wasnt around when most of us lot started using email.

Therefore, I suggest, all email services should provide a useful "introduction to spam" tutorial BEFORE users are given an email address.

Re:How can this work?

[Anonymous Coward]

It would be nice if webmail services has an option "Bounce this message", so the spammer will receive more and more bounces of actually good accounts.

Think about...

on yahoo mail "This message wasn't for you? Is it SPAM? _Bounce it_."

Re:How can this work?

[Darth23]

I saw going to suggest a bullet in the brain myself, though I think some broken bones might work as well.

Re:How can this work?

[msgregory@earthlink.]

Maybe the answer to spam is this:

STOP wasting money and resources on using incresingly sophisticated anti-spam techniques. Re-direct this money into basic education for users, including short courses on:

1. How to identify a spam (People are proven to be far better at pattern recognition than Bayesian models).

2. How not to click on a spam.

3. How to delete a spam.

I think you're underestimating the difference in the average computer user between the strength of will to intelligence and the strength of belief in something for nothing by a longshot.

Re:How can this work?

[Markaci]

STOP wasting money and resources on using incresingly sophisticated anti-spam techniques. Re-direct this money into basic education for users, including short courses on:

1. How to identify a spam (People are proven to be far better at pattern recognition than Bayesian models).
2. How not to click on a spam.
3. How to delete a spam.

Add to that 4. How not to give your email address to spammers.

We have to protect our email addresses. The email-obscuring feature on Slashdot is one way to do so. Another is to teach users that not all websites which request your email aren't going to use it to send spam.

For further reading, "Why Am I Getting All This Spam?"

Re:How can this work?

[Imperator]

No, that's a terrible idea. I'd wager 99% of the {From,Reply-To,Return-Path} email addresses in spam are fake. I know this because my address has been used as the From: address in several spam mailings. I typically find out about it when I get a deluge of NDNs from yahoo.co.kr or something. Encouraging bounces like this would only increase the proportion of SMTP bandwidth used up in relation to spam. It's far better to just /dev/null the spam than to bounce it.

I don't think this will work..

[bonez_net11]

This sounds like a pretty interesting project. One question though, what happens when the spammers themselves get word of this? They will just relay a message through each open relay they find to an account they can check, to see if the message went through. If the message doesn't go through then its a 'blackhole' relay and they will find another one. I just don't see something like this working. Maybe it should save all of the spam and use the messages to update spamassassin filters or something like that. Otherwise it'll be useless. Just my thoughts.

Re:I don't think this will work..

[milosoftware]

But what if there are millions of these spamholes? That would give em spammers a lot of trouble finding the real holes out there.

No place to hide a diamond like in a pile of glass sherds. Finding the diamond is slow and painful work...

Re:I don't think this will work..

[cgranade]

Stopping spam is never the point of any prudent anti-spam action. Instead, anti-spam actions work by reducing the value of spam to spammers. This can be done by reducing click-through, reducing traffic and filtering that traffic which is out there. Always, spam will get through. The only way to combat spam is to reduce the profit margin and increase the time expense so much that it is worthless, and simply bad business to spam.

Re:I don't think this will work..

[bonez_net11]

Yes, that is true. BUT, it would be quite easy to write a script that sent itself messages through a relay, then when/if the message is recieved it would start spamming and sending itself a message every 10 or 50 times or so. If messages start getting lost it would mark that relay as dead and move to the next one. After a few people write this script (there are always many) it would work like clockwork and nobody would really even notice it happening. Remember, there is always a work-around.

Re:I don't think this will work..

[Frisky070802]

One question though, what happens when the spammers themselves get word of this?

Oh, you mean like when they read about it on Slashdot?

Re:I don't think this will work..

[Pedersen]

then when/if the message is recieved it would start spamming and sending itself a message every 10 or 50 times or so

And then, as an added bonus, spamhole could be written to watch for these email addresses. Now we've got a real email address for these bastards...

Re:I don't think this will work..

[RobertB-DC]

reducing the value of spam to spammers. This can be done by reducing click-through, reducing traffic and filtering that traffic which is out there.

That points to an interesting idea. What if you left your relay open, but modified the messages slightly? Munge the URLs, kill the scripts and web-bug images, change all the phone numbers to 800-876-7060. You could even try to de-l33t the subject lines (turn V*1*A*3*R*A back into "viagra"), if possible.

Of course, you'd be violating any number of standards, plus you'd still get blackholed. So take it a step further... create a trojan that looks for open relays and turns them into spam-breaking open relays. Maybe you could then get someone to turn you in to Microsoft and split the reward.

Re:I don't think this will work..

[Savagemutt]

Spam isn't the problem. Fraud is the problem. Legitimate companies don't send spam (or if they do, they usually learn their lesson). What's left is the criminals peddling worthless herbal cures, penis enlarging regimens and committing outright con games like the Nigerian spam. So lets spend a bit more money in the short term on law enforcement. Let's follow the money and put these scumbags in jail. Once the two bit operators understand the seriousness of their offenses, I think the volume will fall off dramatically.

Ok. So it won't stop the garbage coming from countries too poor or too indifferent to enforce the law, but it would help a great deal.

Re:I don't think this will work..

[Smallpond]

Yeah. The address will be ajksajkshs@yahoo.com, now what?

Even if the spamware doesn't detect this now, it will by tomorrow. As a mail admin, I current use 2 RBL blocklists, + hardcoded addresses for serious offenders telesp.net.br and shawcable.net + Bayesian filter. I still get spam in my inboxes.

Spammers aren't stupid, just evil.

Re:I don't think this will work..

[fubar1971]

They will just relay a message through each open relay they find to an account they can check, to see if the message went through

RTFA

From spamhole.net:
When an SMTP client connects to our spamhole, we note the number of times it has connected before. If this number is below a configurable threshold, we simply redirect it's connection through the spamhole to a real SMTP server and allow it an unmodified session. This provides for any potential 'test' email the spammer may attempt to send through the 'open relay' to verify successful delivery to successfuly pass through the system and be delivered. Many spammers do this to validate their open relays prior to attempting bulk mailings. The downside to this is that a few SPAM emails may actually be delivered by your spamhole. Such is the price to pay for tricking the spammer into continued use of your 'open relay'.

The thing that concerns me, is how much of my bandwidth is going to get chewed up receiving all of this spam that does not go anywhere. I mean it is a great idea to trick the spammers, but it is till going to cost me money in bandwidth.

Nice spinoff...

[Glock27]

Now I've got some new invective:

Stick it in your spamhole, pal!

Perfect...

Re:Nice spinoff...

[nickyj]

I thought that my bosses mouth was a spamhole. I guess I was wrong.

Sounds good

[johnburton]

It's not a cure but it's another small tool which might help a little.

Spamming method

[rf0]

This is not a bad idea though it could be abused. However what the author doesn't seem to realise that open relays may only account for 25% of spam. The rest comes via open proxys which mask the connection and mean that the mail server is receiving an SMTP session from a valid IP address. It might help a bit but at the end of the day the only good solution to fix spammers is hit them where it hurts in the pockets.

Of course that is easier said than done

Rus

Re:Spamming method

[Mirk]

at the end of the day the only good solution to fix spammers is hit them where it hurts in the pockets.

Well, I'm told hitting them in the kneecaps can be quite effective too.

Re:Spamming method

[rf0]

Kneecaps are to quick and not painful enough. You want something more drawn out. Prehaps electrodes attached to the testicals

Rus

Re:Spamming method

[swordboy]

Alternatively, you could hit their house. It really is amazing that a spammer would use their home address to register their spam business. In case you were wondering, the delivery joints in this area won't deliver stuff to this address anymore. Mr. Ralsky apparently didn't pay for *any* of the last 500 large with pineapple and andchovie pizzas that were ordered.

It's not going to work...

[SuperDuck]

Just watch the RBL's and ISP's shut down your IP block for having an open relay...

How are they supposed to know the difference between a spamhole and a real open relay?

Re:It's not going to work...

[aborchers]

Just watch the RBL's and ISP's shut down your IP block for having an open relay...

How are they supposed to know the difference between a spamhole and a real open relay?

Don't they test that the relayed mail is actually delivered? ORDB does:

http://www.ordb.org/faq/#mail_accepted

Any tester that doesn't isn't very intelligent...

Re:It's not going to work...

[dorward]

Don't they test that the relayed mail is actually delivered? ORDB does:

http://www.ordb.org/faq/#mail_accepted

Any tester that doesn't isn't very intelligent...

... but as this system lets the first few mails though from a source before blocking them, the tester will be able to send the test message through it - and welcome to RBH.

Re:It's not going to work...

[SuperDuck]

The RBL's might, but having worked for some ISP's (*koff*@home*koff*), I know that they only scan for the open port on 25, they don't actually bother to check the SMTP functionality of the relay.

Re:It's not going to work...

[John3]

His program delivers the first relay attempt to fool the spammer. That means that an open relay test might identify your machine as a spam source.

That may not be a big deal since you wouldn't run this on your actual email server anyway. Most blackholes only list specific IP's and not entire blocks (at least the reliable blackholes don't list entire blocks) just because one IP in the range runs an open relay.

Typical five minutes h4x0r fix

[Rogerborg]

+ Five minutes to implement.
+ It will fool spammers for five minutes.
+ Your ISP will disconnect you after five minutes.

Let's chalk this one up as yet another "nice try, shame about the lack of planning".

Watch out for your ISP

[Anonymous Coward]

I ran a very similar program to see what I would catch.. I caught my ISP, or rather they caught me - they thought I was running a deliberate open relay and sent an email warning me to shut it down. I was pretty surprised they were on to it so quickly (less than 24 hours).

will my head sysadmin allow it?

[dummkopf]

i think it will not work for two reasons:

a) as mentioned before, it is easy to probe the hole to make sure it really works.

b) i seriuosly doubt that the security team of any university and / or company would enable such a hole because then they might get blacklisted and no more email for them...

Nahh, spamd.

[grub]

OpenBSD's spamd actually tarpits the spammer down, then after a looooong held connection sends a 450 (by default) to the spammer to have the spammer-machine retry. I have it running with various autoupdated blackhole lists and very little spam sees my server anymore.

Re:Nahh, spamd.

[arkanes]

I have to say, if I were a professional spammer I'd be using custom SMTP clients that didn't bother with stuff like "standards" and waiting on long timeouts and resending after a 450. All that matters is getting as much mail out as fast as possible, so just skipping hosts that aren't keeping up at a reasonable level would probably be the best option.

HoneyPots

[tomstdenis]

This is basically a honeypot. Various other forms of this exist [like TCP keepalives for as long as possible]. The basic idea is you want to make sure the user thinks its working while wasting their time.

The trick is much like the polution on P2P. People often complain that the stuff they download off P2P is either renamed [e.g. no the thing they were looking for] or of very low quality. This dissuades people from using P2P.

Likewise if lots of people setup fake SMTP servers that don't do anything it will polute the "scene". Possibly make it less attractive for spammers.

Of course what would be nicer is just to snipe the spammers and auction off their property for Quiznos money ;-) [this last comment is aimed at the jerk who is sending the same spam twice to me about all sorts of increased sex crap. It's bad enough you send it once but twice in under 5 mins? In the ban list you go!]

Not going to work

[heironymouscoward]

Spam is moving off open relays and onto pirated home computers. Spammers and virus writers together have already designed a distributed architecture in which they can send emails from hundreds of thousands, possibly millions of 'owned' personal computers.

The solution is to accept that email will become 99.9(n) junk, and that the challenge then becomes to extract the signal, not filter the noise.

One solution I foresee is "data clearing houses" which store-and-forward email, using a reputation management system to rank and score email (and other data, for the problem is general).

Re:Not going to work

[Leffe]

Spammers and virus writers together have already designed a distributed architecture in which they can send emails from hundreds of thousands, possibly millions of 'owned' personal computers.

I won't beleive it until I see the RFC.

Re:Not going to work

[Urkki]

Just go on blacklisting every ISP who can't stop spam originating from their customers. Soon you'll see that ISPs will find ways, such as allowing at most X mails from single user per day, blocking SMTP traffic going elsewhere than their own mail server etc.

Then have a system where an ISP can automatically get themselves removed from the blacklist after 1 day, when they think they've solved the problem. Next time make it 2 days, if they get to the list again, then 3 days etc, perhaps maxing out at about a week.

Oh, and obivously universities etc are ISPs in this context.

Ta dah, no more spam from home PCs.

All it takes is somebody powerful enough deciding that this should be so, and it would happen. There are plenty enough pissed off ISP admins who are itching for an official permission to limit spam traffic to and form their network. A requirement would be even better, then their customers could not even complain or change to the competitor.

For example if EU and US decided this, everybody else would have to follow or lose e-mail communications with economically most important portion of the world.

Sure there would be initial perioid of chaos in e-mail delivery. But then, isn't it a chaos already, if people are talking about internet getting totally broken. Better this than shutting down SMTP port completely at root level routers at some point to prevent complete collapse under the load of SPAM and worms looking for new SPAM hosts...

Please do not run this

[Erik Hensema]

It won't work.

On a small scale it has no impact.

On a large scale the spammer will just send a few 'test' messages through your system and move on to the next. With a million spamholes, a spammer can send a million mails at the least. Great.

Also, you'll get yourself blocklisted by every major DNSBL very soon. They scan for open relays too...

He's reinvented proxypots.

[Chip Salzenberg]

This is nothing new. For example, see Bubblegum Proxypot.

Slashdot, on the cutting edge of last year.

Maybe this is just me being cynical...

[CaptainTux]

I can see this being a great "live" email harvesting tool for some spammers. Setup a spamhole and just sit back and collect the addresses that other spammers try to send to. A good majority of the addresses will be good and you don't even have to waste time harvesting. This could be a windfall for technically savvy spammers with a little time to waste. Good God. Here we go again...

Hmm....

[Alphix]

...has anyone been the target of a spammers affection?

I guess that as soon as they decide that your mail server is open to relaying they will pump their mails as quickly as possible trough to the server...

Wouldn't the bandwidth consumed while pumping all those pr0n mails trough to your server slow your xDSL (or whichever connection you have) to a grinding halt and thus make the project more suited towards those with a fat connection and something to prove?

Re:Hmm....

[Goldenhawk]

Just last weekend... this mea culpa might save someone in /. land some pain.

Had a form.pl script handling all form submissions on our web site. The form submitted its info via sendmail, as well as logging to text files. While the address checking was pretty robust, someone figured out how to overload the contents in a manner that fooled the sendmail into thinking that the contents contained BCC: data.

Fortunately I caught it within about five minutes, thanks to the fact that all submissions are CC:'d to a real address, thus starting a flood of mail. I saw the classic pattern: a test message, a couple revisions, a final draft test message, then the flood of "real" messages. Since I saw it start, I was able to shut down the script (I just killed the Execute permissions).

After the initial test messages, I saw submissions from dozens of different IPs - I assume zombied PCs. It seems that the zombies were programmed to relay form POST submissions, instead of trying to relay mail directly. Smart, since that puts the mail load on a fast server, not a slow dialup PC.

But the really interesting thing was, even after shutting down the script, the flood of submissions continued. I tweaked the form.pl to bounce the requests to another page but the bounce was never followed - indicating to me that the program didn't bother to check the server response to the submission, even for a 404 or 302 response! This continued for around 14 hours, at a rate of about 20-40 hits per minute. Based on the first messages that got through, several hundred addresses were included in each BCC: field.

Suddenly at about T+14 hours, it simply stopped - cold. For the next several hours a few sporadic hits popped up. Haven't seen any since about T+18 hours.

Apparently the spammer assumed his script would succeed once it was successfully started (it WOULD have unless I'd been at the PC). He obviously ran through his entire mailing list "blind". I'm happy to say 13.8 of those 14 hours were wasted, preventing about 7 million spams (14 hrs, 40/minute, 200 addresses each).

As lessons learned, although I'm sure this is old news to most of the /. folks, I'd like to pass along some tips based on my experience.
1) The spammer used our web site's form to build his attack, but then took it to another machine. All subsequent submissions were using a POST method but not from our site's page. No surprise there, but simply checking $ENV{'HTTP_REFERER'} could have prevented 99% of this attack - if not making it pointless to begin with.
2) Sendmail can be fooled into reading BCC: addresses from information after the start of the message body. I don't understand the details, but an obvious preventative is to =~ s/bcc://gi on the message before sendmail gets it. Probably wouldn't hurt to do the same to To: and CC:.
3) Sendmail can be fooled into sending encoded text from an otherwise text-only form. Filter out "Content-Type:" or "Content-Transfer-Encoding:" or "multipart/mixed" or "text/html" before sendmail gets it.
4) If you're watching for abuse, don't rely on looking for multiple hits from one IP - it seems that once you become a target you will likely get a distributed attack.
5) Consider replacing all @ signs... do a s/@/-at-/g on all message fields before sending to sendmail (except of course whatever hard-coded To: is at the start of the message). If all other measures fail, at least you won't get blacklisted, although you might get 7 million "undeliverable" replies.

Re:Hmm....

[Saint Aardvark]

Ah, Formmail.pl, the spammer's friend. Used to work at a small ISP where, sadly, we had copies of Matt's formmail around that would get exploited periodically. Trying to figure out which website was being hit, on a server w/maybe 100 websites and very few of them being logged (that was an extra the customer had to pay for), was nigh-impossible until I was given the root password and tried ngrep. Then I'd replace it with the NMS formmail, which I can recommend w/o hesitation. --Well, almost no hesitation...it's been a while. But it was great: drop it in and everything would work except the spamming.

I've written before about writing a fake formmail. Right now I've got my web server set up so that all requests for formmail (m/formmail/i) get directed to the script; as you can see, I still get hit about once or twice a week. I'd really like to figure out how to tarpit them, but I'm not sure I can do that on a running webserver.

Been there done that...

[SlightOverdose]

We had a spammer exploiting an incorrectly configured formmail.pl on one of our servers. We didnt actually use it, so I replaced it with a fake version that accepted pretended to accept the mail and return 100mb of data as a reply.

Our provider gives us unlimited upstream bandwidth, so it had no real effect on us- however here would have been at least 50gb worth of data used by the time the spammer caught on, so hopefully that cost them some cash. (Although in all likelyhood it was only a minor inconvenience).

Your netblock is at risk

[Space cowboy]

If you put this on your site, and people complain about those 'let through' spams at the start, your entire netblock will be marked as a spammers paradise (and rightly so - how can the RBL's tell the difference?). Goodbye email.

Some RBL's do not allow changes to be made unless you pay a big fee, and you lose the fee if they consider the complaint genuine.

This sounds real risky to me ...

Simon.

Tarpitting

[isa-kuruption]

This is still the best method to "slow down" spammers. Having a listener on port 25 on un unadvertised box waiting for a connection from some random person, knowing this to be a relay checker and/or spammer, then holding onto the connection forever. This is what LaBrea does, but LaBrea does it on a larger scale, for entire subnets w/ open IP addresses, and any port.

Sorta makes you wonder...

[StringBlade]

if a bunch of spammers collect IP addresses of these spamholes and create a blacklist, does Spamhaus have a right to complain then?

Re:For all of you who will say "This won't work"

[Chip Salzenberg]

Some plant, some weed. All farm.

Strange way to combat Spam

[fruey]

While the concept is somewhat interesting at first glance, the people who run spamholes might end up with it costing them a lot of bandwidth and system resources.

• While they are not relaying mail outbound, they are targeting their IP for blacklisting by allowing tests through
• The spammers that do think their relay is valid will then proceed to send thousands of emails via this spamhole, leading to incoming connections peaking very high and a lot of incoming bandwidth being saturated. Outgoing bandwidth will be used in all the ACK packets.
• Most spammers will have some kind of bounce statistics processing, and the really good ones might even seed bad addresses deliberately. So they'll know quite quickly when they get no bounces back at all
• The machines are going to be targetted not just on port 25, as they likely get port scanned, and so be very very vulnerable to other attacks. Running a half-baked spamhole on port 25 is one thing (see above reasons why I disagree with the idea) but then all your other ports had better be locked down... unless of course you're running a honeypot.
• But then, once a honeypot has been attacked once or twice, you better have some time to do serious forensics on it before leaving it open to more and more exploits, you'll find that it's been hacked to run a REAL open relay on some other port!!!

In short, this idea might only work if somehow you could get more spamholes on the net than open relays, and even then it would have to be coordinated by real sysadmins who know their stuff. Clueless admins are (probably) in the majority and whether or not you agree with that little flippant comment, they will surely outnumber the people who have enough time, a spare machine, and bandwidth to run a spamhole.

This guy says that he has 'holed' over 50,000 spam messages. Well, not really. They will be retransmitted. Spending the energy on blocking spam from your users completely is a better bet, I think. Educating people and advocacy is a better bet. Spamholes will be just another 5 minute net curio.

The Power of the Lexicon

[Asprin]

That's not what a 'spamhole' is around *my* office. Pfft!

two potential problems

[tacocat]

I see two potential problems with this approach, one more insipid than the other.

1. Albeit minor, I've now lost my IP port 25 mail server. This is a big problem if I only have one IP address. I would still like to have a mail server, thank you.
2. Spamhole only works as long as it's population is much less than the population of potential open relays. Spam hole will send ~2 emails free to allow some meathead spammer to verify the relay works. After two, or when rate exceeds some value, you /dev/null the traffic. Now you have a really popular tricksy and you have 50,000 spamholes on the internet. This will delivery 50,000 X 2 free test emails. Why not just use that free 100,000 emails to deliver spam instead.

Haven't you only succeeded in sponsoring a low volume spam relay that not only delivers spam, but at such a low per-boxen rate that no one will ever be the wiser for it.

I see that even on your homepage you mention that a few spam emails might get delivered, but you are acting as a relay for a few spam emails times 50,000. You will eventually get blacklisted via OpenRelay RBL's.

I think if you sit down for a day and just watch your email logs, you will find that a lot of spammers don't bother to test a connection for open relay status. They just test by pushing as much email through it that they can as quickly as possible. Daily I have hundreds of attempting mail relay deliveries.

Re:two potential problems

[Aardpig]

Now you have a really popular tricksy and you have 50,000 spamholes on the internet. This will delivery 50,000 X 2 free test emails. Why not just use that free 100,000 emails to deliver spam instead.

Because to send each of those two 'free' emails from each of the 50,000 spam holes, you have to bring up 50,000 separate SMTP connections and send the email text 50,000 times, thus completely maxing out your connection. This is not the way spammers want to work.

Instead, they find high bandwidth open relays, and send a few spams with huge To: lists. It is the open relay which then multiplexes the spams to the multitude of recipients, not the spammer.

To summarize, the 2 (or however many, as long as it remains a small number) 'free' emails permitted by spam hole will be of very little use to spammers, since to reach millions of recipients, they will have to connect to thousands of spam holes, which is too slow to be economical. Spam hole will not create a new spam problem in itself. Whether it will cure the present spam problem is another matter.

Proxy Honeypots been doing this for ages

[gorbachev]

monkeys.com used to have one, until the spammers DDOSed him.

Several other people are still running proxy honeypots with great success. They are a great resource for finding out which ISPs harbor proxy hijacking criminals.

For all of you, who think spammers will check whether the proxy works first, spammers do no such thing. They actively scan for open proxies and immediately start blasting away. That's just like with spamming. You really think spammers check every Email address on their lists is real?

Proletariat of the world, unite to kill spammers. The more painful and slower, the better.

Re:Does it help?

[Steve Cox]

> only until it all goes offshore.

It already is. I live in the UK and the majority of junk emails I receive come from the US, or contain 'offers' from US based companies.

Plan for Spam Prevention

[dcocos]

Since it seems that a lot spam I get comes from my e-mail address being on my homepage, I've toyed with the idea of putting two address up on the page
like dan@example.com and danc@example.com since danc only exists as a harvestable address any messages that show up at danc are compared to the messages in the spool for dan and a 95% or more match pushes them both to the trash. Has anyone else tried this or something similar?

Re:Plan for Spam Prevention

[Dr. Evil]

It's been done. The Vipul's Razor portion of Spamasassin generates signatures from known spam. People feed spam sources into it.

The only problem is that dan@example.com would receive kretiv1y R/\N|)0/\/\][Zed di||erent tipes of spam. Twinkies limes in spain. \/|AGRA \/|AGRA \/|AGRA.

I thought that maybe applying pattern equivalencies, dictionary and grammar checkers to create signatures based upon "real sentences" would improve things, but before I could do it, randomized jibberish like this came out:

danc@example.com would receive kretiv1y R/\N|)0/\/\][Zed di||erent tipes of spam. Spanish onions defeat goliath squirrels. \/|AGRA \/|AGRA \/|AGRA.

Isn't that interesting...

[dcavanaugh]

Run an open relay, the ISP detects it, launches nastygrams and prepares to blast your ass to Mars. Complain to the average ISP about the average spammer, and the spammer is still spamming through the same ISP 6 months later. Hmmmm.

a trap bu tnot a solution maybe

[denisdekat]

Perhaps this can be used to trace them down, I am a tad doubtful that this would really work, however, it could be used to catch folks who test for these and try to use them, thereby identifying potential spammers. Perhaps, a follow up email to ISPs getting them disconnected for life (hehe)?

Just a thought

[fr0dicus]

Everyone being blacklisted for using this might have the nice side effect of making more effective blacklists :)

Re:For all of you who will say "This won't work"

[pridkett]

Well, here's what I've done and it hasn't gotten me on any black lists for running an open relay because I don't.

First, my mailserver runs OpenBSD, this allows me to use pf for my port filtering software. Then each user on the server has a copy of CRM114 installed. This is a very powerful and extremely accurate bayesian classifier. I've gotten 1 piece of spam in the last three months, 0 false positives and it blocks about 150 pieces of spam a day (for my account alone).

For each piece of mail that I receive, the relays involved are entered into relaydb. This wonderful little program logs each mail relay listed in the message. When a relay has 3 times as many bad messages as good messages it is added to the black list. Because I'm using pf, this blacklist is updated in real time to the mail server's pf configuration, which causes spamming hosts to be sent to the tar pits.

I'd estimate the total accuracy rate (defined as non-Type I and non-Type II errors) to be somewhere around 99.95%. User interaction is zero for most of the time, I've got a nice corpus that I train the accounts with. On the off hand that there is an error the user mails the message to themselves and it gets fixed.

So, to summarize:
This idea won't work, you'll get your host marked as an open relay.
This is what I did to kill spam and it does work.

Fed up reading such non-working stuff

[c.herwig]

Everybody is complaining about spam. And at the same time almost everybody comes up with yet another brand-new-weired-looking workaround. Why the hell?

May I suggest just doing a few basic things:
1) Make a law (if your country doesn't have one already) which makes it illegal to send emails with forged FROM fields (= email addresses you don't own)
2) Slightly improve RFC2821 (smtp): Convert the optional ssl layer to a mandatory one. An smtp sender should only allowed to send mail to a server if
a) it uses an ssl encrypted connection and the Hostname in Reverse-DNS matches the name provided with the ssl certificate OR
b) it uses username and password to login into some kind of mailaccount
3) Sue spammers violating law 1) to hell. If you want to find them, you only have to look at the ssl certificate used for the connection.

Yes, I know this prevents everybody from having his own pretty little smtp server. No, I'm perfectly well with that. Use a provider.
Yes, ssl certificates are expensive for now. But any serious provider should be able to afford one.

Re:Fed up reading such non-working stuff

[randombit]

1) Make a law (if your country doesn't have one already) which makes it illegal to send emails with forged FROM fields (= email addresses you don't own)

And when people violate it, you track them down how, exactly? Please explain.

Slightly improve RFC2821 (smtp)

What you term "slightly improve", I would call "change EVERY mail server and client in the world". Oh, wonderful solution. Even if this was pushed through today, it would take years (at best) to happen. As a much smaller-scale example, all new X.509 CAs that comply with PKIX (the IETF X.509 profile) are supposed to start issuing all their certs with UTF-8 on 1/1/04. This is been a requirement of PKIX since at least 1998. Not one single CA is going the change on the cutoff date. Not one. SMTP is thousands of times more widely used than X.509. You are insane if you think this is technically or politically feasible.

Yes, I know this prevents everybody from having his own pretty little smtp server. No, I'm perfectly well with that. Use a provider.

I am very glad you have no ability to carry out any of these actions.

This doesn't solve anything

[RouterSlayer]

there are two major issues unsolved by this.
This does nothing to address the traffic/bandwidth usage. I've seen spammers continue to hit mail servers for several years (yes YEARS) after they were locked out, they just don't care. The bandwidth costs become seriously problematic.

and the second thing, sort of the first, or related, is what the issue never getting addresses about EGRESS filtering.

Now if everyone, or at least every major ISP would actually use egress filtering, the spam problem would be reduced by, probably, at least 80%.

Here we are talking about this same stupid issue years later, with the same stupid suggestions and the same stupid ideas, over and over and over again. But no one listens.

The other way to combat spam is one I mentioned years ago, and on slashdot many times, in fact, almost every time this subject comes up, which, by the way, is getting more and more frequent. Anyhow, it was an online database of known spammers, by domain and IP. Two seperate lists, one IP, one domain. IPs are by class-C (/24) minimum. It would work if it was pseudo-public, and open, and everyone would keep updating it.

but no, people say "yeah, interesting" but does anyone really get involved? no.... sigh...

My predictions: we'll see this spam issue more and more often with more and more so-called "brillant" solutions like honeypots and crap like that. But will anyone really want to *DO* anything about it? nooooo..... and we'll keep talking about it for eons... nobody cares...

Re:This doesn't solve anything

[TiggsPanther]

his does nothing to address the traffic/bandwidth usage. I've seen spammers continue to hit mail servers for several years (yes YEARS) after they were locked out, they just don't care. The bandwidth costs become seriously problematic.

Well, wouldnt merely locking them out cause mail to bounce?
But this Spamhole thing will at least make the Spam disappear at the first relay. Not bounce back. Not propagate on. It'll reduce some of the overall bandwidth usage.

Plus, from a purely users' PoV, whether it saves bandwidth is irrelevant. but if it manages to reduce the crap that hits their Inbox, then it's a good thing.

The database idea is great in theory, but it does sound similar to Blacklists. In so much as they have the same three potential problems.

• (1) Point-of-origin isn't always clear. And that means that either faked domains or open/cracked mailservers may get added. And once on, sometimes it's hard to get off.

  (2) Slightly less major, but there's always the chance that people get erroneously added purposefully - albeit through ignorance/laziness rather than malicious intent.
  Especially if it's automatable, people have been known in the past to just flag up certain senders as Spam. When it's actually legitimate bulk-mail that they just can't be bothered from unsubscribing from.

  (3) As problems with the RBLs have shown in recent times, all such a list/database does is provide a central "target" for Spammers to cripple. Unless there was a way of doing the database distributed, then they'd just get DDoS'd, and targetted by the latest worm payloads.

It's not that I think the idea itself is bad. Just that current implementations do tend to include rather serious flaws.

Tiggs

Another nice "spamhole" project

[Electrode]

spamhole.com!

It lets you set up a temporary forwarding address, which can be very useful for those "free registration" things that just scream "SPAM!".

Same name

[404notfound]

Spamhole is the name of a temporary e-mail redirection service, good for those times when you need to submit an address for a verification code but don't want the company's spam to fill your inbox afterward (why would you?).

The problem is different ISPs

[Sycraft-fu]

Some ISPs are very vigilant. They have a take-no-shit attitude towards SPAM and/or hacking. They'll actively watch for it, shut people down, respond to abuse complaints, etc. Some just don't give a fuck, and won't stop it unless it interferes with their network or someone comes after them with a big enough stick.

So just because you've dealt with an ISP that is in the "don't give a shit" category, doesn't mean there aren't other ones that will be very responsive.

helping spammers... *sigh*

[dakkon1024]

So as the project grows, people will sell lists of these "open relay's" This way, spammers can use different SMTP servers to send there mail, making them more difficult to track. A few IPs and a few email accounts to check when the spam hole stops working, and they could actually use these to there advantage.

Bad-Address Reporting

[waldoj]

As I'm sure many of us that run our own mail servers have found, I've got a good dozen addresses that have never existed to which spammers attempt to send mail. I get hundreds of attempts to send spam to these addresses each day. For a while, I was forwarding these messages to an RBL, but my mail queue just got too huge.

What I would like is a tool that hooks into Postfix (or whatever MTA; I use Postfix) that not only blacklists the sending IPs on my machine, but even reports the sending IP to an RBL. At a bare minimum, this would be a useful tool for me, since it would keep these spammers from proceeding to send spam to any other addresses on my server. At best, this simple method of confirming that a spammer is a spammer could help to reduce spam on the whole.

-Waldo Jaquith

Make it costly for spammers

[lamename]

It seems to me the reason people spam is because it is cheap to do. Sending out hundreds of thousands of emails for next to nothing.

What if everyone who got spam took 5 minutes a day and replied to a few? I am not saying they need to actually be interested in the pitch, but just send a nice polite letter saying you are. Could you send me some info by postal mail? Do you have an 800 number I can call? Could you contact me with greater detail to this question? Now, the spammer has to invest some time and possibly some money.

Millions of people get spam. If a small percentage would do this, would it deter spammers?

Re:I have a better solution

[Urkki]

The problem with this is that it does not solve the problem. It may hide it from you, but it does not solve it. Also, it somewhat requires that you don't need to be reliably contacted by people you don't know.

The actual problem is at least two-fold
1. The actual spam traffic slowing things down, costing core network operators, and this cost getting passed down to ISPs and ultimately end users.
2. The threat to home PCs that get hacked for the purpose of sending SPAM from them.

Filtering or hiding your e-mail may help *you*. But unless you expect every stupid average Joe to do it too, it will not discourage the spammer in the least so the real problem remains.

Try this approach......

[SomeoneGotMyNick]

I don't believe honey pots will be able to solve the problem. I believe in attacking the economics of spam. Make it not worth their while to send it in the first place. Here's one case in point:

I have been the victim of a spam which used my e-mail in the forged From line. I have been receiving all the 'undeliverable' bounces as a result. Of course I got fed up and decided to do some research.

I picked out the origination IP from the header of the attached bounced mails (always valid) and did a port scan on then. I found most of them infected with the Jeem trojan.

Well, this explains the open relay. I gave up complaining to ISP's about their subscribers who have trojaned systems. They don't seem to care. I suppose it's time for vigilante justice.

The Jeem trojan opens up an e-mail relay on a random port and a control connection plus an http proxy on their own random ports. Time to fight fire using the same fire.

After 'safe browsing' the web sites listed in the spam mails, a lot of them have form information (usually requesting credit card info). Why not use a program that uses a trojaned system's HTTP proxy to send invalid data as the form contents. I was able to send URL encoded form content based on the form's fields which easily bypassed the form's javascript validations. In return, I get an expected confirmation screen. Hey, maybe they just got one invalid response.

Now, if this can be done often enough, maybe the ISP will see the traffic and suspend the account of the trojaned system. In the meantime, the source of the SPAM gets a lot of invalid info to filter through. When I say invalid data. I don't mean 'asldfhhfsdf' and such. I mean real looking names, addresses, CC numbers, etc.

I know there are flaws with this idea, but I don't see where it wouldn't start becoming a thorn in their sides. The Jeem trojan can be controlled remotely. I wish I knew the remote commands to turn them off. But, if we use their known trojans against them, maybe they'll turn them off for us.

Why this is a horrible idea.

[dentar]

1: They'll get blacklisted.

2: The spammers will eventually be able to find a way to test it first (like they have with everything else.)

3: It'll just suck up bandwidth and dump it to /dev/null.

4: Even if the idea did work in theory, there won't be enough people believing in the idea to make it actually work.

Re:Does it help?

[TiggsPanther]

I also find (or did a while back) that a lot of Spam originated in Taiwan.

I just started auto-killing anthing from .tw (or, at least from @yahoo.tw).

Instead of putting your address in clear...

[b00le]

try Enkoder (also available as an OS X app), which converts your mailto: link to a javascript thingy which works correctly but cannot be read by bots. It's free.

Surely this idea

[goldcd]

coule be developed a bit more. We all install a spamhole on our PC and then they all P2P themselves together to form, what I have decided to call, a 'Spamnet'
When one of our servers detects a spammer it communicates this to all it's little peer friends and they launch a DDOS for a few minutes. If the same spammer hits the same (or another) node in the Spamnet he gets hit for longer etc.
It's not a perfect idea (and probably illegal) but it would certainly get the attention of whoever is responsible.

Re:Surely this idea

[ender-]

You don't really need to go that far [into illegality], but you're on the right track.
Maybe have a spam-net and when one of the servers detects a spammer, it propagates the offending IP to the rest of the spamnet. You then can use that as an rbl or as firewall rules or whatever for your real mail server.

Ender

This is nothing new...

[KC7GR]

Google for 'honeypot' or 'proxypot.' In fact, Security Focus ran a series of comprehensive articles on honeypots, one of which is here. There's also a huge web site devoted to nothing but honeypots at this link.

Proxypots are a variation of the honeypot idea. A proxypot pretends to be an open proxy server which, instead of actually passing traffic sent to it, simply logs what's going on and sends the actual traffic to a specific destination specified by the proxypot operator. This can be Dave Null's in-box or anywhere else said operator wants.

Details of proxypots may be found here, and here, just to name a couple.

Keep the peace(es).

Track IP addresses, not email addresses

[billstewart]

You don't really need the email addresses, because as another poster pointed out, many of them are forged. What you need are the IP addresses, and traceroutes to find one or two routers upstream to them, because that tells you what ISP the spammer is actually using, so the ISP can either whack their account (if they're a spammer) or get them to clean up their machine (if it's a hijacked zombie.) Sometimes that means the complaints go to the spammer themselves (so your spamhole gets outed), but if you're also hitting their upstream it's a good start.

If you want to get fancy, you can also do a couple of hits on any URL mentioned in the email - you shouldn't robo-complain, because spammers often put real email addresses in the spam as well, but it gets a bit of bandwidth drain, exercises all the URLs that the spammer might be getting clickthrough from (which is likely to get the clickthrough vendor to stop paying the web site or spammer), and generally shakes things up a bit.

PHP and SMTP

[KalvinB]

I have a web-form and use a simple PHP script that is hard coded to go through my mail server and my mail server requires a valid POP3 login from the username you plan to send e-mails with prior to being able to send e-mails with it. You get a short window of time once validated and even then you must send the e-mails from the same IP that validated the user name. So you can't figure out what e-mail address is being used, send a message from the form and then spam away with that e-mail address remotely.

And on top of that the function that sends the e-mail is seperate of the pop3 function so even if you managed to figure out how the script works, you still couldn't abuse it in any way shape or form. All the security depends on the mail server itself.

And then from my form the script that uses the SMTP/POP3 script can only send messages to a single hardcoded address. It also can't do BCC or CC's. I'm considering doing an anonymous e-mailer with it but I need to work out details before jumping off that cliff.

"that was an extra the customer had to pay for"

That should be an extra the customer has to pay to get ACCESS to. You should be logging regardless. It's just diskspace and if the customer isn't paying you can clear the old logs on a X day basis if nothing exciting is happening.

Setting up a secure form mailer is rediculously easy. And with PHP I can use my script anywhere. I don't need to set up funky permissions. I don't know what formmail is doing that could possibly allow it to be hacked in such a way that an attacker couldn't just go right to the mail server and accomplish.

Currently, my log analizer is custom made and logs all formmail attempts sorted by IP. It used to be pretty bad. So much so that I reported a number of people. That's died down now though since they've finally realized I don't have formmail on my server in any form. I don't even have Perl installed on my server anymore. PHP only.

Ben

But you have to wait or SMTP fails

[billstewart]

Maybe you spend some time detecting timeouts and avoiding hosts that don't respond quickly, but you can't overdo that or everybody will add that to their SMTP servers to discourage spammers. But even adding a second of delay at the end of a message is enough to crank your bandwidth drain down a lot and slow down the spammer's average load. And if the spammer is getting a 10:1 multiplier by feeding your relay 10 recipients per message, they won't be surprised if you're only accepting incoming spam at 10-12kbps because that'll fill up your average cable modem or ADSL upstream, and it'll happen by adding random delays to the response time. So go ahead and add a bunch of 100-200ms delays per packet (especially per RCPT TO or per line of message body, since SMTP handles data a line at a time.) If you want to add a bunch of longer delays, see how much you can get away with.