Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Spam The Internet Your Rights Online

From Artist To Spam-Hunter 271

Posted by timothy from the bourgeois-distinction dept.
I am Kobayashi writes "Wired has a story about Andy Markley, a graphic artists, whose business domain name was spoofed by infamous spammer Eddy Marin and used to spam thousands of people. After the incident recurred at a new ISP, and at the risk of his business and sanity, Markley fought back. He tracked down Marin through several spoofed email addresses and several hi-jacked servers, and eventually was successful in getting Marin's current ISP to shut down his account. Too bad he was a graphic artist and not a professional bounty hunter...."
This discussion has been archived. No new comments can be posted.

From Artist To Spam-Hunter More

From Artist To Spam-Hunter

Comments Filter:

  • glad for one positive hit (Score:5, Interesting)

    by SHEENmaster ( 581283 ) <{ude.ktu} {ta} {sivart}> on Tuesday September 30, 2003 @08:24PM (#7099918) Homepage Journal
    Get 10,000,000 more of these guys and major domains will start accepting mail from innocent bystandards like me that are unlucky enough to be on small subnets again.

  • Spamming (Score:5, Informative)

    by Henry V .009 ( 518000 ) on Tuesday September 30, 2003 @08:26PM (#7099932) Journal
    Spamming is such a dirty business that most spammers will commit some illegality somewhere. Their character is rarely that of a saint. And most ISPs will do anything to keep a spammer off of their bandwidth. So if you go after a spammer, there will probably be some dirt to smear him with somewhere.

    • Wrong (Score:4, Interesting)

      by segment ( 695309 ) <sil@politri x . o rg> on Tuesday September 30, 2003 @08:42PM (#7100030) Homepage Journal
      And most ISPs will do anything to keep a spammer off of their bandwidth

      Most can't do anything about it coming into their networks. Going out yes, but coming in, there is nothing that can be done unless every single customer agrees that spam should not reach their mailbox. See in order to add those kinds of rules to a router, it has to correspond to all. No ISP is going to update multitudes of routers to add one rule for one person.

      • Re:Wrong (Score:3, Informative)

        by LordLucless ( 582312 )
        I assume the grandparent is referring to the ISP providing the spammer with his service, not the ISPs providing the intermediate jumps. I'm pretty sure any ISP would disconnect anyone who it can be proved has been spamming.

      • Re:*You* are Wrong (Score:5, Informative)

        by mckyj57 ( 116386 ) on Tuesday September 30, 2003 @10:25PM (#7100571)
        No one does spam filtering at routers.

        There are filters and blocklists, but they have nothing to do with
        routers. Long ago particularly egregious spammers were blackholed at the
        router level, but that hasn't happened for years.

        No ISP can stop all spam, but given enough resources we can stop most
        of it. The problem is usually somewhat like you allude to, that there
        is a certain set of people with an absolute horror of a non-spam
        message being bounced. They claim "loss of email", and thereupon close
        their ears.

        But there is a more insidious foe, the scan-and-delete error.

        Most admins today have two basic ways to stop spam -- blocking and user-
        based filtering. Blocking rejects spam detected (via filter or
        blocklist) and puts the onus on the sender to re-establish the
        communication. User-based filtering puts the onus on the recipient to
        review their spam folder and look for "false positives".

        And there are three ways to play your two tools.

        1. Little or weak filtering or blocking means communications are lost as
        people have scan-and-delete errors due to battle fatigue from their
        daily fight with spam in their mailbox. Much legitimate email is
        lost, and it is lost and *neither party knows it was never read*.
        This collateral damage is spread over every part of the net,
        spam-friendly or no.

        2. Aggressive filtering and tagging for dropping in the user's "spam"
        folder means that legitimate communications are tagged as false-
        positives. People usually don't scan their spam folders carefully,
        because such a high percentage is spam. Again, legitimate email is
        lost and *neither party knows it was never read*. This collateral
        damage is spread over every part of the net, spam-friendly or no.

        3. Aggressive rejection of email via blocklisting causes some legitimate
        email to be rejected. However, that collateral damage is limited to
        spam-friendly parts of the Internet. The sender knows full well it
        was not read and can re-send the message via another channel if it is
        important. This knowledge also allows them to take action to correct
        blocking errors; and heightens awareness of who is not doing their
        part to fight spam.

        To me, selecting #3 is a no-brainer. When legitimate email gets lost,
        the sender knows it was not received. And it is almost all lost from
        networks participating in the massive denial of service attack on the
        Internet at large that is spam.

        AOL, for example, does a simply outstanding job of making sure spam is
        not sourced from their network. They don't allow spam hosting of any
        kind. I *never* want to lose mail from them. Same with Earthlink, MSN,
        and Hotmail. They deserve that consideration due to their effort. If my
        users lose mail from them due to scan and delete errors, I have not done
        my job. I would much rather have them lose email from the people who pay
        the spam-friendly providers. (And no, folks, those fake hotmail.com
        addresses in the From line don't mean they source spam.)

        You can do filtering at the MTA level too with rejections, but I don't
        do that except with filter settings that have a near-zero false-
        positive rate.

        • 3. Aggressive rejection of email via blocklisting causes some legitimate email to be rejected. However, that collateral damage is limited to spam-friendly parts of the Internet. The sender knows full well it was not read and can re-send the message via another channel if it is important. This knowledge also allows them to take action to correct blocking errors; and heightens awareness of who is not doing their part to fight spam.

          Anyone who reads somethingawful.com kno

          • SomethingAwful??? (Score:3, Interesting)

            by Eggplant62 ( 120514 )

            Anyone who reads somethingawful.com knows that this isn't necessarily the nobrainer that you think it is. They had a particular problem where people would be able to sign up for their forum accounts, but they could not be mailed back with the activation because of the SPEWS blacklist determining that the part of the internet SomethingAwful belonged to was Spammerville, USA. This meant that 10-20% of the people who tried to get a forums account couldn't be mailed back, and SomethingAwful could even mail the

    • Re:Spamming (Score:5, Funny)

      by Chris Burkhardt ( 613953 ) <Chris@MrEtc.net> on Tuesday September 30, 2003 @09:12PM (#7100186) Homepage
      > Their character is rarely that of a saint.

      Maybe not, but I've seen spam from monks selling laser toner [lasermonks.com].

      Seriously, someone should tell the monks that spamming is not good.

  • The Spam Hunter - Crikey! (Score:5, Funny)

    by Kenja ( 541830 ) on Tuesday September 30, 2003 @08:27PM (#7099939)
    Here we see the Spammer in his native environment, lets pull his network connection and see if we can get him rialed up. Crikey, look at em dial tech support!
  • Verio is notoriously spam- and crime-friendly. So much so that I wouldn't be surprised if their management sold their children out to child pornography websites.

    As for convicted coke dealer Eddy Marin, he deserves horrible and painful death for his actions. It's sad that no one has taken him out yet.
    • There's nothing wrong with dealing coke.

      Spamming, on the other hand....

    • Coke Cover (Score:4, Interesting)

      by _Sprocket_ ( 42527 ) on Tuesday September 30, 2003 @11:03PM (#7100794)


      As for convicted coke dealer Eddy Marin...

      Not that I would dispute the accuracy or honesty of someone who makes a living from such activites as spamming and (apparently) dealing coke... but...

      Ya suppose all this money Eddy likes to gush about in interviews comes from an activity other than spamming? Wouldn't spamming make a great way to launder income. Its already a shady, though not entirely illegal business. It wouldn't be too odd to have a customer base that's a litle difficult to trace. And it would explain a solid income without any apparent labor, contacts, or business partners.

      (not that this little conspiracy theory has plenty of holes - but hey, that's not the fun of it)

  • Amazing story! (Score:4, Funny)

    by antic ( 29198 ) on Tuesday September 30, 2003 @08:30PM (#7099955)

    Wow, what a revenge! This has all the exciting hallmarks of the most boring story in the world. He shut down a single ISP account. I'm stunned!

    I hope the author isn't holding out for a script-writing deal for anything starring Chuck Norris or Lorenzo Lamas. It's hardly going to get rapped about by Dre, is it?

    From Artist to Spam-Hunter to zzz...

    • So Chuck Norris, Lorenzo Lamas, and Dr. Dre are what is important in this world?

      Besides, how many spammers have you stopped lately, eh?
      • No, his point is that they are two barely-actors, Chuck being long past his prime and reduced to crappy TV shows, and Lamas being a B-movie flunky at best.

        I've been responsible for a hell of a lot more than 1 spammer losing their Internet connections, it never occured to me to put out a press release. This is none news... I give it a 1 out of 5. Now had it involved SCO, I would have gone with 3 out of 5, because I just love reading about SCO and their wacky antics... now thats a good topic for a movie,

      • Besides, how many spammers have you stopped lately, eh?

        I think the point is that the spammer wasn't "stopped", he just lost one ISP account. Spammers churn through these at a great rate anyway. Has he stopped or even slowed down? Did he even notice that he'd been "hunted down"? (I was expecting/hoping that he'd turned up on the spammer's door with a bailiff or maybe a shotgun.) Was he fined one cent for impersonating the poor artist and costing him thousands of dollars in lost time and business and damag

    • You know, just because it's only on a small scale doesn't mean it's boring. Heck, RIAA suing a 12-year-old Girl made the newspapers, and I heard about that lawsuit before I knew what RIAA was.

      Besides, such effects seem to snowball in the courts. If smalltime people can shut down one ISP, then they'll shut down another; where there might be only one case this year, a year or two down the road there could be twelve

    • Re:Amazing story! (Score:5, Funny)

      by sharkey ( 16670 ) on Tuesday September 30, 2003 @08:41PM (#7100027)
      I hope the author isn't holding out for a script-writing deal for anything starring Chuck Norris or Lorenzo Lamas.

      No, but it seems to be prime material for Kevin Costner's next magnum.

    • Re:Amazing story! (Score:2, Insightful)

      by mckyj57 ( 116386 )
      Wow, what a revenge! This has all the exciting hallmarks of the most boring story in the world. He shut down a single ISP account. I'm stunned!

      You think Eddy Marin fools around with a single ISP account like a dialup? I believe WCG had him signed up for a dozen class C networks...encompassing a couple thousand IP addresses.

      If Eddy Marin wants a single account, he just rapes a proxy. He needs the class Cs to do the sinultaneous raping of thousands of them.

      If you are a Windows-head, which it sounds like y
      • You know that paragon of Open Source development methodology, sendmail? The one thats responsible for the massive proliferation of proxies on old and poorly administed mail servers all over the world? Remember what OS that runs on.

  • SpamCop will help with backtracking headers (Score:3, Informative)

    by Spazholio ( 314843 ) <slashdot.lexal@net> on Tuesday September 30, 2003 @08:30PM (#7099956) Homepage
    If you want to do the same thing as this guy, try using SpamCop [spamcop.net]. Paste the entire email (with headers, duh) there, and it will backtrack the message to where it originated. It will tell you which company it came from, which one is being advertised, etc. For the especially lazy, it will also allow you to send a carbon-copy form letter to all parties involved. Best of all, it's free. Consider donating though, it's worth it.
    • I completely agree.

      Actually, if you're considering donating, you should consider signing up for their paid service. For $3/month, you get just about all the e-mail features you could want, and on top of that, you can submit spam reports much more easily.
      • What has your experience with SpamCop's system been? Does their filtering work well? For $30/year I may try them out: I like the fact that they support IMAP and can process mail from external domains. Impressive.
        • I've been using spamcop's webmail for personal email for about a year and a half. I'm pretty satisfied with it. Once every few months a spam gets through the cracks, and I cut and paste the message source into their spam reporting form, and it sends emails to the ISPs. They also give you the option of using spamassasin in addition to their blacklist.

        • Re:SpamCop will help with backtracking headers (Score:5, Interesting)

          by Phroggy ( 441 ) * <slashdot3&phroggy,com> on Tuesday September 30, 2003 @11:47PM (#7100993) Homepage
          What has your experience with SpamCop's system been?

          Nothing but good things to say about them, and I've been on the other end too - I've worked in the abuse department at an ISP, and the vast majority of our spam complaints came from SpamCop. They put all the most important info in the subject line and the reports are all formatted consistently, making it very easy to deal with them. We were understaffed for awhile, so the SpamCop reports were the ones I dealt with first, because I could get them out of the way faster.

          I also use the service myself. There have been some occasional glitches, which have almost entirely been due to denial of service attacks. These glitches have not caused me to lose mail, but DDoS attacks have caused mail to be delayed on occasion - normally it's delivered in seconds, but I've seen it take a day or so.

          The way I have it set up, mail to my domain is forwarded to my SpamCop account, and anything that doesn't get stopped by their filter is forwarded on to my server at home. If I have any problems with my server at home, I can disable the forwarding and use SpamCop's webmail temporarily.

          Depending on how you have things set up, if SpamCop thinks something doesn't look right, it is possible to report yourself to your own ISP's abuse department. They don't like that much. When submitting a complaint, be sure to review the list of addresses the complaint will be sent to before sending it.

    • Re:SpamCop will help with backtracking headers (Score:5, Informative)

      by stilwebm ( 129567 ) on Tuesday September 30, 2003 @09:53PM (#7100380)
      OK, enough of these wise-guy posts saying "I've cancelled spammer's ISP accounts before too" and "he could have just used SpamCop." First of all, if you are at all familiar with spam operations, you would know that spammers do not use mail servers hosted on their own network 95% of the time. Second, if you RTFA, you would see that was exactly the case. The article clearly states that he "painstakingly worked his way through a half-dozen hijacked servers."

      These were likely servers that had been compromised or accidentaly misconfigued and turned in to open proxies. Spammers use dozens of these per mailing. However, they have to send the spam to these hijacked servers from somewhere. Much of the time these are home users on cable modems or DSL, so this isn't always easy. There is no trace of the actual origin in the headers, just the proxy or relay. The ISP shuts down their connection and the spammer moves on. The hijacked server often has no record of the actual origin of the mail, or upon being cleaned, the records are cleaned. In this case, the victim was able to find where the proxies were getting the original messages from. This isn't as simple as submitting to SpamCop.

  • Professional Bounty Hunter (Score:5, Funny)

    by nacturation ( 646836 ) <nacturation@gmai[ ]om ['l.c' in gap]> on Tuesday September 30, 2003 @08:31PM (#7099961) Journal
    Qualified candidates must be professional bounty hunters with verifiable experience and verifiable references.

    Yes, my name is Boba Fett and I worked for a Hut called Jabba -- this was a long time ago and in a remote galaxy. During my tenure with Jabba, I successfully tracked and captured Han Solo, wanted for failure to pay back a sizable loan.

    I'm fully familiar with the use of various weaponry, grappling hooks, and personal rocket packs. I have also done consulting work for Mr. Vader, a well known businessman who spearheaded the creation of a large spherical space station.

    References available upon request.

  • Identity theft (Score:5, Insightful)

    by BWJones ( 18351 ) on Tuesday September 30, 2003 @08:33PM (#7099970) Homepage Journal
    So, this is identity theft. Why cannot spammers be prosecuted for assuming somebody elses "identity" and doing business/making money at the expense of others? This practice is illegal and there must be a legal precedent, yes?

    • Re:Identity theft (Score:3, Insightful)

      by donnz ( 135658 )
      Took the words out of my mouth.

      Why all the new laws required outlawing spam when *all* spam I receive is fraudulent (as is the practice of highjacking my businesses ID for spam)? I have cannot remember the last time I received unsolicited marketing material where email headers and the email itself was not fraudulent.

      This is what our public prosecutors should be chasing down and gaining convictions on - can anyone tell me why they are not?
      • Successful prosecution of coke dealers, murderers and rapists is better material for career advancement than putting a spammer in the slammer, I'm afraid. The mere existence of a law does not imply actual enforcement.
        • Ok, point taken. But why bother creating anti-spammer laws that probably aren't needed and won't be enforced? Maybe the odd sucker vote or two.

      • Re:Identity theft (Score:3, Interesting)

        by k12linux ( 627320 )

        I have cannot remember the last time I received unsolicited marketing material where email headers and the email itself was not fraudulent.

        Just today I got an e-mail for a service I actually could have used. But as is my policy, I wrote back that I would have liked to discuss thier product, as it appears to meet a current need. Then I said that I could not, however, do business with a company who chose to use spam to advertise.

        Very quickly I got a reply stating "if it was spam would I have time to

  • i expected a "and he torched the spammer's luxurious mansion in revenge" kind of ending... :(

  • How appropriate (Score:5, Funny)

    by Gunfighter ( 1944 ) on Tuesday September 30, 2003 @08:35PM (#7099987)
    After seeing what looks like a solid plan for spam [trainix.com], I decided to change my business model today. You can read all about it here [packetvision.net].

    Finally, something to fill in the ????? in my
    1. Linux
    2. ?????
    3. Profit!!
    business plan. Now I don't have to hide my email address(es) anymore!
    • I hope this is satire. This is silly (stupid?) and would be akin to me having a site policy at the bottom of my website that says "LOL IF U VISIT THIS SITE U OWE ME 5HUNDRED BUX."

      If a user does not consciously agree to a contract, it is not binding. Period.
      • Yes... definitely a little satire in it. Even my wife asked me if I really planned on sending out invoices. For the record: I do. If I don't keep a record of it, I can't write it off as a business loss on taxes ;)

        Also for the record: I've never received any spam at that domain, and this really was changed just today. So while it is meant to invoke laughter, I do intend to do it. After all, it's much cheaper than the alternative: $25,000 per unsolicited commercial email under Commonwealth of Virginia law.

        • Re:How appropriate (Score:3, Insightful)

          by Styros ( 144779 )
          IANAL. Just to get that out of the way.

          I've been thinking about your "service", and I think it can be legally binding. Similar agreements exist, for example those catch-22 EULAs and the infamous Opt-Out agreements, where if you register you "automatically" get signed up for ads, unless you specifically opt-out. I think you're service stands a chance if you add some statements based on the EULAs and Opt-Out agreements that I've seen:
          • The EULA is in theory binding if you click on the "OK" or "Agree" but
      • This agreement is just as binding as shrinkwrap licenses, or the Verisign SiteFinder EULA.

        The page linked above may seem silly, but a sufficient number of them posted across respected domains may throw a curveball into any EULA case.
  • It would be great if governments like the U. S. gave 15 million dollars to a new force to track down spammers. The penalty for spamming is now 5 years in federal jail. 50 million people signed up for the national no-call list. I bet millions would back such a SPAM squad. It is too bad the government doesn't seem to care.
    • Dude the government is us! If enough people care, you will see the law go through congress like nothing else. No congress person is going to go against 50 million Americans, no matter what. There are not enough special interests in the world for them to even think about it.

      If enough people want it, sometimes Congress actually responds to the needs of the people, pretty neat idea huh? :)

  • If SPAM == $$$... (Score:4, Insightful)

    by thecampbeln ( 457432 ) on Tuesday September 30, 2003 @08:48PM (#7100057) Homepage
    ...Then we should get laws that attack the $$$ part of the equation!?

    Although the logistics of such a plan are always complicated, why not author laws that would hit spammers where it really hurts: their financial institutions!? Since you can buy the shit from these bastards, you should be able to determine where the money is going. So make laws that would seize any such moneys that are a direct result of SPAM activity?

    Hell even put the onus on Visa/MC/AmEx so that they are charged with dealing with the financial fallout! Do you think even the idiots who buy shit form SPAM would buy again if they were charged double for their purchase (once from the spammer and again from the credit card company for the penalty)? Sure there are bugs in the plan as is, but stopping SPAM from the technical side is difficult (if not impossible), so lets make it financially infeasible!

    • a) Unless the actually catch the spammer or trace to the distribution source, how do you tell what is bought from a spammer VS not (there's also legit sources, ebay, etc

      b) You may argue fining the company for whom the spam is soliciting a product... but if you look up the term "Joe Job" you'll see why this isn't a great idea either.

  • Legal question (Score:5, Interesting)

    by Michael Woodhams ( 112247 ) on Tuesday September 30, 2003 @08:51PM (#7100079) Journal
    A scenario: Someone damages you, but it is hard to figure out who it was. You spend money and/or time and track them down. You succeed, and sue them.

    Can you include the cost of tracking them down in the damages you are suing for?

    Can you sue for more than your actual costs, to account for the risk you took that you'd be unsuccessful in tracking them down (hence your time/money would be gone with no possibility of being repaid)?
    • If you document every minute and every dime spent in agonizing detail, document your hourly rate and present it succinctly to the judge, you just might get it. Suing for costs and damages is done, although I suspect you usually only get your full costs award if the judge thinks the defendant is going to try to skip on the payment anyway.
    • Congress can issue letters of marque and reprisal in this situation- (it's actually in the constitution, intended to authorize privateers to go after pirates from other countries overseas to recover stolen property).

      If we can get some of those issued, we could go after spammers and steal their stuff- take their servers and set fire to their mobile homes. (And keelhaul the bastards).

    • Re:Legal question (Score:2, Informative)

      by Anonymous Coward
      "Can you sue for more than your actual costs, to account for the risk you took that you'd be unsuccessful in tracking them down (hence your time/money would be gone with no possibility of being repaid)?"

      I Am Not A Lawyer, but I do work in a collection agency.

      I believe the short answer is, no. You will never get paid, or receive funds for the actual RISK of your actions to track someone down and receive your due finds. That is part of the situation you are in. As an example, one client will never sue som
  • How might people who receive faked messages track the messages to a source with minimal effort?...

  • nailing the bastards (Score:4, Insightful)

    by Stephen Samuel ( 106962 ) <samuel@@@bcgreen...com> on Tuesday September 30, 2003 @08:56PM (#7100102) Homepage Journal
    It's not that hard to take down a spammer who causes you problems beyond just sending you unwanted email... I had one friend who had a spammer run a couple hundred thousand emails thru his system (a bug had made it into an open relay). It took one stern call to the ISP hosting the advertised websites to get his hosting and DNS cut off at the knees.

    This is more than just sending off a single email to a scantly watched abuse email.. This means getting hold of a real person and explaining, realistisay, what sort of legal liabilities they might be open to if they continue to support the spammer's actions. (Hacking laws, aiding and abetting, Trademark infringement and vicarious liability) often fit in there.

    If more people would do this, life would get a lot harder for spammers.

  • Considering I'm actually an IT professional--I get "Returnend mail: user unknown" bounces from SPAM labelled as being from my email address (omaratallwrongdotcom) all the time.

    While spam is certainly all wrong, I don't appreciate it much... I guess I just haven't unappreciated it enough to get off my lazy butt and do something about it.

    • I get "Returnend mail: user unknown" bounces from SPAM labelled as being from my email address (omaratallwrongdotcom) all the time.

      Who I really feel sorry for is the people who own the domain names "yourmom.com" and "yourmother.com."

      Because, really. How many of us have used that as a spam email address when signing up for, say, RealOne?

  • I sure care! (Score:2, Insightful)

    by Michael B. Davis ( 588524 )
    I had exactly the same thing happen to me.

    The spam in question was a pharmaceutical firm, and one morning I got just about 50 'undeliverable mail' messages with my email address as the sender. I never got any complaint letters, and it hasn't happened since (that was about Sep 21, 2003 give or take a day).

    I figure I never got the flak because no one ever comes to my site anyway...

    Michael in Toronto
    • 50 is nothing :P I managed to screw up my mail server once, and it was discovered and immediatly used for about 24 hours before I noticed and fixed it. In that 24 hours they managed to send out thousands of spams (I'm not sure exactly how much, but the logfile was hundreds of megabytes), and I continued to get bounces, annoying replies, and especially probes from other spammers for months afterward.

      The probes were the most annoying - even after securing the server, I had at least 3 spam runs attempted.

  • Another vote for "SUE HIM" (Score:3, Interesting)

    by ChangeOnInstall ( 589099 ) on Tuesday September 30, 2003 @09:33PM (#7100290)
    IANAL, but if this guy has as much evidence as he claims to against this spammer, he needs to sue the spammer. The spammer is knowingly committing an act that he knows will cause damage to the business that he is effectively "impersonating". He is doing it to turn a profit from an illegal activity. If proof of this act is available, the victim here could be looking at a pretty stout judgement. If this guy made $750,000 spamming people last year, there's a good chance he'll be able to find an attorney who will pursue this on a contingency basis.

    And IIRC, I'm pretty certain the victim can sue the spammer from his home state (especially nice since the spammer is on the opposite end of the country).

  • Check this [freewebsites.com] out.
    • This is a great story which I genuinely enjoyed reading. I laughed out loud more than once.

      That said, please be very careful if you choose to follow the "Let's Get Brutal" link provided at the end of the linked site. Do yourself a favor and resist all temptation to click on the "Rodona Garst Breast Size" link there, as it is only a little less offensive than goatse.cx.

      You have been warned.
    • When I try following your link, I get redirected to a Japanese casino site that tries to force malware onto me. What's going on here?

  • Solution to SPAM (Score:3, Informative)

    by Sly Mongoose ( 15286 ) on Tuesday September 30, 2003 @09:45PM (#7100344) Homepage
    Only workable solution:
    1. Bayesian filters (or similar) on the SMTP servers, analyzing and SPAM-rating e-mail on a line-by-line basis, as it is inbound to the server.
    2. Packet-by-packet connection throttling of all connections to the SMTP server, based on the current SPAM-rating of the open connection.
    All mail will get through. There are no false-positive or false-negative issues to deal with. There are no freedom-of-speech issues to deal with. But SPAM works only because of VOLUME and this will drastically reduce the volume of SPAM that a server can send, making spamming unprofitable.

    Not my idea -- someone else suggested the scheme a while back. I wish I could remember/locate a reference.

  • Williams Communications Group shining. (Score:4, Informative)

    by Agent R ( 684654 ) on Tuesday September 30, 2003 @10:14PM (#7100501)
    WCG.net, and told the tech support staff what had been happening. Within a few hours, Marin's account had been canceled.

    Baloney! It is likely that they told Marin to change the domain name before Markley sues and WCG loses their big bonus blood money.

    But WCG sounded sincerely surprised to find out the infamous Eddy Marin was one of their customers."

    Rule #1! Williams Communications Group is notorious for continuously providing bandwidth to spammers with dirty /24s. Then they feign this concern by "shinning" on those who complain about their dubious customers. Why don't someone ask them about Wholesalebandwidth.com/Optigate?

    Anyone who wants to know about Marin and his scum operation can see it on Spamhaus.org:
    http://www.spamhaus.org/rokso/search.lasso?evidenc efile=1114 [spamhaus.org]

  • Poor guy... (Score:2, Funny)

    by betong ( 526611 )
    First Noah's Flood of spam, then isolation and even blame, and now his server gets Slashdotted to death ;).

  • Reverse MX would have solved it.. (Score:3, Interesting)

    by FattyBoeBatty ( 458019 ) on Tuesday September 30, 2003 @10:43PM (#7100676)
    So what ever happened to that great idea of including RMX records in zone files? It would 100% eliminate spam like this (which accounts for the vast majority). I haven't heard anything frome either qmail or sendmail implementing it.. which sucks.

    See, the reason I'm so big on this, is because I consulted at implementing this at Shadango.com (a new, free, filtering service). We started performing reverse lookups and you would NOT believe the filtering success. It was like day and night. So seriously.. try implementing that on your mail servers and see what happens. And if you're just curious and want to see how effective it can be, check out the implementation at Shadango.com

    -Fatty

  • Been there, done that. (Score:5, Informative)

    by Anonymous Coward on Tuesday September 30, 2003 @10:46PM (#7100694)
    I've had this problem, and I've successfully put a major porno spammer out of business, although it took a while.

    The spammer was forging mail from one of my domains. Since the domain name was a registered trademark, I had some extra leverage. ISPs have a "safe harbor" for E-mail content, but not for trademark infringements.

    I ignored where the mail was coming from, and concentrated on where the money went when you placed an order. The spammer had two phony "billing companies", with phony addresses. Accepting credit cards without providing a valid business name is illegal in many states, so, by sending appropriate letters to the ISPs that hosted his billing sites, I was able to turn off his income stream. The sites reappeared on other ISPs, but with some work, I was able to get his domain registrar to lock some of his domains.

    This is an effective tactic. If you file an "incorrect whois data" complaint with the Internic, and the registrar can't contact the domain owner, the domain goes to "locked" state. Then, if you get the hosting company to dump them, they can't move the site. In this case, the spammer operated his own DNS servers (triply redundant, on different ISPs), so I had to get all of them kicked off various ISPs.

    By now, I'd had this guy kicked off ISPs from Dallas to London to Sao Paulo. This was made easier by the fact that he was paying for much, if not all, of his hosting with stolen credit card numbers. Since his porno sites generated credit card numbers, he could keep signing up for new hosting accounts with his customer's credit cards. That doesn't work once the ISP knows who to look for.

    Finally, the guy retreated to his home ISP in St. Petersburg, Russia, where he apparently felt safe. That took a while to crack. I found out that the upstream provider used by the small St. Petersburg ISP was a larger telecom company in Moscow. That company was in the process of doing an initial public offering on NASDAQ. I talked to their investment people in New York, and eventually received a call from the Russian telecom's CEO. It turned out that we had some friends in common, and that he knew about the small St. Petersburg ISP as a known problem.

    With that connection, I had some discussions with the St. Petersburg ISP, which kicked off the spammer. He came back with new accounts the next day. I got those accounts closed. This went on for several weeks. Finally, after some additional prodding, the St. Petersburg ISP shut the guy down and kept him shut down.

    It's been months now, and the spammer's content is nowhere that Google can find it, so he seems to be out of business.

    The key to dealing with spammers is to follow the money. While dealing with this problem, I talked to bankers, the people who developed his billing system, and a company to which he'd outsourced web design. Eventually, a picture of the spammer emerged. This was basically a one or two person operation devoted to stealing credit card numbers. Once I knew that, getting cooperation in shutting the guy down was reasonably easy.

    Trademarking your web site name gives you some additional legal options, and is definitely worth the $450 or so it costs. When you raise a trademark issue, the problem escalates to the ISP's legal department, and you're no longer dealing with the customer service people.

    Once you get to the legal people, and fraud is involved, you can point out that the ISP, once informed of the problem, is knowingly aiding and abetting a fraud scheme. This usually results in quick action.

    It's always useful to check business license and corporate filing data. If you find a Whois entry for Phonycorp, Inc. at a Mail Boxes Etc. address, find out whether the company has a business license (where required) and is registered as a corporation in the state. If they don't, they're doing business illegally. So report them to the IRS, the state tax authorities, and the local authorities. ("Hello, City Assessor's Office? I'm trying to locate the offices

    • It is very difficult to do this kind of thing across borders. You were lucky that the Russian company owning the St. Petersburg ISP was seeking a listing in NY. In many cases, this doesn't happen so you have little edge in getting law enforcement involved.

      In my case after working for a while in St. Pete, I found that a spammer based in Russia was spoofing using my EMail address (easily obtainable from my business cards). It didn't seem to be coming from my systems and when I could get headers from annoyed

  • Comment removed based on user account deletion
  • I haven't seen SPF [pobox.com] being mentioned yet.

    It's a sistem whereby you, the domain-owner, via DNS records, explains what SMTP-servers (their IP adresses) are allowed to send email with your domain in the From: header.

    To me it really does look like a way to kill spam, if it were adopted.

  • One spam arrived as I was reading this! And they are still abusing whois/dns. Nice, but this guy has managed to do sweet FA

    Relevant supporting evidence attached (my account is hosed, anyway..)

    News Story.
    -----------
    http://www.internetnews.com/ b us-news/article.php/3 _531911

    Spam Headers
    --
    Return-path:
    Received: from punt-3.mail.demon.net by mailstore
    for johnc@yagc.demon.co.uk id 1A4cHz-0006dB-Fh;
    Wed, 01 Oct 2003 08:25:56 +0000
    Received: from [24.128.200.166] (helo=h000ae62be489.ne.client2.attbi.com)
    by punt-

Slashdot Top Deals

"The pyramid is opening!" "Which one?" "The one with the ever-widening hole in it!" -- The Firesign Theatre

Close