Slashdot Mirror
Tech Reporter Pursues Spammer
girish writes "Technology reporter extrordinaire, Mike Wendland, is at it again tracking down spammers. Wendland conducted the infamous interview with Alan Ralsky, the alleged mega-spammer, a few years ago. That article spawned a lively discussion on Slashdot and eventually resulted in hundreds of pieces of junk postal mail flooding Ralsky's million-dollar home. Now Wendland is using a new tool from a service called Project Honey Pot to track email address harvesters. He posted on his technology blog this morning about catching a company that is holding itself out as a legitimate bulk mailer, but appears in fact to be sending to harvested addresses and conducting on the side some other seemingly seedy businesses. Interesting stuff."
Honeypots are lurking all over the net... spammers don't have a chance. They are so indiscriminate and stupid with their harvesting that they are just announcing their presence through a digital loudspeaker, "I AM A SPAMMER".
There might even be some on slashdot! Who knows?!
- crawford@goingware.com
A long time ago I decided I wanted to make it as easy as possible for potential clients to email me, so I have never spam-protected my email. It's all over a lot of different websites. It's all over Usenet too.On the other hand, I get a lot of spam. It's only just beginning to bother me. I have a friend, she gets maybe ten spams a day, and she gets so outraged that she reports them all to the abuse@ addresses and so on. Me, I get a few thousand spams a day. I read my email with elm because it's the only email client that can handle the huge mailboxes I get.
What's getting me down though are the viruses. At one point I was getting 400 MB a day of viruses. Now I've decided I'm going to set up a virus filter on my home linux box, and use fetchmail and spamassassin and clamav and what have you to filter it, and serve it with imap to my other computers.
My hosting service tried to filter all the viruses with clamav, but they got so many viruses that it was too much of a CPU load, so now they do only very simple virus filtering, to catch the most obvious viruses without much CPU consumption.
Request your free CD of my piano music.
A howto video on how to prent yourself so they will take you off their mailing list.
An relevant note here would be to mention Spamikaze system (intro here).
In a nutshell, it sets up spamtrap e-mail addresses, and any IP that sends mail to that address is automatically added to the blacklist, and further mails from it are rejected at SMTP level. A false positive can be easily removed from the blacklist manually (example, PSBL).
>Seems to me that this kind of thing should be fairly straight forward. I mean, sending millions of e-mails can't exactly be done "quietly" can it?
Sure it can.
Creepy spammer approaches creepy trojan writer. Creepy trojan writer rents creepy spammer access to 10,000 compromised PC's on DSL and cable. Creepy spammer commands each compromised PC to send three emails per minute from 11PM to 7AM. Creepy spammer has now sent 1.44 million pieces of email without an obvious flood anywhere and without an obvious IP address to block.
the university where I work has some fairly effective spam-killing filters set up.
We frequently see the following interesting fun:
a) People emailing us from blacklisted domains asking what's up. We inform them to complain to their ISP or use a different one.
b) spammers wanting through our filters so they can spam the 20k folks on our network. These are the most fun. I got to watch as the senior network engineer composed a 4000 word message to totally demolish any sort of hope the spammer had, and actually locate the physical address of the spammer. We got an "oh, sorry" reply, and heard nothing since.
But, with a honeypot address(es), you know it's been harvested, and who the mail was sent for. If you can keep track of all of the people that used the spammer, you may eventually find the spammer through his own ineptitude.
The Postfix Spam Controls have reduced my spam by 95% without using compex spam filters like Spamassassin.
I added rules in my .procmailrc file to block all e-mails from the IP range of this company, this has worked very well for me (100%/0% positives/negatives)
Interestingly, since a few days I was again receiving quite similar spams, and this time they originate from the IP range of a company called Big Time Fiber. It turns out that the spams from Media Dreamland abruptly stopped after 10 november (spammer kicked out?) and after a few weeks the spammer apparently found a new hosting service.
I put the following lines in my .procmailrc:
* ^Received:.*\[204\.9\.24[0-7]\.
{
LOG = "[!!!! Big Time Fiber] "
}
and just this morning I found the following entries in my procmail log:
[!!!! Big Time Fiber] From rolffarris@newssign.net Sun Nov 21 00:16:08 2004 /dev/null 1550 /dev/null 1705 /dev/null 1739 /dev/null 1565 /dev/null 1623 /dev/null 1563
Subject: Would you like to stop smoking?
Folder:
[!!!! Big Time Fiber] From benniemilburn@minisaver.net Sun Nov 21 01:55:43 2004
Subject: Apple 17" iMac G5 Desktop!
Folder:
[!!!! Big Time Fiber] From rhettsmallwood@bigtopsavings.com Sun Nov 21 03:36:04 2004
Subject: Mortgage interest rates are at their lowest point ever.
Folder:
[!!!! Big Time Fiber] From bruce.tillery@e-goodstuff.com Sun Nov 21 05:20:55 2004
Subject: Women, something to rock your world
Folder:
[!!!! Big Time Fiber] From donovanragland@e-goodstuff.net Sun Nov 21 07:06:03 2004
Subject: Test & Keep an IBM Laptop - Product Testers Wanted
Folder:
[!!!! Big Time Fiber] From gilcolvin@bigfoodsavings.com Sun Nov 21 08:46:04 2004
Subject: You can be smart! Folder:
As you can see from the type of domain names these spams are probably from one spammer.
In the past I have received spams using the same trick from Webhostplus, Pharmakon and Aphrodite Marketing, but the spammer (now) operating from Big Time Fiber IP range appears by far the most active.
See also http://ws.arin.net/cgi-bin/whois.pl (fill in "204.9.240.164" in the search box)
...is forfeiture laws.
any property used in the commission of a crime (in this case, relay rape, botnets, spamming, etc) is seized and auctioned off to the public.
it's even better than destroying their property -- its taking their property away from them altogether. their home, their car, their computer, everything.
Curious, I punched up the IP address (69.6.66.17) in my web browser, and I get the default IIS page, telling me there is not a default web page... blah-blah-blah.
So this clown is either stupid and someone really has hacked his box and it's a zombie, or he's playing dead, and has set up the box to appear hacked, and is happily harvesting email addresses anyway. Either way, boxes like these should be shut down. Who leaves an unprotected IIS box exposed to the internet?
I'm curious if anyone is able to resolve that IP address to a street address. It has to be static. Get someone over to that address, see what's going on with this clown.
-- No sig for you!
Why should a spammer harvester mail addresses by himself? There are so many viruses, trojans etc out there: The Army Of Lamers can do it for him.
Have a look at this.
www.bigtimefiber.com resolves to 69.42.98.5 which resolves to host-98-5.approvednews.com.
A lookup on approvednews.com shows that it is owned by:
All the spammers have to do is to filter out the domains of known honey pots. Even with the donation of additional IP's by vounteers, this would be trivially easy to do.
What I don't understand is, with all of the negative publicity that spam gets, why do people still buy stuff from spammers? Although everyone claims to hate spam, I recall reading an article on /. a while ago that said as many as 10% of people buy stuff from spam, this just seems ridiculous to me. If I were walking down the street and I saw what looked like a delapedated, possible condemned building, and as I walked by 50 guys with crudely made signs ran outside surrounded me screaming "buy our product" I sure as hell would do whatever I could to get out of the situation, spam is the digital equivilent of this, yet people still buy into it. I guess it's that too many people think GIGO means Garbage In Gosple Out. As long as there are people buying the products though, there will never be a technological solution to the problem of spam.
I guess stories like this could help by showing what creeps spammers are, but the only people who are going to read articles like this already know the evils of spam. Perhaps we need to get a bunch of donations and run a commerical during prime time reality tv equating spam to terrorism?
Anyway, sorry for the somewhat offtopic rant, just been rather upset with spam more than usual lately, an email address that i've had for almost 4 years that never got a single spam has finally been getting inundated with it because some fucktard had to go and put my address in a CC with 100 other people for some stupid chain letter, and then one of those machines got pwnd and now the address is out there (BCC PEOPLE, IF YOU HAVE TO SEND THOSE DAMNABLE CHAIN LETTERS TO SO MANY PEOPLE LEARN TO USE BCC FOR $diety SAKE).
Famous Last Words: "hmm...wikipedia says it's edible"
Spam this:
I figure anyone who spams SpamCop deserves what they get.
sub f{($f)=@_;print"$f(q{$f});";}f(q{sub f{($f)=@_;print"$f(q{$f});";}f});
Frankly, I suspect it might be easier to find people who would do that to the spammer...
I get massively less spam than you - around 300 a day, though most of it gets stopped dead at the mail gateway by ordb.org and dsbl.org checks. I get about 100 or so spam actually delivered, and SA (set to be pretty forgiving) filters out all but 10 or so per day. I don't envy being in your position.
Viruses, however, are another story. I haven't seen one in six months - it's fantastic. A combination of some postfix rules and ClamAV on the internal (sendmail) mail server did the trick. If you run postfix at your mail gateway, you can get it to check incoming mail for suspicious filenames before it even accepts the mail:(note: the regexp and message are all on one line, though I should move to an extended regex and split it up).
*blam*. There goes 99% of your incoming virus mail. ClamAV gets the rest, so I just don't get viruses anymore. Best of all, you're not generating bounces for virues, you're rejecting them instantly - so unless they're using some dumb bastard to relay, there won't be any mess of bounces to falsified addreses to worry about.
What about the new waves of self-zipping viruses, you ask? Yeah, that's an issue. I cheat and quarantine all zip files. I rarely have to retrieve one, and it's well worth the saved fuss.
As for mail programs, I'm happily using Evolution with IMAP over a 512k/256k effective link to work's Cyrus IMAPd server (all this stuff is set up for work). It works great, and I'm able to use 20,000 message mailboxes without noticable stress. Sieve (the cyrus IMAPd filter language) filters everything into the right mailboxes server-side, so if I'm in a hurry I just read my (always small and managable) INBOX without worrying about my lists.* folders, the (server-side filtered) Junk folder, or anything else.
It's great.
I have been doing a little tracking down of a Spammer myself from my state.
...
A few months back, when the free iPod craze started - a company in my state started sending out emails from:
Product Test Panel
Consumer Research Corporation
Subscriberbase.com
Saying, "Product Testers Wanted". They would go from hot product to hot product. Sometimes, not even released products - like the Nintendo DS was advertised almost 2 months ago - claiming immediate shipment.
I found that they were in my state by reading the actual email and seeing a location in my state and then by confirming it with whois information.
I then sent off an email to the contact. I got an email from a guy named Brian Benehaley. In typical fashion, all of my accusations were denied.
Turns out, if you Google this guy's name - he has written a well respected piece [respected amongst bulk emailers] about how the Can Spam Act will bring a new renaissance in email marketing.
I have since written the Better Business Bureau about him, found the record for the company is now in the 1000's of complaints
I have contacted my state attorney general which is conducting thorough investigation
I contacted the host ISP - Exodus - they have over 12000 complaints lodged against Subscriberbase.com
I have written a piece that has gotten into Google searches - that receives a few emails and comments each week.
More info about Product Test Panel
It has been quite fun to research this guy and put various internet tools to my disposal.
This was a good story to see what techniques Mr. Wendland used.
Google, Whois, MY BLOG, The BBB online, My attorney general all helped me
Yell & scream & rant & rave... it's no use... you need a shaaaave ~ Bugs Bunny
This is how I keep spam from ruining my email while also catching spammers in the act:
I have a domain (examancer.com) and a cheap hosting company that allows unlimited email accounts. Every time I give out an email address I make up one that will remind me why I gave it out (like slashdot@examancer.com, nytimes@examancer.com, someotherservice@examancer.com, etc...). I don't actually have to set up each account because I have all undeliverable mail sent right to my main account. If I start receiving spam, I just look at which address its sent to and I know right away which company sold my address or which online forum my email was harvested from. If the spam gets too bad, I actually go and create a real mailbox for that address and route it to a black hole... viola, no more spam.
Don't forget the creepy port scanner who looks for installed trojans and exploits them to install his own software. For months now, every morning at 7:42 & 8:42 EST a port scanner checks ports 5554, 9898, 1023 and 445 using several zombies per scan, mainly from Korean and Japanese IP addresses. (There are plenty of other scanners but none so damned punctual as :42 Zombie Charlie!)
One line blog. I hear that they're called Twitters now.
Personally, I use a combination of tarpits, poisoning their databases, and a website that is rumored to kill the little bastages.
On the same page where I do all this, I also include links to the House and Senate email address pages, figuring if I get spammed, Congress should, too :-)
--- Asking inconvenient questions for over 30 years...
Beating up journalists is hazardous to your health. Some crooks have tried. What happens then is that hundreds of other journalists start investigating the story. TV trucks start showing up in front of the bad guy's house. Stories like "Why isn't this guy in jail yet" appear. Soon, there's heavy police attention focused on the crook.
Few crooks survive heavy press coverage. It's hard to stay in the shadows when there's a TV light in your face.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.