Where spam comes from

bbcnews.com ^ | april-24-2003 | bbcnews

[green team 1999]

Where spam comes from

For anyone plagued by junk e-mails, the question that often baffles most is how did the spammers get your address. US researchers at the Center for Democracy and Technology set out to answer this question in the summer of 2002.

They found that e-mail addresses posted on websites or in newsgroups attract the most spam.

Spam is estimated to account for up to 40% of global e-mail traffic and is causing a massive headache for businesses, which are losing billions in productivity.

E-mails on the web

To determine the source of spam, the researchers set up hundreds of different e-mail addresses and waiting six months to see what kind of mail the addresses were attracting.

For the purposes of the study, researchers posted e-mail addresses on websites and newsgroups.

They also provided e-mail addresses in response to services on popular websites such as auction site eBay and e-commerce favourite Amazon.

E-mail addresses were also sent to websites in response to jobs, auctions and discussion boards.

Finally researchers posted addresses in the Whois database of information about the owners of domain names.

Evasive techniques

The researchers found that spammers used harvesting programs such as robots and spiders to record e-mail addresses listed on both personal and corporate websites.

One way of avoiding this mail-harvesting, said the team, is to replace characters in an e-mail address with human-readable equivalents - for example john@domain.com would become john at domain dot com.

Another successful evasion technique is to replace the characters in an e-mail address with the HTML equivalent.

None of the project's addresses written in human-readable formats or HTML received a single piece of spam.

Over the course of the six-month study, the researchers received over 10,000 e-mail messages to the 250 e-mail addresses they had created.

Only about 1,600 of these were legitimate e-mails.

Over 97% of the spam was sent to addresses that had been posted on public websites.

The number of messages received was linked to the popularity of the website. Organisations linked to major portals such as AOL and Yahoo received a lot more spam than those without links.

AOL is currently waging its own war on spammers, recently launching over a dozen lawsuits against individuals and companies it claims is sending unsolicited mail to its members.

Opting out

The research also looked at whether websites respected consumer attempts to opt out of receiving commercial e-mail.

In all cases where researchers asked not to receive commercial e-mails, their wishes were respected.

Opting out of e-mail communications further down the line also resulted in the majority of websites complying with the request.

The study found that most web companies did not share or sell e-mail addresses to third parties.

Just 25 spam messages were received as a result of inappropriate sharing or selling of e-mail addresses, and most of these were from gambling and adult-content related websites.

Scatter gun approach

At one point during the study, the system began receiving spam messages to addresses that had never been used for any purpose or submitted to anyone.

Such brute force attacks, in which spammers attempt to send e-mails to every possible combination of letters that could form an e-mail address, are relatively common.

The system received over 8,000 brute force e-mails before a block was installed.

These messages were not included in the final data.

for information and discusion only,not for profit etc,etc.

[goldstategop]

Any business that has to make a living by cheating and conning its customers deserves to be shut down. Death to the spammers!

[Bobby777]

They found that e-mail addresses posted on websites or in newsgroups attract the most spam.

they just discovered this in 2002? ... this has been known for years ... maybe they should have asked and somebody would have told them ...

There's an easy way to cure spam, declare a spammer as somebody who sends 5 or more unsolicited emails per day ... bill the companies who advertise with spam, by the receiving server (like Yahoo!, AOL, a private or public company) $5 per incident for receiving / storing unsolicited email ... have employees / recipients forward spam to cental collection ... generate the bill ... when they don't pay, file a lawsuit and shut 'em down one-by-one ...

that will cure 90% of spam inside 6 months ... guaranteed ... permanently ... sue the advertisers ... pass the bill in Congress ... done deal ...

[Keith in Iowa]

From the headline, I thought this might be an article about a meat processing plant just up the road in Austin, MN.

[tubebender]

Here is another source spam

[ex-Texan]

AOL says it hates spamm yet they are one of the worst spammers ... Ack! I just hate AOL ... #^%&$$#&$$ !

Regardless of the stories -- I believe spammers get new Email address from ISP's. I periodically change my ISP and/ or my Email address. But within a few months your address will get out.

Other sources are Internet sign up sites. And they have the ability to scan the Internet and pick up addresses from web sites by Spyders and Robot scanners.

Oh, be careful writing to Ezines to raise a ruckus. Some like Salo* might turn your address in to porn sites.

[Smedley]

Hmmmmmmmm, Spam!

[boycott]

"AOL is currently waging its own war on spammers," AOL is nothing but a bunch of hypocrites. They send more unsolicited email than anyone. They're always trying to sell their broadband or something else.

Yesterday, I was very tired when I got home form work. I received three telephone solicitations during dinner and another later after I had fallen asleep. I fell asleep and another telephone solicitator called and woke me up!!!! I'VE NEVER HAD A SPAMMER WAKE ME UP!!! After I was awaken, I turned on my computer and deleted the spam in less than five seconds. I don't like spam but I despise TELEPHONE SOLICITERS AT LEAST TEN FOLD MORE!!!!

I also believe that AOL subscribers tend to get the most spam because the spammers consider them to be somewhat ignorant if they continue to use AOL. The ONLY reason I keep AOL is because I've used it for years and a lot of friends and business associates have the email address. I surf the Internet using Exployer and my cable connection.

I really need to dump AOL since they're run by a bunch of liberals. Maybe I should go to the plan where I can just check the email?

[lonewacko_dot_com]

Well, this does sound like a scientific survey. They tracked the email addresses, how they were used, how much spam each got, etc. So, it's better than just anecdotal evidence.

Anyway, I get about 100+ spams per day. A lot of them come to strangely-named addresses at my domain that I've never used. Example: elephantitis@mydomain.com. I'd imagine that some of these came from email address harvesters who wanted to pad out their list which they sell to spammers.

Some of them come from ijits who work at a large company one of whose servers has the same name as my domain. For instance, they entered fred@mydomain.com in some online spam form, when they meant fred@mydomain.ibm.com

As far as your idea is concerned, the abuse departments at earthlink, aol etc. probably already work that way. If they get enough complaints they decide to sue. It would also be open to abuse: if people didn't like someone, they could complain that the email they got from him was spam.

An interesting study would be to look into who keeps the spammers in business by buying their crap. If no one bought from spammers, the problem would solve itself.

[Busywhiskers]

Fastest way to get rid of spam is to tax it.

[Feldkurat_Katz]

I don't like spam but I despise TELEPHONE SOLICITERS AT LEAST TEN FOLD MORE!!!!

Has a telemarketer called you to sell you a penis enlargement treatment? Imagine, on the other hand, your 12 year-old daughter receiving such email, complete with photos.

[sasportas]

"Imagine, on the other hand, your 12 year-old daughter receiving such email, complete with photos."

Whoever these people are that do this they are the lowest scum on the face of the earth.

[boycott]

"Has a telemarketer called you to sell you a penis enlargement treatment? Imagine, on the other hand, your 12 year-old daughter receiving such email, complete with photos. "

I agree that there is a lot of offensive spam. Let's just say that I don't get a lot of joy out of telephone solicitors or spam.

[Feldkurat_Katz]

"Imagine, on the other hand, your 12 year-old daughter receiving such email, complete with photos."

Whoever these people are that do this they are the lowest scum on the face of the earth.

Agreed. And I get a lot of messages like that and they usually come with an innocent subject such as "You forgot your coat". Inside, there is a graphic image and a link. There is no way a spam filter can catch this.

The macho attitude summarized by "I can take care of spam myself" neglects the fact that spam has made email unfit and useless for children.

[TBall]

I'm so sick of the spam I get. Recently I've been getting a lot of spam for porno sites. No joke I just got an email tilted "young boys ---ked for the very first time." Someone has got to put a stop to this.

[Revolting cat!]

I say send all the spammers to Korea (the part where they say "you all", not the part where they say "Bahston") where SPAM is considered a delicacy!

[TBall]

For the last week or so I have been replying to every spam email to remove me from the mailing list. Will this work and what about the spam that does not have a remove option?

[Feldkurat_Katz]

For the last week or so I have been replying to every spam email to remove me from the mailing list. Will this work and what about the spam that does not have a remove option?

In my experience, if they provide an unsubscribe option, it usually works. If they don't provide it, that's another story.

[goldstategop]

Don't. That simply gives spammers an indication there's a live human at the other end and you'll simply get more spam. Sign up for a http://www.mailblocks.com account and keep the spam at bay. (And you can list your AOL, Hotmail, and Yahoo e-mail accounts with them.) I signed up for $9.95 the other day and I got 2 years extra service for FREE. That's not hard to beat.

[AmishDude]

Do not select the unsubscribe option unless it's somebody you've done business with (McAfee, ESPN.com, etc.) who decided to put you on a newsletter list.

Even if they do unsubscribe you, they'll just put you on a hundred other lists.