Does SPAM Unsubscribing Really Work?

dacarr asks: "An associate on a mailing list I am on recalled an article (which he, in turn, does not recall), in which the author managed to reduce his spam some 80% by, of all things, using the provided 'unsubscribe' mechanism in the messages. This is totally counterintuitive to what most of us have learned (doing so was a spectacularly good way to actually *confirm* your address) - but perhaps this isn't the case anymore, based on this. Has anyone else had any luck as far as this goes? By following the aforementioned unsub links, said associate found a number of broken links and dead addresses (and one link that tried to create an attachment and email it out (which he stopped)), but after three days and 400 unsub links, he trimmed his spam levels 'from an average of 250 a day to just 40 today' - that's just around 17% of what he was getting. Maybe spammers are getting their act together and listening for a change." Do any of you have any anecdotal evidence to provide to confirm or contradict this? Have you been able to lower your spam volume by "unsubscribing"?

Comments

I tried it once

[IIEFreeMan]

It reduced the flow for a month or two and then as soon as your email is selled again (with the added value of being verified) the spam comes again full strength :(

my 2c

Re:I tried it once

[Jahf]

This is exactly my experience. About a year ago I decided to unsub from SPAM whenever it came in.

After about a month of effort, I reduced my SPAM by more than 1/2 for a short while. Within 3 months I was at a higher level than before.

Just because you unsub from the SPAM source doesn't mean your address is removed from the databases / CDs that the SPAM source purchased. It is the harvesters that are truly evil.

And I have a number of addresses that have never been published and yet occasionally show up with SPAM. I wouldn't be surprised if the harvesters are making use of Outlook addressbook exploits to further harvest.

My own suspicion is...

[rusty0101]

that the only time this is a valid mechanism, is when the sender of the e-mail has gotten your address through a partner agreement with a website where you provided an e-mail address as part of registering.

The other possibility is that some spammers are still using the functionality to validate e-mail addresses, but as part of that action, they hide the fact from the recipient by suspending spam to the address for some weeks or even months before re-distributing the address to their buddies. As a result, the recipient thinks that the "unsubscribe" worked, but in the end gets even more spam.

Then again, I could be wrong. I am sitting at around 2-300 spam messages per day, if I see other reports that this is working, perhaps I will try it out as well.

-Rusty

Re:My own suspicion is...

[kenthorvath]

I don't understand how people claim to get 100's of spam messages per day. The most I've ever gotten, I think was perhaps 10, which is a rarity. In fact, most of the email I get is from companies that I actually agreed to them sending me email. Now I've had an email address since the early 90's. I've even subscribed to a few porn sites in the past and posted my address on numerous usenet posts. Nowadays I'm nostly careful, but the fact still remains that spam has never been a problem for me. Are there other people like me out there? And if you do get plagued by spam, do you know what triggered it?

With high bandwidth, does it matter?

[Sancho]

About the only reason it makes sense to need confirmed e-mail addresses is if you are a) fishing by putting together common names and numbers or b) needing to reduce your bandwidth costs. With bandwidth costs decreasing as much as they have and the use of zombie machines, what's the point in testing e-mails anymore? Plus, if you use an alias that doesn't have common names, most of the spam you get is probably your own doing--signing up to sites that sell your address, posting publicly where spammers can harvest, etc. In other words, these addresses are probably fairly well confirmed anyway. "Unsubscribe-harvesting" doesn't add anything to those unscrupulous spammers (thus shouldn't add to your spam) and thus can only decrease it when legitimate spammers allow you to opt-out.

But since the OP asked for anecdotal evidence, my mom began clicking on every unsubscribe link she came across. She called me to tell me this (and I knee-jerked about what a horrible idea it was). Then she told me that her spam had decreased significantly since she'd begun unsubscribing, and .. well, I was surprised :) But there ya go.

Pure Luck?

[Sandman1971]

Maybe it was shear luck? I tested this out about 6 months ago. I created a honeypot email address that appeared on a website for a total of 24 hours. Got a little bit of spam on the account. When I unsubscribed (the ones which didn't bounce back, etc...), the amount of spam I started to receive grew expotentionally. So in my personal experience, unsubscribing still does nothing more than confirm your email address.

Re:Pure Luck?

[AnwerB]

> When I unsubscribed (the ones which didn't bounce back, etc...), the amount of spam I started to receive grew expotentionally.

You know, it might have just grown anyway, as the email address was copied from list to list...

It might have been a good idea to do a control study, where you set up two emails, equally obscure and subscribe to the same sites. On one email unsub., and see what happens.

Re:Pure Luck?

[Just Some Guy]

I created a honeypot email address

Thanks. That would explain all of forged sandman@honeypot.net spams that I have to deal with.

Yes, I own honeypot.net. About once a week, some jackass decides that "foo@honeypot.net" would be a splendid From: address, so I suddenly get thousands of bounce messages, whiny upset recipients, and other administrative hassles. My Sendmail reject list is growing longer by the month.

Re:Pure Luck?

[Just Some Guy]

By the way, the first line of my reply was lacking the /> tag that seemed obvious at the time. I didn't really think that you used an address at honeypot.net.

Unsubscribe links make cash

[mcgroarty]

You'll find that a lot of the spammers present a load of banners on the unsubscribe page. There are still banner advertisers willing to pay per impression instead of per click, believe it or not, and this is one way of getting those in everybody's face.

For what it's worth, I read an article similar to this one about a year ago. I clicked all the opt out links in my Yahoo account and continued to discard spam unread in my self-run account. I'm only one guy, which makes this statistically insignificant (and thus, it would be highly irresponsible to do something like writing an article about it!), but I can definitely confirm that the Yahoo spam skyrocketed while my other account stayed the same.

Re:I've been thinking about doing this

[AnwerB]

I vote we all go out and try this on a large scale to see if it works. I will be glad to compile the results when we're done.

Sincerely,

Alan Ralsky
CEO, Email Clearing House

Hmm...

[rehannan]

Perhaps our friend here is sending out a few "marketing messages" as well?

Fox: "No, really, we only eat bugs and stuff."
Chicken: "Oh, really? Great! Lets do lunch"
Fox: "Muahahaha"

Do not attempt this, you will get more spam

[sa3]

I "unsubscribed" a unique spam trap email address and it started recieving spam a few months later.

Red Herring?

[icerunner]

And what if this 'anecdotal article' was in fact posted by a spammer.

What better way to try and reassure people that unsubscribing via the link in a spam email works and therefore get even more unsuspecting people to verify their addresses?

Not entirely the same method, but effective anyway

[Frambooz]

I have the "privilige" of owning my own domainname with unlimited email-addresses and, more importantly, a Catch-All address (e.g. mail to non existent mailboxes end up in the Catch-All address, which is, by choice, own email address).

When I register on a page (New York Times, for instance), I simply enter a non-existent email address with the name of the service: newyorktimes@[mydomain.com]. Any email (passwords) sent to that address will end up in my personal inbox, and I can easily check to which address it was delivered originally (by checking the "To" field or scanning the headers of the message).

The key part is that you can't use that address for ANY other purpose. Don't post it on forums, don't use it to subscribe to other services. If there's a spinoff-service from a site you're already registered to, and it requires you to register again, use a new address. It'll all end up in the same inbox anyway.

This has two upsides: it's easy to create sorting-rules in my email client and, in relation to this /. article, once you start receiving spam on the 'fake' address (e.g. they sold your address to 3rd parties), that address is easily blocked by creating an auto-reply on my server whenever a message to newyorktimes@[mydomain.com] arrives.

In fact, its even hard proof for them selling your message, so you can back-track the user agreement and see if they're allowed to do that.

The big downside to this is that when you use a fake address for a public mailinglist, they can require you to send mail from that fake address. Then, you'll need a client that allows you to change the From-field in one way or another.

My $0.02.

P.S. I know you can get my domain from looking at my profile, but I figured I keep the example simple by using [mydomain.com].

Wouldnt recommend this method

[NeverEnoughTime]

While the slashdot bretheren might be able to intelligently pick apart some message headers and the unsub link to see if there is any legitimacy to it, we all know that the average user has nowhere near that level of sophistication. Trying to get your average user to stop and think about where the unsub link is taking them is like trying to convince them that they shouldn't open attachments from e-mail addresses they dont recognize.

No, it doesn't

[lightspawn]

Hormel keeps sending me those cans of spiced ham, even though I've asked them to stop at least five times now.

Really, what's with the uppercase? Is "spam" an acronym now?

Re:No, it doesn't

[Blakey Rat]

Not that anyone on Slashdot cares, but the proper way of using "spam" to refer to unwanted email is to use normal capitalization, i.e. "spam" or "Spam" and *not* all-caps, as the SPAM meat product's trademark is all-caps.

The SPAM and the Internet FAQ is located here:
http://spam.com/ci/ci_in.htm

Re:Not entirely the same method, but effective any

[MarkGriz]

If you don't happen to have your own domain, you can get the same benefits you described by setting up a Spamgourmet account.

You create throwaway addresses on the fly (just make them up - no logging in) and email gets forwarded to your real address. Works great for addresses you only expect to receive a few emails from (like when registering for NYT, etc), as the address automatically expires once you receive a certain number of emails. If you want to continually receive email at that address, you can specify an exclusive sender (by email address or domain) to allow email to come in indefinitely.

Works great and is free too.

Re:Not entirely the same method, but effective any

[harrkev]

Yes. Sit back and laugh. You seem like an intelligent person. Why would you possibly want to e-mail somebody who is do dumb that they have to use AOL. If you ask me, they are doing you a favor.

This also keeps your e-mail address out of the computers that are most likely to pick up trojans, spyware, and viruses.

Re:Not entirely the same method, but effective any

[TheGratefulNet]

and I take it one step further.

I run BSD on my domain and when I get 'bad' email hits, I have a realtime process that detects this and adds IPFW 'block' statements to cut that turkey off WHILE he's trying to smtp me. having my firewall and mail server on the same box lets me to this very realtime.

so while someone tries to send to "sales@" or something equally guessy and dumb (for my domain), he gets ipfw'd and he doesn't even GET to try to talk to me ever again.

it works. but only for small controlled sites.

Re:Yes, it works.

[jqh1]

use spamgourmet, then you don't have to worry about the checkboxes.

[disclaimer: I'm associated with spamgourmet -- if that bugs you, please *don't* follow the link :) ]

Re:I've had good success with this.

[Alwin Henseler]

"This seems to work for legit spammers"

Legit spammers? Do they exist?
Is it legal to use "legit" and "spammers" in one sentence?

People not using unsubscribe is a pain in the ass.

[sideshow]

I work for a online incorporator (we form corporations, LLC's, etc.). We maintain a email list that includes past clients, people who sign up for our newsletter, people who give us business cards at expos, etc. We send out about 5 emails a month.

Each time we send a email out dozens of people call us to bitch about it. We've been accused of "domestic terrorism" more then once. People scream about receiving emails for the last three months. I'd like to ask them why the hell the waited until they waited until the 15th email to complain and why they never unsubscribe, but I know better.

Re:People not using unsubscribe is a pain in the a

[cmowire]

Well, that's why you should be doing confirmed opt-in, not just mailing folks who "should" get mail. Back in "the day", this wasn't such a problem, and I do sympathize with you. This is really the spammers ruining things for everybody else. So you want to make the user give you a response with a unique token to confirm that they want on.

The problem is, there's nothing you can do to assure legitimacy that spammers don't abuse. A good chunk of spam assures you at the bottom of the message that you really did subscribe to their list, so people just don't believe it. And people will forget astonishingly fast that they gave you their address.

Spam Unsubscribing is like...

[Lead Butthead]

Calling your local known felon and ask not be bugularize or robbed...

"Hello, this is John Smith living at 1234 Any Street. I have a lot of valuables and carry a lot of cash on my person, please do not rob me or bugularize my house."

Re:People not using unsubscribe is a pain in the a

[antispam_ben]

I agree absolutely with cmowire - just because someone at a convention gives you a business card with an email on it, that doesn't even mean the card belongs to the person who gave it to you. In ALL cases where an address is added to your list you should send ONLY a confirmation message telling something about the list with a unique tag. If you don't get a response (in a reasonable time such as three days, but you can tell them how to request another confirmation if they've been on vacation for a week), you need to delete the email as if you had never entered it into your system (or at best save it in a "failed to confirm" file for auditing purposes only). It's much too easy to add "someone else's email address" to uncomfirmed lists like yours - you can mean well but still be an unintending source of spam and mailbombing.

I'm on (many) fully connfirmed discussion lists - one went several months without a message and then someone sent something and a discussion started, but even in that list someone screamed "I never signed up for this list! Stop spamming me or I'll sue!" They can scream all they want because the list owner has kept all the original confirmation responses over the years where they added themself[1] to the list. It's possible the original subscriber cancelled the address and someone else got a new account with the address, but it's more likely the person forgot they subscibed.

1. Yes I know that's a very odd word I used in an attempt to not use "himself or herself." Has English yet evolved so there's a cleaner way to do that?