Defeating spamfilters through obsession

[The harasser] was hitting me on email and twitter for more than [2100 messages], and the thing was, those all got past the filters I’ve got in place. So one obsessed crazy man with minimal technical skill and nothing but persistence outperforms all the spambots out there, at least on the scale of individuals, if not in breadth of attack.
PZ Meyers

Dr. Meyers goes on to suggest that spammers could defeat filters just by hiring a bunch of people who would manage an ongoing campaign of identical but not quite emails.
Spammers have beat him by at least a decade. In fact, much of the Nigerian 419 spam and associated scams are hand written and sent out by people paid pennies an email to send them.
Where everything falls apart, though, is getting a response. The harasser didn’t need a response from the people he was harassing. So he could go through dozens and dozens of email addresses and twitter accounts a day. Spammers are usually attempting to collect money from people, and they need to have some sort of way for their targets to provide that money.
In fact, a group of researchers looked at credit card processing as a way to stop spam.

95 percent of the credit card transactions for the spam-advertised drugs and herbal remedies they bought were handled by just three financial companies — one based in Azerbaijan, one in Denmark and one in Nevis, in the West Indies.

(Report PDF)
It was taken as truth back when I was handling abuse@ that if we could stop people from buying from spam, that we could stop the spam problem in its tracks. That failed for multiple reasons. First, it’s impossible to stop people from being manipulated and taken advantage of by scammers. Second, spammers have figured out how to make money in many more ways than getting people to give it to them. Now, a lot of spam is not advertising real products or services. It’s closer to theft or fraud.

Related Posts

Buying lists

The problem with buying lists is that you never know which consumers are already on your list and you risk spamming current subscribers.

Read More

TWSD: I can haz ethix marketing

I’m getting slammed by spam advertising URLs at http://perfectdeliveries.com/ from
Ethix Marketing LLC
711 S. Carson Street Suite 4
Carson City, Nevada 89701
The kicker? They’re violating CAN SPAM while they’re doing it. Seriously, sending mail out through open relays and proxies with forged From: addresses is a violation of CAN SPAM. And they’re spamming for ambulance chasers.
Spammers, eh?

Read More

Are you sure you didn't opt in?

Yes, really. I’m sure I didn’t opt-in.
I get a lot of spam. I get a lot of spam to addresses that aren’t used to sign up for mail. But it seems inevitable that when I bring up examples of receiving spam I inevitably get asked, “Are you sure you didn’t opt-in?”
On one level I can understand the question when I send in a complaint to an abuse desk and they’re dealing with a customer who swears all their mail is opt-in. It makes sense when an ESP is working to identify what may have happened so they can correct their customers’ behaviour.
But when it’s a client who has hired me to investigate their email delivery problems and I provide examples of spam sent to me? Why, WHY would I lie to you? Why would I claim I’m getting spam if I wasn’t? What use is that? How does me forgetting I subscribed actually help fix your delivery?
And even if I did forget, shouldn’t that be a sign that maybe there is some issue with your mail program that people sign up and forget?
I am not sure what causes clients to think I would tell them they’re spamming me when they’re really not. I certainly do tell clients when I opt-in and enjoy their mail while offering advice on how to improve their marketing program. I’m not sure what’s going through their heads when I say, “Oh, you (or your affiliate) is sending me a lot of spam,” that prompts them to ask, “Are you sure you didn’t opt-in?”

Read More