Slashdot Mirror
Do Unsubscribe Links Stop Spam?
Kaiten writes "Brian McWilliams of Spam Kings fame has just published a fascinating spammer exposé over at Salon. Using a pseudonym, he was hired to send junk email on behalf of a spam operation that has been burying people (me included) with spam for fake Rolex watches. The article details how the spammers handle the 200,000-plus unsubscribe requests they get each month. Seems that LOTS of geeks actually cross their fingers and click those remove links. And, surprise, surprise, the spammers usually ignore the unsubscribe requests."
NO
A reply confirms there is a live person behind the email address. And for those with a HTML-enabled email client, a cleverly placed (and sized, ie 1 pixel) embedded image to an external site with a unquie string keyed to your email address is yet another trick spammers have for confirming your address.
expect the unsubscribe link to work?
I had to fire up Internet Explorer to read the article, as the ads didnt work in firefox :( ...
And this somes as a suprise to WHO?
And if you like what you read you can come and hear the author speak at the MIT Spam Conference on January 21.
John.
THIS JUST HIT THE CABLE!!! Breaking headline! Spammers are dishonest! (first post)
..But the big corps too. Coincidentally, I tried to remove myself from the iTunes list (which I had accidentally enlisted for when downloading QT) only the find that the unsubscribe-URL "contained no data". Hmm. Double hmm.
Gosh, thanks. That must be why the other ships call me Meatfucker -- GCU Grey Area (Eccentric)
Using the link will
a. confirm your address
b. be ignored / or removed from that 'particular' offer list
c. added to 100s of other lists
unsubscribe is a bit fuzzy
spammer may unsubscibe you from one list, company or offer while adding you to many others
"um....duh" was the first thing I thought. It's like doing a study on why people have sex.
I stole this sig.
Usually I go through periodically and unsubcribe the ones I can. The volume then goes down for a couple weeks, so it is worth it.
Often, however, the unsubscribe links don't even display a page, much less get me unsubscribed. Porn spam is actually one that I have noticed DOES work more often. I started getting porn spam at work, and being one of the network admins, told the other guys that I would be going to porn spam site to unsubscribe, and they actually worked. That was 1 1/2 months ago, no more porn spam.
"And, surprise, surprise, the spammers usually ignore the unsubscribe requests."
Hitting the unsubscribe just *confirms* that the mail address is valid and you actualy *viewed* the spam email. This sets you up as a more valuable target.
From what I have always believed, many spammers not only disregard such removal requests, but use this link to instead verify an e-mail address. So clicking on such links only results in more spam, not less.
Plus, by clicking on the link, you probably just made the platinum edition CD of resellable e-mail addresses...an honour, I'm sure...
Doesn't that violate some states anti-spam laws? I thought one of the points is to make a way for people to remove themselves from the list in a way such as this...
Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
riiiiiiiiiiiiight..... and next time someone steals your wallet, send them a polite letter asking them not to use the cards and return it immediately :)
no, they now have the images link back to the server to confirm your email address. it is all worthless.
until they come up with a real solution, we won't have much to fight it.
Who'd want to unsubscribe from the spam anyway? Its like getting free literature in the mail!
.
We sell software as the box version without the b0x and the manual. that
By foregoing the fancy box and typically can
slim manuals you end up saving a considerable amount.
Love is the victim's response to the rapist.
You have only 100+$ bucks and want to buy goood software today - then
clcick here and you can get a lot//.. stories featuring our s,
s real you.
What doth it profit a man if he gains the who world and loses his own soul?
Great products hard and extreemely good pricing
They by far exceeded my expectations. This is only one of 100's
commentts from satisfied customeersto
Seems that LOTS of geeks actually cross their fingers and click those remove links.
not geeks but stupid lamers.
We need an article to tell us this?
Do Unsubscribe Links Stop Spam?
While they don't exactly stop spam, they do prove useful. You can immediately sort possible-spam by whether it offers an unsubscribe option. If it doesn't have it, it's definitely spam. If it does have an unsubscribe link, it's either legit (newsletter perhaps), or spam disguised with a fake unsubscribe. While the fake unsubscribe doesn't really help the end user, it offers a way to track and prosecute those who violate CANSPAM which requires that the unsubscribe option be present in some form, and that it work.
Slashdot Syndrome: the sudden, extreme urge to correct someone in order to validate one's self.
According to tFA, was that some spammer "affiliates" actually seemed to honor the remove requests.
Behold the riant ape! Beware, his crooked thumbs!
That's how I introduced myself last month, when I sent Casper an e-mail asking to join his spamming crew. I fibbed to him that I was a full-time bulk e-mailer looking for a new sponsor. I said that one of my business associates had recommended his program. (For authenticity, I lightly sprinkled typos and grammatical errors throughout the message.)
I wanted to be one of Casper's sales affiliates. In today's world of spam, a sales affiliate sends out junk mail on behalf of a spam-site operator or "sponsor," who assigns the affiliate a special tracking code to include in his e-mail ads. For every sale the affiliate's spams generate, he is paid a commission by the site operator. Sponsors also provide "remove" lists, spamming software, and other support to help their affiliates successfully market the site.
Since September, Casper and his associates had been clogging my various e-mail accounts with ads for a watch shop called Royal-Replicas.com (formerly onlinereplicastore.com). I filed several complaints with the Chinese Internet service provider hosting the site, to no avail.
I suppose I could have just clicked the "unsubscribe" links in the dozen or so spams they sent me every day. But I didn't trust these people one bit. I was sure that if I could get inside Casper's operation, I would find hard evidence confirming what savvy Internet users instinctively know: Trying to unsubscribe from spam is a fool's game.
Just look at the place. Royal-Replicas.com provides no physical mailing address in its junk e-mails or at the site. The domain's registration record lists someone in Spain as the owner. The site is hosted on a server in China, but the order page cites prices in Indian rupees as well as U.S. dollars. The headers of the spams reveal that many have been sent via "zombied" home computers. Even the headers of Casper's private e-mails are a fraud. (He routed all his messages to me through proxy computers in South Korea.)
The "About Us" page at Royal-Replicas.com doesn't help much, either. It contains little more than a bizarre rationale for buying its $300 knockoffs rather than the real thing: "Many people purchase watches that cost thousands of dollars and render the wearer liable to get their hand chopped off while walking home from a posh cocktail party."
Bulk e-mailers are required to honor list-removal requests under the U.S. CAN-SPAM law. But still it's common knowledge that clicking an unsubscribe link or handing over your e-mail address on a junk e-mailer's remove page is insane. The U.S. Computer Emergency Readiness Team (US-CERT) warns that unsubscribe links are "often just a method for collecting valid addresses that are then sent other spam." The FTC has sent warning letters to at least 77 marketers for their failure to honor unsubscribe requests.
Sure, a few spammers might take your name off to avoid trouble. But to most, you're merely confirming that they've found a live one. Next thing you know, they'll have sold your e-mail address to other spammers as "validated" -- or, in other words, ready for spamming.
At least, that's what I thought until Casper brought me onboard. My undercover mission into the heart of fake-Rolex spam didn't turn out exactly as I had expected.
I tried flattering Casper in my e-mails, gushing that he had astutely tapped into a timely and lucrative spamming niche. (You could probably find similar watches on the streets of Chinatown for $25, but hey, some people prefer the convenience of holiday shopping from home.) But Casper doesn't let just anyone join BlackMarketMoney.com. After I sent my introductory e-mail as "Chris Smith" from a free webmail account I had created, he asked to know the name of the person who had referred m
Dent: No, how much?
Prosser: None at all.
> The article details how the spammers handle the 200,000-plus unsubscribe requests they get each month
By a strange coincidence, "none at all" describes the actions taken on 200,000 remove requests a day by a bunch of ape-descended spammers targeting a group of fellow ape-descended lifeforms so amazingly primitive that they still thought that ch33p r0l3x watches were a good idea.
No, I know for sure that they don't help. For years I have been trying to get MORE spam. The main way I have done this has been unsubscribing from lists! In fact, I even "unsubscribe" an address that was never subscribed. Indeed, that new address is now getting plenty of spam.
Unsubscribing from spammer's sites will get you more spam. Unsubscribing from mailing lists will work, of course, but mailing lists != spam.
Does the Pope shit in the woods? Are cats really superintelligent beings from the planet Arcturus?
In my experience, no. There was a time when I was naive enough to think that they would, but unfortunately, experience has proven otherwise.
In fact, I did an informal experiment of my own. I created an email address specifically for this purpose, and posted that address on a few sites. I was getting spam within 2 days (3 messages on day 2). After I got the first spam, I removed my email address from the sites. I also used the unsubscribe link on just one email. Guess what? The volume of spam jumped 400% within 24 hours (12 more messages came in).
Most effective weapon against spam? The delete key.
bash: rtfm: command not found
its those bastards that are filling my mailbox up is it? I get nearly 300 Rolex spams a day alone, and like a good little boy I eat all of them, no bouncing no unsubscribing. Why isnt there a SMTP server that checks it as it comes in and refuses it there and then, telling the sending server to bugger off? That might get you taken off the list, whereas bouncing only annoys some poor sap whoes had their email address hijacked, and unsubscribing just announces that the address reaches a human.
Why are you loading the images in the spam you get?
See, the spammer is like any other advertiser: they want to try and sell you something.
So they send out a few billion spams, and 20% of them unsubscribe. Instead, they ignore it... and resend the same spam.
What, do they REALLY think if the person took the time to unsubscribe that upon seeing it a second time they'd think, "Oh WAIT, YES, *slaps forehead* I DO need a new pair of sunglasses!!! Silly me. I can't eat carpet"? Sorry, doesn't happen.
I don't know if it's just laziness or what, but ignoring the massive amounts of unsubscribe requests just seems like a waste of time, especially if you're trying to zoom down your list of people to those who will actually buy something.
We have secretly replaced these Slashdot mods' sense of humor with a rusty nail. Let's see if they notice!!
For about 6 months, I became victim to a spam system sending out e-mails. They thought my name was "Cxzffadds" or something of the sort. One day, I was fed up and sick of it (hey, it went to other@clete2.com anyways, so if they still sent it, I just change my spam address) coming to my inbox. I would get 3-5 messages a day or more off of it. I clicked that unsubscribe link, filled out something, and at the end, it "unsubscribed" me and sent me to a page to fill out something else, trying to trick me into subscribing to a plethora of other spam e-mails. Luckily, I took note of that before doing anything and now, I am Cxzffadds spam free. I will never click any unsubscribe links unless I get them 3+ times per day or for months on end.
I have been using Yahoo for a couple of years and I started to get about 2-3 spam e-mails a day. I was sick of it, so I decided to use the unsubscribe list. Coincidently, I started to get more and more each day. Not only do the unsubscribe links "not work", but in my opinion, they also tend to send more links to the user knowing that they are actually the e-mails to some extent. Just my .02 cents!
thanks /. editor morons, for posting that link to an add. Salon and their disruptive ads can go to hell. Here is the link to the actual article:
m ov e_me/
http://www.salon.com/tech/feature/2004/12/14/re
I always figured, that if you'd try to unsubscribe, your email address would be tagged as verified adding value to. This is just a thought, I've had since dawn of junk mail.
In spammers lingo, unsubscribe means "confirm that you email address is real". Is that us that don't understand that language.
"And for those with a HTML-enabled email client"
It's for this reason I have my OSX Mail app configured to not load embedded images and objects in incoming HTML.
---
Cthulhu holiday songs, for the gift that keeps on loathing.
REPLICA WATCH MODELS
Rolex, Patek Philippe, Bvlgari Cartier, Gucci, Franck Muller
http://www.differentwatches.info
All for only $199.00!
To change your mail preferences, go here (unsubsribe link)
I usually do not even bother unsubscribing from spammer accounts. As a general rule I do not give out the email address where I recieved this solicitation, so my only thoughts on how/where the aforementioned solicitor obtained my email address lies in the company (Pentad Systems) I work for listing it publically on thier website.
I simply deleted the spam and go about my day.
-JMHA
At the very least, however, the same laws which apply to telemarketers should apply to spammers. If I remember correctly, here in the States, if someone recieves a telemarketing call and requests to be removed from the telemarketers' list of numbers, the telemarketing company is required by law to remove that number from their list. The same thing should apply to spammers, and be enforcable with (at the very least) heavy fines.
Many Bothans died to bring you this sig.
...stops spam! I've been using it for some time now (server-side) and it has been so acurate that I have proceded to move alleged spam to /dev/null.
Mail that Spamassassin thinks is spam but isn't can't be that interesting anyway.
I wouldn't have expected that, seeing that they don't seem to have any problems hammering my servers from spamzombied PC's with dictionary attacks sending mail to hundreds of thousands of -mostly- non existant e-mail addresses on the off chance that a few will reach a valid address that doesn't have spamassassin active.
This spam business is starting to look more and more like one giant distributed DOS attack, so pray tell, why would they be interested in unsubscribe requests?
Opt-out DDOS would be a nice idea in the ideal world...
Best advice is to have more than email address. Even better if you can have a separate one for EVERY online form you fill out. Then you can safely identify anyone selling your information. Of course, most is harvested from website caches and newsgroups and such. You'll want to shroud your addresses used there.
In other news; animals continue to defecate.
I'm surprised no one has posted the link to the spammer site from the article.
We wouldn't want http://www.blackmarketmoney.com/ to get slashdotted, now would we?
Bad monkey!
"Seems that LOTS of geeks actually cross their fingers and click those remove links"
I really don't agree. Any respectable geek shouldn't be getting spam in the first place, let alone be stupid enough to click the unsubscribe links.
Personally I haven't had more than 30-50 spams in the last 3 years or so.
I have my main address, which only 'real people' know, friends and family. It never gets any spam because it's totally secret.
Then for everything else I assign a throw away address on one of my domains, the mail on these gets checked only when I'm expecting something (like a signup confirmation/verification etc).
I also have a semi-secret address to give slightly less trustworthy people and to date that hasn't had any spam either.
Obviously I make sure none of my addresses get posted in plain text on the internet either.
It is simply a matter of keeping your address clean. The only way spammers can send me mail right now is if they brute force my email address, and that doesn't happen very often.
Unsubscribe generally does work for legitimate mass mailings, ie the ones you had to sign up for in the first place. It doesn't work for true SPAM, and indeed as others have pointed out, tends to actually make the problem worse.
It's amazing that this is considered "news", but I guess you have to repeat experiments every so often to prove that the theories they provide support for still hold water.
You see? You see? Your stupid minds! Stupid! Stupid!
That clicking unsubscribe simply lets them know your email is valid. Lots of spammers simply email all words in a dictionary in a hybrid-like motion, i.e.
[word][number]@[hotmail, etc] and so by clicking unsubscribe, your email is added to a database of 'valid_targets', best to simply block the address/domain.
I created an account just for spam, and about 300 messages per day got past my filters.
one day I got bored and "unsubscribed" to about 100 messages. The effect was not immediate, but within a week it was down to about 50 messages/day, so I started unsubscribing again. Today it gets about 15-25 per day, and I have stopped hitting unsubscribe (and stopped using that address as spam account thanks to gmail's spam address feature).
Evolution lets you skip loading external/embedded images, by default, if that option is selected. I'd like to have an extra filter in there: white/blacklists (in my contact list) for message senders and image SRC URL patterns - all default to "NO". That way, senders/servers I trust - they already have my email/IP#/existence confirmed from other messages - send mesages that aren't broken. The rest can go to hell. A good filter would find messages that point at untrusted servers, and add their senders to the blacklist. That kind of Evolution plugin, with spamfilter against the blacklist, would go a long way towards suffocating the spammers drowning us in privacy invasions. And also make Evolution a much more attractive draw than, say, Outlook, for people who use their computer to communicate with other people, not with machines or reptillian spammers.
--
make install -not war
This has been going on since before the days of the (long since defunct) IEMMC with their bogus remove list, which was back in 1997 or so.
Here's one article that was written about the IEMMC.
I'm actually (at the cost of some traffic) using this to help me fight spam...
It's not just that spammers are ignoring these requests, they will actually just merge their lists with the responses (on the off chance that you might try to also unsubscribe some of your other email addresses / or a friend's email address).
In fact, if you enter just a random address in there, you can be pretty sure that this address will get spammed in the future, too.
If you use bayesian filter software, like bogofilter or spamprobe, you can turn this into an advantage. I've actually "unregistered" some previously non-existent email address on my internet domain that I'm not going use anywhere else. Now I know that any email coming in for that address is definitely spam - and can hence use it to automatically improve bogofilter/spamprobe by passing that email from procmail into them with the spam "learn" flags set.
Of course they don't. If anything,unsubsribing will triple the spam you do get.
Besides filtering spam I started creating a seperate email alias for every website I need an email address on. When that alias starts to get spam I delete it, and I know where its coming from.
The most surprising place I ever get spam from is sears. I think they have someone on the inside selling their customer list because I will start getting spam about 2 weeks after ordering something.
And it was an interesting experience. @Once has big-name clients who don't want to be thought of as spammers, so the company puts amazing resources into reply handling and unsubscribe systems that actually work. I know, I worked my ass off keeping them running. It was a stark contrast to what a real "spammer" is, at least in my imagination.
Still, I was never proud to tell people where I worked because people think of bulk email as spam unless they're educated about the difference. In my interviews since I left the firm, I've always had to be very careful to describe the white hat nature of what I used to do.
All generalizations are bad.
Salon.com forces you to read an ad before you can RTFA. They can go to hell.
Ignorance is curable, stupid is forever.
Before I was getting around 30 spams a day, now about 2 to 4. One problem with unsubscribing to spam, I noticed if you do it every day you continue to get the spam. On their opt out links they say something like please allow 7 days for their servers to delete you. Guess what after 6 days and you unsubscribe again, they wait to those new 7 days are up. It really works, though not all spams have unsubscribing, and usually it takes a while to hunt and find the link. The worst is medical sites I can never find them, http://lcv.pharmnnfh.com/ help me find the link. What really needs to happen is the people who work in the spam division at gmail, hotmail, and yahoo need to get their acts together and put together pages where you can mass unsubscribe to these things.
with spam for fake Rolex watches.
I once saw an actual brand called "Relox". By changing the spelling they could legally get away with it, at least in the short-term until Rolex sues them for confusing consumers, which takes longer in the courts than direct rip-offs.
Anyhow, another annoying repeating spam is the one with the red box in the upper left selling penis pills. It comes in as an embedded image from different sources. The only constant is that it is always the same image. My filter can only filter by whole words rather than parts of the (ASCII encoded) image.
I was in the process of building my own email filtering system with all kinds of "indicators" such as marks saying the email had HTML or image references and suspicious key words, but I didn't trust my own message parsing algorithm as far as isolating and altering messages and attachments as units. I am thus looking for libraries that do the basic parsing for me. I can then add the logic to screen and rank the content. I've been dabbling a bit in TCL of late, so TCL libraries may be the way to go.
Table-ized A.I.
Wait a minute, I distinctly saw a line in that article that read "You don't negotiate with terrorists...". What the f are they thinking? Of course you do. That's how you get terrorism and spam, to stop. Don't fight them, someone might get *hurt*. You might hurt someone's *feelings*. They might get *offended*.
And... that damn ad... I'll be sure never to buy that product, or visit salon again.
-- Liberalism is a mental disorder.
I mean, there's nothing more valuable to a spammer than a list of functional e-mail addresses. How best to trick people into letting a spammer know an e-mail addy is good? The unsubscribe link, LOL.
NEVER use the 'remove me' or 'unsubscribe' link when the spam is from a company you do not trust.
Loading...
if shadowy figures enlisted armies of anon remailers to flood these assholes with threats of bodily harm.
Of course I do NOT endorse any such thing but I bet that if it ever did happen a good number of them would drop out of the spamming biz..
Soon or later, someone IS going to get a belly full and go track one of these jerk-offs down and do them serious harm..
Analyze a few spam messages. Multiple versions of the *same* message come from multiple sources. Whoever hires the spammers supplies a pre-written message containing all that sneaky code, probably written by a disgruntled or greedy geek.
Ignorance is curable, stupid is forever.
Do Unsubscribe Links Stop Spam?
If by "Unsubscribe" you mean "trade one source of crap for a hundred others"...
By "Links" you mean "deliberately mangled URLs often either hidden in the page source or only appearing in white text on a white background"...
And by "stop spam" you mean "accomplish nothing more than waste time and speed your journey to a RSI"...
Then yes. Absolutely. Click away, Merrill, click away!"
Why should junk addresses (president@whitehouse.gov, for example) in the remove list be a problem?
When the remove list is used properly, it should just be a case of "this address isn't on my list, I can ignore it". Granted, if the fake addresses were swamping out the real ones it would increase their processing time -- but still shouldn't be a major problem.
Of course, if the remove list is used as a source of e-mail addresses, then the fake addresses will be a problem. But in that case, annoying the spammer is a plus not a minus.
...also ignore requests to unsubscribe.
I religiously unsubscribe from everything, and I get very little spam. That said, I don't sign up for shady web sites or mailing lists, and my email isn't very public. However, I do believe it's an all-or-none scenerio, you have to get off of everybody's list or they will just propogate you before you can remove. If you're going to try and remove, hit those unsubscribe links/emails as soon as you get the message!
One thing really missing is a national or perhaps even a global unique "company ID". Law makers are so eager to tag and trace individuals, but ignore company tracking. It is time for a national company-ID number.
Any company that wants to do business in the US would be required to have such a number and include it in any email they send across our borders, perhaps as a new email header attribute. Ideally it would be globally enforced and the US could pressure problem countries such as China to crack down on businesses that abuse email and/or the company number.
There are too many fly-by-night companies running around.
Table-ized A.I.
Well, sort of: IMAP mail readers only download the headers of messages until you select them. If you just click the Junk or Spam icon for those, away they go. Same thing with autodetected spam, of course.
/. posts, OTOH, are often improved by HTML. I'm not sure why.
Or you could just turn off HTML in email. I don't see the point of rich text in an email. At least, I've never gotten an HTML email I thought was improved by its prettied-up format or the convenience of a clickable link.
sigs, as if you care.
"I wish I had a feature to select all my spam. and forward it to spam@ftc.gov"
In OSX's Mail app it's easy to set up a rule to do that. I haven't tested it with a live message yet (just created the rule to see if I could), but I think it would keep the headers intact.
The risk then becomes the false positives of your spam filter. Forwarding non-spam to the FTC is probably not a good idea. ;-)
---
Cthulhu holiday songs, for the gift that keeps on loathing.
I never click on unsubscribe links. It just serves to verify to the spammers that your e-mail address is valid.
Sigh Assuming by "geeks," you're referring-to computer geeks: Real geeks don't click remove links.
Real (computer) geeks don't use MS Windows. Real computer geeks don't program in some variation of BASIC. And very few real geeks bother with /. anymore, cuz /. is mostly inhabited by geek wannabe's.
Much of McWilliams' spammer expose' book is only marginally based on reality, btw. (Real geeks already knew this.)
What a great article. I think more of us nerds should infiltrate the spammers and see if there is any way to shut them down. I realize that is a lot more work, but how much work do you spend filtering, or deleting spam each day?
On a related topic, I used to get 25-30 emails per day to the email address that is on my whois registration. Recently I had to renew my domain name and I noticed that my registrar offered an email address encryption. By selecting this option my spam emails went from 25 per day to 2 or 3 per day! I was astounded at the scum who are using the whois information to spam people.
So if you own a domain name, check to see if your registrar is offering a similar service.
- Bruzer
"Tempt not a desperate man" - Willy S.
You didn't ask for the spam in the first place, so why would they listen when you ASK for something?
I always just assumed that, if you ever clicked "remove", they may remove you from their list (or not) but then they've got confirmation that yours is a valid email address, so they can turn around and sell it to others so you can get even more unwanted email.
"Attitude, not aptitude, determines altitude." - Jesse Jackson
Much of spam that I get doesn't contain ANY usable information or links at all. And sometimes there are links, but they aren't even valid URLs.
What the hell is the point of spamming people with ads when they won't be able to get back to you to buy your product?
I clicked on the link unsubscribe to some Microsoft spam and it tried to force me to signup for passport, including a long... questionare asking lots of questions about me
I sent a email to customer service to complain. I got a response back from a customer service drone (human) that offered to unsubscribe me if I just gave him all the information needed to create a passport account for me... so he could opt me out of future spam.
I had some time to kill, so I replyed with a reference to the new spam law with a reminder that his reply acknolged my request to not send spam, so if I did get any more then Microsoft would be in violation of the law, passport account not withstanding.
So, four opt out attempts and three emails, but I did finally opt out... from one sender that is well known and has deep pockets and very sueable. Small spam outfits... forget it.
Sorry for the latin, but I've always wanted to use that bit seriously just once...
Just because your spam dropped at that point that doesn't mean it was due to your unsubscribing session. There are many reasons why your spam levels fell. Perhaps your ISP/mail provider installed better spam filtering, perhaps the spammers responsible for a large proportion of your junk mail were shut down one way or another, etc.
There are many possible causes for the effect, so don't assume that you using the unsubscribe links was the catalyst for the change. That could have been it, but that's not necessarily it.
"Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
She did not understand why she was getting so much spam, because she always clicked on the unsubscribe link!
I had to explain the 'harvesting' concept to her, so that the new account wouldn't suffer the same fate as the old one. She was good after that.
"The most sensible request of government we make is not, "Do something!" But "Quit it!"
Whoops! That should read "Never Hit Remove". Not enough coffee yet this morning.....
"Attitude, not aptitude, determines altitude." - Jesse Jackson
Heck, legitimate businesses often either ignore or don't test their unsubscribe systems.
I signed up for emails from History Channel a year or so ago. A couple of months ago I decided I didn't really want them any more. I clicked on every unsubscribe link they sent me, probably a total of 6 or 8 of them over 2+ months. Finally I sent them an email telling them they'd better honor it or have a lawyer familiar with CAN-SPAM.
To their credit, I got a hand-written email back within 12 hours and I haven't gotten any more promotional emails from them. But it's pretty obvious that their unsubscribe system wasn't working when I tried to use it.
all well and good but does anyone have this guys home address? I have a number of issues I want to take up with him, maybe involving a can of petrol and some matches.
DRM-free indie games for the PC and Mac: Positech Games
I've received several pieces of spam lately where the URL of the website being advertised (the subject varies, free porn, free downloads, etc) is invalid... In fact, the only valid domain in these e-mails was in the unsubscribe link. I can only conclude that the purpose of this e-mail is to harvest the e-mail address of people who 'unsubscribe.'
I had a junk hotmail address that I used as a spamtrap, but the amount of spam I was getting was really overwheliming. Figuring I had nothing to lose, I started unsubcribing from every piece of spam I got. Contary to conventional wisdom, it really did cut the amount of spam I got in half. For a while. Then I must've hit 'one of those', because the gates of spam-hell were opened, and I ended up creating a new account. But I think there are at least some spammers who try to play it legit.
Slashdot headlines are often phrased as a simple question.
The answer to this one is: No!
So what are the rest of you commenting for?
"almost 200% effective against porn spam"
So... it reduced your incoming porn spam by 200%. Which means you somehow processed negative numbers of porn spam. Which, to balance the books, must mean you became a net exporter of porn spam? :-)
---
Cthulhu holiday songs, for the gift that keeps on loathing.
An uncontrolled experiment. You don't know that the 400% jump was due to the unsubscribe link. You should have created two addresses simultaneously, one where you clicked a link and one where you didn't, and compared.
In my experience, the most effective weapon against spam is source-IP-based email blocking.
This point is so obvious, I'm puzzled as to why it warranted an article, much less a posting on /.
Next week, we find that the penis-growing-rolex may not be real! The horror!
They take the unsub requests and diff them against their mailing lists. That allows them to quickly and easily compile a list of active suckers, I mean mailboxes. They in turn sell their new list of active mailboxes to other spammers. Thus causing the sucker to get more spam.
Spammers also take the list of unsub requests and flat out spam them, no questions ask, too. Anyone that gets themselves on that list is guaranteed to get the living hell spammed out of them because the list is in the hands of active spammers, not website scrappers trying to sell the list.
I have about a dozen domains I set up for the sole purpose of hosting spamtraps. I took a list of proper pronouns and compiled a list of just over 525,000 spamtrap addresses per domain. I used pronouns so that the spamtraps would have a legitimate appearance (some spammers got wise to the way of random characters). So I had this enormous list of spamtraps and I had Razor and Pyzor set up to submit spam to the DB. I also hadm y good buddy Procmail set up to munge the spamtrap address and forward a copy to NANAS and the FTC. So how did I go about getting the spammers to spam me you ask? Hell that was the easiest part of all. I automated the stuffing of their unsubscribe boxes with my spamtraps addresses. I used NANAS to find current (and active) unsubribe forms. I then either used wget or curl and some shell scripting to stuff the boxes, depending on whether they were POST or GET forms. Simple. Within minutes I was getting spam. Within a few days I was getting over 30,000 pieces of spam per day. That was after stuffing perhaps a dozen unique unsub forms. I stopped stuffing them after that because the flow of spam was saturating my cable connection. I have a co-lo that doesn't charge me by bandwidth. I should fire up the spamtraps again. This time I'll add DCC.
What?! My Rolex penis pills are fakes? Damn! Now I'm gonna hafta sell my Mercedes Tercel to pay for real ones.
Table-ized A.I.
Dammit. Where's that "Get your refund here" link?
This has been true for years, click on the link and the spammer knows they have a good address and you've actually read their spam...Update that address and send em more!
We are what we repeatedly do. Excellence then, is not an act, but a habit.
Yes, it's a nudie-pic site.
I checked it out a while back and subscribed briefly using an address specifically created for that site and never used or posted anywhere else-- and yesterday I got spam sent to that address.
Black Market Money
Click now!
(You'll also find an email address there: webmaster@blackmarketmoney.com.)
[sarcasm]
Lycos has released an anti-spam program that really works! Check your inbox for more details...
[/sarcasm]
They're commiting FRAUD!
They got a oh-so nice link that says unsubscribe, but when you click on it, they ignore it? Spammy then turns around and increases the sendto rate by 200%, resell the address, and oh, by the way, we'll joejob your account once we're tired of filling it up.
In the eyes of the Law, this constiutes Willfull Fraud, and more than a few other items in the United States Legal Code. Spelled out, means JAILTIME!
First rule of holes; When in one, stop digging.
i've never ever gotten a personal email asking me if i want to opt out, so i set up a filter to block anything that has the word "unsuscribe" in it. worked out well.
swanker than you
Seriously, just watch the ad. Salon isn't attempting to gather information from you like NYTimes or San Jose Mercury News does with their lockout schemes.
You watch a short ad. Big deal. Delete the cookie afterward if you're paranoid. I wish the other online newspapers would see the merits of this model.
Posting the content on slashdot like this just hurts the chance you'll see other registration-only papers switch to this relatively benign method of getting revenue.
That address list "affiliates were instructed to scrub their mailing lists" with is part of the getting started package intended to hook new affiliates with... ie: use these addresses and you'll see how good our product will sell for you.
This is 1 -time mailing. N0-re m0val are re'qui-red
The real question is how you recognize a "lazy" company, which doesn't bother selling your unsubscribed name to other spammers. Unfortunately, the main method I know for doing that is to use their unsubscribe link and see if you get spam. You can get fancy and unsubscribe your dummy spambait address, but many of the unsubscribe links I've seen have your email information encoded in them rather than listed transparently, e.g. "http://spammer.biz/unsubscribe/3485093285489035" as opposed to "http://spammer.biz/unsubscribe/addr=yourname@exam ple.net" so they're really just using the URL and not the address you unsubscribed from.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Yeah I actually got one of 'em a night or two ago, advertising replica watches of common expensive brands. Small world it seems. Or maybe just broad reach of spammers. It's just that the address that got spammed only gets one or two spam emails a day, despite the fact that it's "info [at] mydomain"...
McWilliams sets out in his article to prove that spammers ignore unsubscribe requests. He then signs up as an affiliate for a spam site so he can get his proof. As a check, he unsubscribes a little known e-mail address which has been getting spam from this spam site.
Lo and Behold, the spam site he's on actually HONORS remove requests and sends out lists to spam affiliates explicitly telling them to remove those e-mail addresses from the spam runs. Not only that, his little known e-mail address stops receiving spam from that particular spam site.
This wasn't really a very good article: no smoking gun, no body, no evidence of any wrong-doing. In fact, McWilliams effectively disproves his original assertion because he actually does get unsubscribed.
So why does the slashdot summary say that this article proves unsubscribing doesn't work?
I find the 'report this message as spam' was more useful...
I bitched to yahoo about the spam problem at my yahoo account.. I had been using spamcop to report spam and that had been semi-effective at stopping spam... but when I got enemy listed spam was flowing in at much higher rates than before.... But then yahoo decided junk mail didn't count towards quota, and was filtering most of the junk mail properly, and then quota went up to compete with g-mail...
So I get maybe 100 spams a day, but it's rare for more than 2 to slip past the yahoo!s spam blocking. So my yahoo account is usable again... for now... even though my hotmail account went up in quota, their spam filters suck. Yahoo!s spam filters can get over zealous at times blocking valid mailing lists etc, but I haven't had any important e-mail end up in the bulk folder...
https://www.gnu.org/philosophy/free-sw.html
There's tons of ancedotal evidence on usenet that shows that not only don't the remove lists work - using them often resulted in the account getting *MORE* spam.
Aren't we all decedents of apes? I suspect this does not have much to do with it, unless you are trying to say that spammers are human like the rest of us? I bet that's not what you mean, right?
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
The best way is to run your own mail server and simply prevent the spammers from connecting. One way is to add blackhole lists to your MTA (Sendmail, or whatever). That really did cut my spam quite a bit. But recently I noticed I was still getting quite a bit of spam directly from China and Korea decided to get tough and start blocking net ranges completely. I had tried blocking SMTP from a few /8 address ranges before, but this time I didn't want to unnecessarily block Australia or Japan, so I took the time to look at the /16 level to find sub-ranges to block.
It's already working, too. Here are the ranges I've added so far. (The second column is the number of connection attempts that were rejected.) At this point, I only plan to add new blocks as I encounter them in actual spam.
Oh, and those first two lines? Google for Cyvelliance and you'll understand why they're there.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
you could do a filter for the words subscribe or unsubscribe, then exclude any mailing lists you're on
I have had spammers remove my names from lists - Scotty Richter's OptInRealBig gang were particularly diligent about it, since they were trying to promote an image of legitimacy and responsibility. (yeah, right...) I didn't directly request that they unsubscribe, but I sent spam complaints to some of their ISPs from one of my addresses, and that address showed a noticable drop in spam while the other addresses they were spamming didn't. I didn't bother complaining to their direct ISP, which was an obvious front, but I complained to their upstream, who should have known better than to "send complaints to them for resolution", but eventually got the hint that they really needed to get rid of the problem spammer, not just get the problem spammer to remove addresses.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
i received a spam in my gmail spam box about a product that makes women "instantly horny"... yeah, right...
/ DJEum9tXL.html
it did have an "unsubscribe" link, so i clicked through and entered a brand new, created just for this address there. the link, for those willing to try is http://protesilaos.info/3ea2a2675e2fe363b4ffa9b7c
lessee now if spam starts flowing or not...
What ? Me, worry ?
Two years ago, it had gotten to the point that I was getting over 200 pieces of spam a day, and not the yummy kind that comes in a tin. Before initiating an email address change, I decided to try an experiment: see if clicking those unsubscribe links actually did anything. So, for one week, I followed the unsubscribe instructions on every piece of spam I got. The result: a 2/3 reduction in spam. That's pretty significant, but hardly worth the effort in my case, as I was still getting dozens of piece of spam a day, and unless you keep up with the unsubscribing, it just goes back up to the previous level within a few weeks, anyway.
So, yeah, you CAN reduce the amount of spam, but it becomes a regular maintenance task every day, and really isn't worth it in the end.
My advice: get your own domain and handle your own email accounts. Create special ones that simply forward to your main email address, to use on sites that require an email address for full functionality, and when you start getting spam, you know where it came from, and can shut that particular email forwarder down. It's a bit of a pain, but a LOT LESS pain than trying to unsubscribe from spam.
Obviously, anti spam tools like bayesian filters and what-not are always a good idea, but can let spam get through, and can block some wanted emails.
YMMV (but probably won't).
I've tried several times to unsubscribe from pandasoft's newsletter after having installed their bloatware and quickly deciding that I wanted my computer back. After my third attempt in 3 weeks, I am waiting to see if it worked.
Karma: Bad is the liberal way of saying this guy won't drink the kool aid here on slash dot. I wear my Karma with pride
Not loading images in not enough protection. The same unique ID trick can be accomplished with a BGSOUND tag, and yes, I have received spam messages using this trick. My personal preference is to always view the message body as plain text.
For a start. But it would take every ISP in the country, doing this overnight, to shut that route down.
After that, you need "undercover" agents buying the compromised lists that spammers use, and start blackholing those entire subnets. After you buy about ONE MILLION compromised machines, you're likely to see some kind of pattern.
The problem just isn't great enough yet.
Immensely useful, I agree.
To manage spam:
Create a Yahoo (or MSN or Gmail etc) account specifically for the purpose of spam reception. Don't put the word "spam" in the name of the account. Whenever you purchase anything online, or otherwise fill out ANY online form that requires an email address, use that one.
Create another (brand spanking new) account on one of the above providers or your ISP or wherever you want. Tell your friends to email you there, and also tell your friends never to put your email addy on a web form (like those "send this article to a friend" forms). Whenever they do anyway, bug them about it.
If you use yahoo chat, or IRC, or what have you, be sure that none of the information you provide (such as your screen name, the account with which you log in, etc.) can be traced back to your friends-only email account.
Also, make yet a third email account for professional contacts...job searching and so on.
I found this works quite well, and doesn't require you to use an anti-spam tool on your own network if you don't want to.
Back in the mid 90s, I did that. Hit a great many remove-me links. Spam did drop for a short period of time, but within a few months it was back with a vengeance. That address is now completely unusable, I get about 5 spams an hour on it, and have long since given up on actually being able to use it.
What happened, I think, is that the spammers in many cases did remove me from their own mailing list - while simultaneously adding me to the 'confirmed good' list they sold to other spammers.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Actually...I hate to tell you guys this, but most spammers use those unsubscribe requests all right. They use them to verify that the email address is active, and it goes into a higher priority hit list. Even if they're in the US where the law says they must honor your unsub request, there's nothing that says they can't sell the information to other spammers that this is an actively used email address with a real live person on the other end of it.
About 18 months ago I did a little experiment. I set up my own junk inboxes at different email services and started handing them out. Three of them I unsub'd every spam email I got, and the other three I didn't. Guess which one eventually ended up getting buried in 10 times more spam...
I have a friend that is quite intelligent. He did a spin on the same idea, and I recommend it to anyone that wants to cut their spam to one or two mails per week (or you could just get a gmail account--I only get a few spam messages per week over there). Here's how it works...
Go out to every free email service you can get your hands on that supports POP3 download. Hand those addresses out to every spam list you can get your hands on. Periodically (every hour or so) download those messages into your Bayesian spam filter, marking them as spam (salearn that comes with spam assassin, for instance). I know of no better way to train your filter system and keep your spam stats up-to-date.
Of course, this isn't totally free of manual intervention. There's the initial setup of all this, which is more or less a one-time thing, but for it to truly work well, you have to make sure you also pipe all your regular mail (ham, as spam assassin calls it) into your Bayesian filter as non-spam mail, and if any spam does show up at your regular address, make sure you sort it into a separate folder and deal with it as spam. The spammers are getting more and more clever every day, and the line between spam and ham gets ever fainter, requiring that much more learning by the filtering system to keep straight what's what. But it's really not more work than you go through anyway, and you'll collect far more stats to use against the spammers than you otherwise would.
And let's not forget the best part, either. Signing up for and collecting all that spam costs spammers a little change (though, you could argue it also costs the hosts of your spam accounts, though you can delete the downloaded messages off the server every hour as part of the d/l to try and minimize impact on them).
but have you considered the following argument: shut up.
No really, report spam to the RBLs. They'll work better the more they're used and the more timely. And they really piss off spammers, which is a Good Thing.
... a hotmail account of mine that I had stopped using because of intense spam. I never thought it would work, but I wanted to experiment with it anyways. I replied to every spam letter I could in there for maybe 10 minutes a day. It took about 2-3 weeks, but it's spic and spam free. I haven't gotten spam on the account for a year now and I'm a lot more careful about where I type my e-mail. It may seem at first that they ignore the requests, but if you're persistant enough you can have success.
The giveaway was the "200% effective" comment and the "abiout" spelling glitch.
That would work if the spam correctly reported its origin.
But that's not in the spammer's best interest. It's better for them to use zombies and open relays.
You'll bounce their message to a server that didn't send it and they'll bounce a message to you saying that such-and-such person isn't there...
It's better to just delete them (after sending the headers to spamcop).
Spammers are unscrupulous law-defying scum.
Eternity: will that be smoking, or non-smoking? I Corinthians 6:9-10
Dear Mr. Convicted Felon,
My name is Joe Blow living at 1234 Any Street, Any Town USA. I am writing you to opt-out of your crime spree target list. Please do not rob me or bugularize my home, even though I regularly carry a large sum of cash on my person and keep most of my valuable assets in my home...
ELOI, ELOI, LAMA SABACHTHANI!?
I'm running SpamAssassin at work. I flag all the spam and forward it to the end user (so they can find any false positives).
One woman set up a rule to delete the flagged spam AND to send a reply asking that they not send any more. It was very polite.
Yes, she was getting TONS of spam. I noticed it when she was on vacation and her mailbox usage stats shot up because she wasn't in the office to delete the hundreds of emails arriving every day.
Personally, I find it hard to believe that any spammer will remove any address from their list when I see "dictionary spam" every day (email sent to every last name in the phone book in the hopes that it might get through to a real person).
I have also set up a few fake names to use with SpamAssassin. I just use them to register at some sites and reply to them and they keep getting more spam. They keep getting spam.
Rule #1. Spammers lie. Remember that.
instead of having the list have email addresses stored, why not just long hashes of those email addresses. then, the spammers just hash the email address, submit to the list to see if its there, and do whatever based on if it is or not. anyway, not perfect, because people still wont follow the rules, but it provides at least a little wall of protection because SOME people would use it.
The spammers can reasonably assume that you don't want their message to begin with, yet they send it anyway. So what basis is there to speculate that they might even consider heeding an unsubscribe request? None, to me.
-b
myselfmusic
Has everyone heard about Sneakemail.com? I've been using it for a while, and I think it's great. You create temporary throw away email addresses that you tie to your real accounts. For someone like me without their own mail server, it's great.
Brilliant!
(I need to do this... create a bogus email, spam@mydomain.com and try it...)
"I have no special gift, I am only passionately curious." - Albert Einstein
Or at least read the end of the article. His volume of fake Rolex spam went down. It didn't stop, but it was reduced.
The wanna-be-sorta-legit spammers will respect the unsubscribe.
The don't-give-a-darn spammers don't care enough to differentiate between a "live address" and bogus/dead ones. They'd spam the power set of e-mail addresses if they could.
>> Update that address and send em more!
I really don't think this happens.
IF they look at the clicks on an unsubscribe link they will probably take you off the list.
BUT I suspect that most of them just ignore the clicks. They DO NOT care if the email address is valid or not. It costs nothing to send to a bad address, and someday it might belong to someone.
Some idiot uses one of those and they collect TWO addresses (the idiot's and the idiot's friend's).
Security through obscurity does not work.
Your address gets out one time and you're on the spam lists forever.
So is this actionable now? I mean is this enough proof to hit them where it hurts?
"he drew his sword Ringil that glittered like ice... and he wounded Morgoth with seven wounds..."
I use TheBat http://www.ritlabs.com/en/products/thebat/ for my email app at work. It won't load any html pages or images without permission. Gmail http://gmail.com/ does the same.
"Simplify, simplify, simplify!" Thoreau
I can't believe what Google did to Google Groups
I can't believe what Google did to Deja. When I needed web-news access (was without a machine at home), Deja and that old my-deja.com address did me fine for many a month.
-- now where did I put that
From the link you referenced:
The conference is free, but please register if you want to attend.
We will send you a message containing a link that you can use to confirm your registration.
(Don't use an address with over-aggressive spam filtering set up on it, because if our message bounces you won't be able to confirm it.)
So we are supposted to register for a free conference, on a web forum where they will send us an email? Oh yeah and by the way use a real email address, we promise not to spam you.
What crazyness.
- Bruzer
"Tempt not a desperate man" - Willy S.
Using one of my domains, I use a different e-mail address for every form i fill out like xyzcompany.com@mydomain.com or xyzcheeseoffer@mydomain.com ...
using this method it becomes easy to determine where exactly each piece of e-mail originated allowing me to determine where spam was coming from. what really suprised me is that i never get any spam.
the only things i get spam from are the following
-domain registrations
-offers from companies that send you e-mails because you signed up for their support forums, etc. or are an existing customer of them
-guess e-mails (ie. sales@ support@ webmaster@, etc.)
the worst spam comes from the free ipod offers and things like that online, even if you opt out of everything they will still send unsolicited e-mail directly from 3rd parties so you really have no idea where it originated, and the only way to opt out of the e-mails is to find the website of the place that originated the offer and find an unsubscribe page (not listed in the e-mail) and enter in the e-mail address you used to sign up for the ipod or whatever in order to stop all the other unsolicited crap.
i use different e-mails in newsgroups and all sorts of public forums all over the internet and have never had any of them phished.
in conclusion, if anyone wants to try this, you'll see that spam is a lot easier to stop than you think, if you know where it's coming from, you can stop it, and i've never not been able to unsubscribe from anything.
maybe some other geeks will get some ideas off this as well. and if the people running this spam test wern't doing this sort of thing, then i hope they had some way of differentiating where the mail came from (i haven't read the whole article yet)
hope this helps someone
1) Use a long email address that is difficult to brute-force
2) Only give it to real people
3) Use a mailinator address for online registrations and whatnot where you have to read a reply.
4) For those sites that force you to reply from a real email address to complete registration, use a spam webmail address.
This has stopped almost all spam from bugging me.
Anecdote: My first email address ever was from Cornell in 1990. Cornell has a policy that lets you keep your email address for life by setting up an auto-forward after you graduate. The irony is that Cornell, back in the days before spam, unfortunately picked an address format (initials+number@cornell.edu) that turned out to be easy to brute-force, and that I've since had to turn the auto-forward feature off due to too much spam, defeating the purpose of the "lifetime email address". oh well...
Check out U.S. Bank's Unsubscribe page. Basically what you do is click no on everything, put a checkmark in the checkbox and click the submit button.
The interesting thing is it asks if you're 13 years old or more. If you choose "No" then it won't let you unsubscribe. So if you're under 13 and truthful then there's no way to stop getting mail from them. And one could argue that no 13 year old has a bank account but then, why would they ask the age?
I just thought that was interesting.
I think in this case attack can be the best form of defense. We know that certain IP's are legitimate in the address headers.
Correct me if i'm wrong but the email headers correctly display the orriginating IP address for the spam. What if we had a program that would, once it had determined that the email was spam, would periodically spam/ping/??? the originating IP. If everyone used such a program, as the amount of outgoing spam was increased, the amount of incoming activity would exponentially increase at some point either bringing the compromised machine to the attention of someone or simply just bring it down.
Even if some of the IP headers were spoofed, the last legitimate IP in the chain of IP's would be the 'closest' compromised machine and this in turn could be targeted.
To receive this URL, just send $5 to aheine@hotmial.com using Paypal, and within 24 hours you too can be spam-free!
I have gone through AT&T's unsubscribe process many times, to no avail. Even though they tell me they'll stop sending me 'promotional' email, they still do. I have reported it to the FTC, and am planning to take my service elsewhere.
The FTC did reply to say that not unsubscribing someone, even if they are your customer, is in violation of CANSPAM. They were less than clear as to whether or not they'd actually do anything about it.
Well, if you read the article on Salon they say:
"The U.S. Computer Emergency Readiness Team (US-CERT) warns that unsubscribe links are "often just a method for collecting valid addresses that are then sent other spam." The FTC has sent warning letters to at least 77 marketers for their failure to honor unsubscribe requests.
Sure, a few spammers might take your name off to avoid trouble. But to most, you're merely confirming that they've found a live one. Next thing you know, they'll have sold your e-mail address to other spammers as "validated" -- or, in other words, ready for spamming."
Why would a spammer ignore a "good" address?
An ethical business would remove you when you click on these links but then spammers aren't ethical.
We are what we repeatedly do. Excellence then, is not an act, but a habit.
Like those full page banner ads. ... Sorry, I didn't RTFA...
It's funny how one of the two major providers here in France (Wanadoo, to name it), which is supposed to be a serious source, though commercial, won't let you unsuscribe from their news/offers mailing list even though you follow their opt-out prodedure.
Here and there I've encountered similar issues with various websites that are in no way related to spam. They would just keep sending you their mailing list / special offers even though you clearly asked them not to bug you anymore.
Based on that experience, opt-out options seem to me to be here for nothing but the kick in a whole lot of cases. Hopefully I learned how to make a good use of hotmail adresses and mailinator.
Clicking the unsubscribe links is actually worse. Not only do they ignore your request to be removed from the list, but they now know you check that account.
a mail client that displays external images isn't a geek.
Maybe being on too many unsubscribe lists flagged his address as a spamtrap. This supposes better coordination between spammers than may exists, or course, but I sure wish it would happen to some of my accounts...
This is not my sandwich.
I have an account at my university that I used when Usenet was the thing, aka 15 YEARS AGO. I never played with it outside of there, and I used to have a few thousand emails waiting for me every few months. Only recently did I forward everything to /dev/null.
More recently, I returned to a consulting job I had left 6 years prior, around the start of the WWW days, when Usenet was pretty much the big thing. I re-opened my closed account, and received 50 spams within 30 minutes. Eesh.
My addresses were obviously harvested from Usenet archives (or maybe groups.google.com, but I digress). I pity the people who buy these 'guaranteed' lists of email addresses, expecting all addresses to work.
Set up your mail to automatically look for 'opt-out' links and access them - and even fill in the form automatically - now for the bonus, if you get any mail from that place after 24 hours your program should hit the opt-out 10 times with 9 non-existant email accounts, if they still dont stop mailing you you keep doubling that 20, 40, 80 etc. If they are infact using the opt-out form to check if your account is real/read then they will start trying to spam all the other accounts (that don't exist) too. By even having an opt-out link that takes you to a web-page they are giving you an open door to hit them with, take advantage of it and kick them in the balls.
This comment does not represent the views or opinions of the user.
- Bolexes
- "Penis Extenders" (from the article and I *DON'T* want to know what that is!)
- Soft-Tab whateverthehells
- V!@G4rA
- etc.
I mean it costs them nothing (essentially) to spam me but it seems that it would still benefit them to say:"hey we have a strict unsubscribe policy, so if someone's address is on our list, they LOOOOOOVE to get ads in their inbox".
Reading the article, it seems to imply that the "affiliate" gets a cut when a product is sold. Not just because an email was sent. So once again, why persist in sending me email that will NOT get them a sale. Just because they hate me?
It's funny, because I have two email addresses that I've had since about '94' and I get SCADS of spam. It got to the point that I started clicking "unsubscribe" as well... More or less out of desperation even though *I* should know better as well.
This sounds like a great plan, but where do I find a free service that lets you do POP? Yahoo, Hotmail, and Gmail don't. Sean
"Dictionary attack".
It only needs to happen once. Then that email address is screwed forever. It's happened to me, even though I've practiced good e-mail hygiene all along - and I can't easily change the address.
Sean
I dunno, but I had a similar issue in my preferred older Netscape (javascript disabled) -- no way to just view the damned ad and go on by to the content. It was subscribe or nothing. I chose nothing, in the hope that some kind soul would post the content here. I wouldn't have had a problem with viewing a plain old text ad on an interstitial page, but this must have wanted to load something I don't use. Telling me my browser isn't good enough to view their ads is adding insult to injury.
~REZ~ #43301. Who'd fake being me anyway?
>> Why would a spammer ignore a "good" address?
My point is more the other side of this.
Why would a spammer care about a "good" address?
It costs them nothing to send a single piece of spam to an address. (or a 1000 to the same address)
So they can do more work and "verify" good address, or do nothing and use them all.
The "good" addresses are worth nothing more then the bad ones, so why seperate them out?
Is this a joke? I expect this question from my mother who knows basically nothing, not from slashdot editors who know...uh, never mind.
Pay no attention to that man behind the curtain!
Always use extension addresses in qmail when publishing your e-mail. username-SD@domain.com goes to username if there's not a user by that domain. Then you can easily block that domain. Anyone with questionable policies should indeed have an extension address. -M
when you see the word 'Linux', drink!
Look at it from a business perspective. Spammers sell address lists, right? Now don't you think that a list with 100% verified valid addresses would command a higher price? Your address is worth more money if you validate it with the unsubscribe links.
http://shit.slashdot.org/article.pl?sid=04/12/15/1 519257
Some spammers use "Unsubscribe Link" as a mechanism to verify the validity of the email addresses.
Also the URLs for images in HTML emails are tailored to confirm that you have actually opened the email and your email-id is valid.
--
Anand Babu
When you think about the motive behind SPAM the action of unsubscribing shows that the SPAM has worked - you had to read the SPAM to find the unclick button.
-- The Pumped Penis
perl -e 'print $i=pack(c5, (41*2), sqrt(7056), (unpack(c,H)-2), oct(115), 10)'
If you're really interested in not pulling 1x1 tracking images and the likes, you could just set a firewall on your machine to block your mail app from talking to anything but the mail server...
Do that, and spam emails can then request all the crap they want - they'll just get dropped without them going anywhere.
I watched the ad twice using Opera, when I got back to the article it still told me I had to register or view an ad to see the whole article. Then I decided to try with Firefox and it worked. You might need to use a different browser.
I love GMail's filter. It gets the occasional false positive, but only from mailing lists (mostly at yahoogroups) that I actually did subscribe to. Actual personal mail always gets through.
And the filter is improving. I have another email account that's set to forward all messages to GMail, which means a lot of spam gets forwarded too. I've never actually marked any of it as spam in GMail, because it all appears to come from me (my other address) and I don't want to report myself as a spammer. But about a week ago, GMail starting accurately filtering that mail too, even though the spam and the real email all has the same "From" address.
It also has a link to a warning page about phishing whenever an address looks spoofed, which is nice.
I often read Salon, but always look at another tab (or work in a different app window) during the ad. The advertiser doesn't know, so Salon still gets revenue.
The thing to watch out for is sound: Some of the ads have audio, so you need to mute your speakers before visiting Salon.
When you recieve spam, do not click to remove..
:-)
What you are *supposed* to do is click on the "yes I want to buy it" button. Then go to the web page and fill in a credit card (any numbers will do), or dig out an old cheque book from your attic..
"You lied to me! There is a Swansea!"
any emails identified as spam get sent back to the sender. If spammer doesnt exist then thats ok because joeUser who is too ignorant to keep virus's off his computer will be shut down, as will ignorant sys ops who cant control their mail servers. Take out the zombies!
Please mod parent -1 redundant & -1 illegal
The best filter: Filter the word "Unsubscribe", it filters out most of the spam I get.
Change is certain; progress is not obligatory.
I use that method too. If I get so much as one spam per month, I switch the address. But I have gotten nailed by dictionary attacks. You cannot use a common name or any word that would appear in a dictionary.
Quite an experience to live in fear, isn't it? That's what it is to be a slave.
So, basically by joining that blackmarketmoney site, you get to download a whole list of active email addresses?
"Oh please don't rob that guy, even though he's got money. Here's his address so please, don't go by there ok? *wink* *wink*"
eTrade SUCKS
Submit a request for their mortgage (or buy the rolex)...
51992019 times (at last check)...
with a made up name...
and the phone number and street address of the FBI office in NYC (or maybe CIA or NSA)...
and the email address of their hosting provider's abuse department...
I'm sure they filter it out, but if enough geeks "validate the quality of the company we wish to transact business with" using, say, apache benchmark (ab), then the bandwidth costs and CPU time they have to spend on the constant flood will re-balance the cost effectiveness of spam.
Yes, it's basically a linux version of the Lycos screen saver that doesn't care if the spammers site is DoS'd.
Then again, constantly having ab running could be the cause of the sizzling sound that was made by my cheap switch right before it died.
We're Microsoft: Your potential (to receive spam) inspires us to create software that helps you achieve it.
There are several, of which Taxpayer ID and Dun & Bradstreet (DUNS) numbers are the two best known, and cover either all registered corporations or the bulk of major US businesses (2.7 million per research). As business incorporation is handled at the state level (in the US), there are probably state corporation numbers as well. There's also the UNSPC, through the United Nations.
As you point out in a followup, there's no requirement that such identifiers be used in advertising, product packaging, or other communications. Sure, that would be somewhat useful, but....
...there are huge numbers of organizations not covered by such regimes (think sole proprietorships (my TID is my SSN)), overseas companies, and/or illegal operations. Believe me, as someone who's worked extensively in data tracking, the task of identifying and assigning IDs is decidedly nontrivial.
The other problem is this: IDs are cheap. It's trivial to generate various forms of identifiers, and even incorporating is a relatively minor expense against the possible benefits of such actions. Look at the huge number of corporate shell companies, particularly operating out of offshore "safe haven" states such as Hong Kong, the Bahamas, etc.
The problem of tracing corporate relationships and holdings is decidedly nontrivial, and is a major field of law practice. D&B do claim that D-U-N-S tracks families of companies, no idea how successful they are.
What part of "gestalt" don't you understand?
in my experience, youre a fucktard
Does anyone have an idea what was the "special look-up tool" he used to find the other domains hosted on the spammer's server, that eventually led him to blackmarketmoney.com?
I'd wondered about doing this to Phishers, only their software has got a little more intelligent recently and now does things like checksum checking on credit card numbers. I'd have to be able to create random credit card numbers with valid checksums to get past that.
Would a Phisher's database be so much less valuable if badly polluted? Would a software package to allow many people to automate the process be of use?
The only thing I ever put in an unsubcribe link are the ARIN e-mail contacts for the level 1 provider for the unsub link.
An engineer who ran for Congress. http://herbrobinson.us
My wonderful webhost (like many others) lets me have as many email aliases as I want. So every time I sign up for something online, I just use a form of whatever I'm signing up for (kim4abcwebsite@mydomain.com).
That way, as soon as I get my first spam, I can:
1) Kill the alias
2) Reliably report the offender, since I know that there's only 1 website I ever gave that particular alias to.
It's beautiful AND educational.. for example, I never would've guessed that the NY Times would be sellin' me.
(I know that a lot of you are already well aware of this tactic, but judging from previous responses, there are still a few who are not.)
I would expect an address that receives lots of "spam" due to agreeing to get ads many years ago to drop in spam level due to massive unsubscribing. I would say that most of the commercial email received on such an account may be considered solicited as probably the recipient has agreed many years ago that the adress be shared for this purpose (I still remember myself thinking many years ago: "cool, if I check this box I would get even more info on this from sources I don't know about!" - spam was not a problem back then).
So it might be that an address was shared with many senders of commercial email that are "legit" and would honor an unsubscribe request.
On the other hand, the behaviour of a single email account at a specific short time cannot serve as evidence for anything. I've seen great fuctuation in spam rates received at some of my accounts, with no technical changes on my side (including my provider). It seems more like the particular spammers that have my address. One week they have "good business" and send lots of spam. Another week they have "bad business" and send little spam. Spammers don't sell spam for free. They only send it if someone pays them to send something. If they don't have a customer that wants something to be sent, you don't get their spam!
About unsubscribe links: I tried "unsubscribing" disposable addresses (usually of the form spammer19dec04.erase.hadaso@spamgourmet.com) and I never got any spam to any of these addresses. I only once got spam on an address I used to forward "funny stuff". I got many spam messages to addresses I posted on online forums or other online places. (and if you want to receive spam, the best way is to post it on slashdot. Much faster response than posting on "whois" for your domain, or any other online forum I tried. Don't do it to train your filters. every email address receives quite a different blend of spam, depending on the ways it was exposed, so to train your filter you better use only the spam and ham you receive on the account you want to protect, and if you can do it separately for email you receive at different addresses you should get better results).