Where spam comes from

bbcnews.com ^ | april-24-2003 | bbcnews

[green team 1999]

Where spam comes from

For anyone plagued by junk e-mails, the question that often baffles most is how did the spammers get your address. US researchers at the Center for Democracy and Technology set out to answer this question in the summer of 2002.

They found that e-mail addresses posted on websites or in newsgroups attract the most spam.

Spam is estimated to account for up to 40% of global e-mail traffic and is causing a massive headache for businesses, which are losing billions in productivity.

E-mails on the web

To determine the source of spam, the researchers set up hundreds of different e-mail addresses and waiting six months to see what kind of mail the addresses were attracting.

For the purposes of the study, researchers posted e-mail addresses on websites and newsgroups.

They also provided e-mail addresses in response to services on popular websites such as auction site eBay and e-commerce favourite Amazon.

E-mail addresses were also sent to websites in response to jobs, auctions and discussion boards.

Finally researchers posted addresses in the Whois database of information about the owners of domain names.

Evasive techniques

The researchers found that spammers used harvesting programs such as robots and spiders to record e-mail addresses listed on both personal and corporate websites.

One way of avoiding this mail-harvesting, said the team, is to replace characters in an e-mail address with human-readable equivalents - for example john@domain.com would become john at domain dot com.

Another successful evasion technique is to replace the characters in an e-mail address with the HTML equivalent.

None of the project's addresses written in human-readable formats or HTML received a single piece of spam.

Over the course of the six-month study, the researchers received over 10,000 e-mail messages to the 250 e-mail addresses they had created.

Only about 1,600 of these were legitimate e-mails.

Over 97% of the spam was sent to addresses that had been posted on public websites.

The number of messages received was linked to the popularity of the website. Organisations linked to major portals such as AOL and Yahoo received a lot more spam than those without links.

AOL is currently waging its own war on spammers, recently launching over a dozen lawsuits against individuals and companies it claims is sending unsolicited mail to its members.

Opting out

The research also looked at whether websites respected consumer attempts to opt out of receiving commercial e-mail.

In all cases where researchers asked not to receive commercial e-mails, their wishes were respected.

Opting out of e-mail communications further down the line also resulted in the majority of websites complying with the request.

The study found that most web companies did not share or sell e-mail addresses to third parties.

Just 25 spam messages were received as a result of inappropriate sharing or selling of e-mail addresses, and most of these were from gambling and adult-content related websites.

Scatter gun approach

At one point during the study, the system began receiving spam messages to addresses that had never been used for any purpose or submitted to anyone.

Such brute force attacks, in which spammers attempt to send e-mails to every possible combination of letters that could form an e-mail address, are relatively common.

The system received over 8,000 brute force e-mails before a block was installed.

These messages were not included in the final data.

for information and discusion only,not for profit etc,etc.

[js1138]

I keep a hotmail address for travel and such. I was getting 50 spams a day until I made it exclusive, only accepting messages from a specific list.

[Lysander]

e-mail addresses listed on both personal and corporate websites.

Excuse me but is not putting your email address on a website inviting people to email you? How is that unsolicited email?

Here is my phone number, don't call me!

[ItsOurTimeNow]

Any business that has to make a living by cheating and conning its customers deserves to be shut down So, does the Government also fall into this category? lol

[boycott]

"For the last week or so I have been replying to every spam email to remove me from the mailing list. Will this work and what about the spam that does not have a remove option?"

Always remove yourself from the list. There's about a dozen companies that sell the email lists. Some will filter their lists for those that have requested removal. It certainly won't work 100% of the time but it should help.

Another thing to consider is that a lot of the spammers aren't in the USA. A few groups in Russia are heavy into Internet marketing. There is one Russian group that buys expired domain names for redirects. They also sell email lists, etc.

How do you police the spammers that are based in Russia, China, Maylasia, Singapore, etc.?

[ASA Vet]

Fastest way to get rid of spam is to tax it.

Is this where the Postal Services proposed 5 cent
tax on e-mail urban myth is supposed to be brought up?

[kissthis]

In many cases having contact info on a website is required. For example...If you have a commercial website that accepts credit cards, your merchant account provider will require it (if reputible).

This does not mean I am inviting spam. I have no problem at all with cusomers contacting me, but that is a far stretch from "inviting people to email" me. Exactly how is displaying contact info an "invitation", and how is that soliciting anything???? Especially since I don't have any particular need to increase my penis size.

[green team 1999]

aol is trying constantly to sell aol,time.warner, items,from cd music to subscriptions to dvd movies,but all the products are from the same superbig aoltimewarner.
i tell all my friends to stay away from aol.

[Oztrich Boy]

For the last week or so I have been replying to every spam email to remove me from the mailing list. Will this work and what about the spam that does not have a remove option?

Even if it does, there is nothing to stop the spammer selling your address to another as a prized active e-mail addressee who actually opens unsolicited e-mail.

[Oztrich Boy]

Oh, and Where spam comes from?

Spam is Babe!

[lawdude]

"Where spam comes from"

French head cheese!

[snopercod]

Just what is "mechanically separated chicken", anyway?

[tubebender]

Just what is "mechanically separated chicken", anyway?

The first thing that came to mind was those shredders Saddam used...never mind

[steve-b]

This is like arguing that having a window is an invitation to throw bricks through it.

[Vicki]

I got a porn email last week that involved guinea pigs. I'm not kidding. I am so sick of this stuff.

[Lysander]

This is like arguing that having a window is an invitation to throw bricks through it.

LOL! Close, but as bad an anology as mine. It is more like saying that leaving your curtains open is an invitation to watch you get dressed.

[Alouette]

It can be even worse. Recently, I had spammers spoof my domain in the "from" field of their mass mailings, to make it look as though the spam was coming from my server!

Anyone have any idea of how to stop this abuse?

[goldstategop]

Write to your ISP and tell them someone is abusing your e-mail domain to send out spam. They will investigate and take appropriate action against the party responsible for the domain abuse.