Spam's U.S. Roots

ahab_2001 writes "Notwithstanding how tired my finger is getting from deleting all of those unsolicited messages from China and Korea, Information Week reports that a study of filtered messages by the spam-blocking firm CipherTrust revealed that some 86% of spam originates in the U.S. Apparently, a very limited set of IPs with high-bandwidth connections is dishing out the bulk of the spam, according to this study."

Comments

Crush

[Davak]

a very limited set of IPs with high-bandwidth connections is dishing out the bulk of the spam

Crush those sites. Turn them off. Then repeat the study.

We should treat spam like a disease... and perform meaningful research on it.

Davak

Re:Crush

[halowolf]

Well its obvious what the rest of the world should do! We should add the entire American IP address range to the great blacklist and move along! :)

Its not like other countries havn't been blockaded...

Re:Crush

[mattjb0010]

Meaningful infectious disease research needs to take into account people who do transmit the disease a lot. Besides which, most of the spam coming from China and Korea does originate in the US -- either relayed through trojan boxes or properly owned boxes, but definitely advertising US "products" in US English. Looking at the last known good header IP address doesn't tell you a lot about the true origin these days.

Re:Crush

[mattjb0010]

The First Amendment only gives limited protection to commercial speech, and 550's are not limiting speech, there's also the right not to listen. Besides which, there is no First Ammendment where my servers are located :)

Re:Crush

[TykeClone]

One Time DISC0UNT 0RDER for V1@GRA, Via*gra*

That's certainly US English :)

The most effective thing to do is to come down hard on the businesses using SPAM to advertise.

Re:Crush

[gregmac]

They should contact the US government and tell them they have 30 days to fix the spam problem before a nationwide block goes into place.

and what are the chance that Bush would take this as a terroist threat and use it as an excuse to go and bomb the shit out of the country that said it?

Re:Crush

[GreyPoopon]

But the rest of the world's economy would take a severe hit if they were cut of from America even in limited fashion like email.

Yes, most likely, but since the impact to the American economy would be similar, it's unlikely that the US would let that happen. Somebody ought to do a comparison analysis between the impact of loss of connectivity and the impact that fighting spam has right now. A few days of lost connectivity may very well be worth the cost savings to companies that have to spend money on dealing with spam.

Re:Crush

[GreyPoopon]

what are the chance that Bush would take this as a terroist threat and use it as an excuse to go and bomb the shit out of the country that said it?

None. Don't be silly. Although I can guarantee you that the reaction in the US would depend highly on which country makes the threat. If it was the EU, Bush would probably make lots of noise and then bow and scrape. If Iran makes a similar threat, Bush will say "go ahead" and then later try harder to get them slapped with economic sanctions over their nuclear policies....

Re:Crush

[yintercept]

it's because of the proportion of spam to useful mail. I don't know anyone in Asia, so unfortunalty it makes sense for me to use a provider that blocks them.

This is true for all nationalities. There is an extremely low ratio of real mail to spam for all email traffic that travels across borders...because most people really don't know a lot of people across borders. Hence the argument that other countries should shut off the US is as sound as for US ISPs shutting off Asia.

Re:Crush

[Anonymous Coward]

But the rest of the world's economy would take a severe hit if they were cut of from America even in limited fashion like email.

Actually its the opposite. There are tons of third world countries where > 90% of people do and can live without email access and won't bother if their emails do not reach the almightly US. Afetr all, they can still send emails in the non-US part of the world.

Limited set of IP's?

[tpwch]

Great, give me a list and I'll block them on my mail server.

This isn't really news

[Dan Hayes]

Is this surprising? We've heard it before again and again after all. While certain Asian countries are a huge part of the spam problem they're not the source of it, just (often) willing accessories to Western entrapeneurs. After all as China moves towards a more free market economy then people are going to jump at the chance to make a few dollars providing this kind of service. And after all, spam is nothing if not a prime example of a free market run rampant.

Unfortunately the Chinese aren't the only ones interesting in making a quick buck from this, or so you'd think from the vast lack of any kind of serious response from our legislators. But then again the Government is quite fond of their own kind of spam where they're pushing themselves as the "product". Quite fitting that Bush and co. are much the same as fake penis enhancing products to be honest.

I'm confused

[pedestrian crossing]

Why doesn't spam come under the same scrutiny and attempts to shut it down as P2P?

If it is mostly as centralized as this study indicates, it should be easy.

OK, I know the answer (nobody's precious "IP" is threatened by spam), but if there are going to be attempts to regulate the Internet, it seems like this is a far more productive place to start.

Re:I'm confused

[lunatik42]

Spam doesn't come under the same fire as P2P because it *promotes* consumerism and the "entertainment" industry, whereas file sharing circumvents the mass market etc. completely. Ergo, most of the war on spam is fought by the people - no one on top of the dogpile wants to regulate advertising. Besides, there are anti-spam filters being sold all over the place. That's another way to capitalize on the phenomenon.

Re:I'm confused

[pjrc]

Why doesn't spam come under the same scrutiny and attempts to shut it down as P2P?

As a matter of US federal and state laws, there has been one (admittedly lame) federal law passed to regulate spam, following on the heels of numerous state laws. Yes, the CAN-SPAM act sucks, but it is a law on the books. Compare with p2p, where all proposed bills have died so far.

As a matter of ISP policy, almost all ISPs have anti-spam usage policy. They regularly DO delete accounts abused by spammers. Compare with p2p, where most ISPs allow filesharing and make no attempts to block ports, cancel user accounts, and so on.

As a matter of public awareness/debate/outrage, compare the number of articles regarding spam to p2p... both in tech circles and the mainstream press. Spam certainly is an issue receiving a lot of attention, though it's difficult to find hard numbers to compare to p2p.

As a matter of lawsuits filed against perps, compare the lawsuits launched by AOL, Microsoft, Yahoo and others against numerous spammers to the p2p lawsuits. Ok, here the RIAA is a winner in shear volume of suits against end users.... but to says similar actions aren't being launched against spammers is just not right.

As a matter of effort by individuals and small groups, there are LOTS of people working hard on the spam problem. On the p2p side, there's really nothing like all the individuals who's contributed to blacklists, excellent open source filters like spamassassin, and ideas for protocol improvements (SPF).

All in all, the effort expended against spam far outweights that against p2p. Just because the ultra-high-profile Hollywood interestes are against p2p doesn't mean that p2p is somehow getting more scrutiny than spam.

The only thing that's getting a lot more scrutiny on the p2p side is the back-door lobbying tactics. The scrutiny is well deserved and I hope it continues (will I'm not a fan of p2p apps, the unfortunate trend is to lobby for restrictions far broader than necessary). On the spam side, we just don't have a high profile group lobbying against everyone else's interests.

It makes me wonder...

[Short Circuit]

What happens if/when the kingpins are taken down? Will the commercial anti-spam-solution market dry up?

Who's willing to bet that companies with spam-dependant business models won't want that happening?

(/tinfoil hat)

Has anyone ever thought of comparing the originating IP of an email against a blacklist? I'm not talking about the server that sent the message to the recipeint. I'm thinking of further along the relaying chain.

Nice Advertisement..

[inkdesign]

What CipherTrust REALLY means is 86% of their potential clients reside in the US.

SPAM thrives best where it is consumed.

[erick99]

I think that SPAM does so well (so to speak) here in the United States because enough people read SPAM and buy the products to make it worthwhile for the spammers to do business. I had no idea there was such a market for "male enhancement," "payday loans," and the other similar ads.

I have been using gmail since early July and the spam filter is the best I've used so far. I get very few spam in my inbox everyday and I haven't had a false positive in so long that I don't check anymore.

The spammers will continue to spam until they are ingored to the point that there is no money in it. But, you know, I just don't see that happening.

Cheers,

Erick

Re:SPAM thrives best where it is consumed.

[multimed]

That's just not true at all--a very common misconception. If people just stop buying stuff from the spam, the success rates will go down low enough that spam will no longer be effective and go away, right? Hooey. The people doing the spamming and the crap for sale or whatever are two different things. Spammers don't care what the response rates are, they sell the service of bulk emails. They get paid no matter what. Of course that's not what they tell the businesses buying their services. They pitch how cheap it is to reach millions of people and the whole "if just 1% buys something" fallacy. The problem is the greed of the businesses continues to let them believe the sales pitch of the spammers. That's why legitimate companies don't do spam--not because it's immoral or illegal but because it already doesn't make financial sense.

That's why my answer is not to go after the spammers who are slime but often out of US jurisdiction, or even the ISPs because while some of them are evil & look the other way, a lot of them are trying, but it's hard work. No don't bother with them, I think they should go after the companies selling the crap. There's a contact in most of the spam for people to actually buy the crap. And that's a hell of a lot easier than tracking the spammers, nail the businesses paying for the spam. I guess it's kinda like going after the Johns instead of the prositutes.

iptables -I FORWARD -s isp/20 -j DROP

[caluml]

Give us the CIDR blocks of the whole ISP that the spammer is using. Block all packets from those ISPs. Once ISPs learn that they get blocked for tolerating spam, they will try harder to prevent them.

Finally the truth

[maximilln]

Now we can stop all the fingerpointing at foreign nations to blame those nefarious Asians, or the socialist Europeans, or the terrorist Arabs for our spam. We can honestly stop deluding ourselves and look at the problem and say,"It really is nothing more than American business alive and well." However, I find that the analyses are always going to be flawed. If the spam passes through even one illegitimate relay along the way it's pretty safe to assume that the relay has been doctored to rewrite connections. The latest spate of spam that I've received has seemingly come from IP addresses registered to Edward's Air Force Base and the USPS. Of course, the SMTPd signatures openly acknowledge that they're "misconfigured".

Really, until a proactive approach is taken to seriously investigate the businesses whose products are being advertised then tracking spam from the mail side is an exercise in self-delusion.

Re:Me... Trolling?

[azaris]

I use SpamBayes.

Why bother with SpamBayes, just put your fingers in your ears and go "la-la-la-la I can't see any spam so it doesn't exist la-la-la".

Re:cybersmtp.com

[DMNT]

They claim that they have that many e-mails.

Rule #1: Spammers lie
Rule #2: Spammers are stupid

Spammers buying spamming services must be stupid enough to believe other spammers' lies.

There have been reports of spamming attempts to newsgroup message-id's, tags, anything with @-sign in it. And how will the buyer have any way to make sure that the mail is sent to that many e-mail addresses? Or someone will actually read them? Spammers selling stuff will care about this. Spammers selling spammer services won't. They just want the easy profit. They might not even have more than a million working addresses. Maybe if someone bought the service with smaller amount of e-mail addresses will get a couple of sales and then have the courage to by "de luxe" service, which might turn to be the same as the ordinary service.

Only way out is FTC/FBI and RICO

[Anonymous Coward]

Why doesn't spam come under the same scrutiny and attempts to shut it
down as P2P?

Spam is a money maker, and not just for the guys pitching the penis pills. It makes money for ISPs, who charge "high-risk" rates for being associated with it, it makes money for list brokers and other putatively legitimate businesses who sell out your email address to list brokers, it makes money for banks who sell CC services to spam merchants, and so on.

To fight spam, you have to stop thinking of it only in terms of people sending email, think of it holistically -- other people, with more influence on legislation and enforcement are also making money off it.

Spam is fully entrenched in the economy and won't be going away. The only way to make it *mostly* go away is for the FTC to get serious about deceptive marketing practices: have the FBI investigate the entire *world* of spam and treat it like an organized conspiracy. Some RICO indictments and convictions of people profiting off of spam (not just the pill seller and email sender) would make it damn hard to run a spam operation.

Until this happens, we'll see trailer trash guys running a string of zombies get nailed, but the big names turning big dollars won't get touched.

Re:Yeah! We're #1! We're #1!

[Anonymous Coward]

I want to administer the death penalty to spammers. Please?

At 120 emails/day, its a freaking chore to clean it out. I keep my gmail ultra-secret, but my bogged down one was used for important stuff before it became a spam-packed mess.

I'm always amused at the number of people on slashdot who will argue passionately for free speech, then argue passionately against spam.

In other words, you want others to have full and unfettered freedom of speech, until they use it in a way that annoys you, in which case you want to kill them?

I hate some of the TV commericals I see: they're very annoying. I have as yet to contemplate murdering anyone over it, though.

*shrug*
--
AC

I can't even read most spam!

[OrangeTide]

Most spam I get is full of spaces in the middle of words or weird characters or insane grammar that I can't even figure out what they want me to buy. So not only do I have to read the garbled subject of the message and mark it as spam (because their crazy message evades my filters) I get to sit there confused as to what they were trying to tell me.

It's just bad marketing to leave the customer confused. Maybe I should just stop using email all together until someone has a better system.