Kuro5hin.org: technology and culture, from the trenches
create account | help/FAQ | contact | links | search | IRC | site news
[ Everything | Diaries | Technology | Science | Culture | Politics | Media | News | Internet | Op-Ed | Fiction | Meta | MLP ]
We need your support: buy an ad | premium membership

[P]
He who fights with spammers...

By enterfornone in Internet
Wed Jan 16, 2002 at 10:20:35 PM EST
Tags: Internet (all tags)
Internet

It started with a regular spam email. One of many I would receive that day.

From: Harald Lenz
To: mail1@winecellar.at
Sent: Saturday, January 15, 2028 5:50 AM
Subject: Winecellarconstruction Gruber

We build classic vaulted cellars


Personally I receive quite a lot of spam. I just ignore it. Others prefer to complain to the senders ISP or to one of the various anti-spam organisations on the Internet.

Others prefer to reply to the email. Usually this will bounce, since the spammers email address was either fake or has since been cancelled. Other times it will go into a black hole, or even to a system that confirms which email addresses are valid based on the replies received. This one was different.

From: "Dan"
To: "Winecellarconstruction / Weinkellerbau Gruber" <office@winecellar.at>
Cc: <mail1@winecellar.at>
Sent: Tuesday, January 15, 2002 2:05 PM
Subject: remove
You would have thought after everyone received that first "remove" that someone would have gotten the hint. No...
Subject: Remove
Subject: AW: Remove
Subject: FW: Remove
Subject: re: Remove
Subject: FW: re: Remove
Hmmm, perhaps every mail you send to the mailing list gets sent to everyone else on this list. Lets test that theory.
From: "Daryl"
To: <mail1@winecellar.at>
Sent: Wednesday, January 16, 2002 4:30 AM
Subject: Testing

testing
Guess so. Better inform the list, just in case they haven't noticed yet.
From: "Mike"
Cc: "Winecellarconstruction / Weinkellerbau Gruber" <office@winecellar.at>; <mail1@winecellar.at>
Sent: Wednesday, January 16, 2002 3:27 AM
Subject: Re: Remove

You guys can stop sending remove notices to this list -- they just get forwarded to the entire gigantic list, creating more spam for all of us. I think it's pretty clear that whoever is spamming us is not going to take our names off his mailing list.
Armed with that information we can now take action. What action should we take? I know, reply to the list asking to be removed while admitting that we know it goes to everyone else on the list.
From: "Rob"
To: <mail1@winecellar.at>
Cc: <abuse@winecellar.at>
Sent: Wednesday, January 16, 2002 6:20 AM
Subject: Screwed up addressing?

Hi,

I was recently subjected to spam from your address. That's no big deal, I just delete them at this point. Unfortunately, it appears that I have somehow become the recipient of all the "Remove" reponses which that email generated. I've gotten 5 or 6 in the last 24 hours. I don't know exactly what's going on, but y'all need to make this stop IMMEDIATELY! Spam is one thing, but this is just ridiculous. All these emails appear to be addressed to mail1@winecellar.at.

Rob
This person even went as far as to suggest that the rest of the list not be as dumb as him...
From: "Deven"
To: <mail1@winecellar.at>
Sent: Wednesday, January 16, 2002 7:47 AM
Subject: Winecellar spammers
If this message is received by the people who sent the spam, then consider this a complaint and a remove request. Almost nobody appreciates spam.

However, I believe that <mail1@winecellar.at> actually goes to the list of people who were victims of this spam. I have received several "remove" replies, and as far as I can tell, those replies copied that address, which is the only explanation I can come up with for how those replies ended up in my mailbox.

So if this is received by other victims of the original spam, please don't copy <mail1@winecellar.at> on any complaints or remove requests!

Deven
So this is what's known as the Internet Death Penalty. In his credit, at least he realises he's mailing a list and not the original poster.
From: [deleted]
To: "Mike"
Cc: "Winecellarconstruction / Weinkellerbau Gruber" <office@winecellar.at>; <mail1@winecellar.at>
Sent: Wednesday, January 16, 2002 9:18 AM
Subject: Re: Remove

Then I would like to take this opportunity to introduce myself. My name is [deleted], I'm a compiler tester in the United Kingdom and I have no idea what this list is. The web page at the address of which this list appears to be hosted has contact details as such:

WEINKELLERBAU FRIEDRICH GRUBER Ges.m.b.H.
A- 2770 Gutenstein, Ferdinand Raimund - Straße 171
Tel.: +43 / 26 34 / 74 65, FAX +43 / 26 34 / 85 85

Would any members of this list who are in Germany (and I'm sure there are a few) please call this number and threaten the life of whoever answers. I am now adding a deny rule to my mail browser. Thanks for playing.
So we have people who reply to spammers requesting their name be removed. We have people who reply asking to be removed even after they realise that their mail is being forwarded to the same group that received the original spam. We have people who post to mailing lists asking others not to post to mailing lists.

If I didn't know better I would think this spammer deliberately harvested a list of the stupidest people on the net. But where would you harvest such a list from?

From: "Matt"
To: "Mike"
Cc: "Winecellarconstruction / Weinkellerbau Gruber" <office@winecellar.at>; <mail1@winecellar.at> Sent: Wednesday, January 16, 2002 10:10 AM
Subject: Re: Remove

A side note.. I used special e-mail address for things.. apaprently they "web crawled" slashdot.org and took e-mail address from there (and maybe elsewhere?) because they sent mail (this one) to the address I ONLY use for slashdot!
Good thing I'm a whole lot smarter than that. Or perhaps not...
Subject: Undeliverable: Re: remove
Subject: Returned mail: User unknown
Subject: Mail System Error - Returned Mail
Subject: Returned mail: see transcript for details
Subject: failure notice
Subject: failure delivery
Subject: Out of Office AutoReply: remove

From: "AltaVista Technical Support" <search@support.altavista.com>
To: "enterfornone"
Sent: Wednesday, January 16, 2002 8:48 PM
Subject: Search (KMM2739745C0KM)

Thank you for contacting AltaVista concerning our Search product.

If you provided comments or feedback that do not require a response, we appreciate your contribution. Your comments and feedback help us improve our offerings and enhance the AltaVista Search experience.
Thank you,

AltaVista Support Team

Subject: Returned mail: see transcript for details
Subject: Mail System Error - Returned Mail
Subject: Returned Mail: Recipient no longer with company
The end.

Sponsors

Voxel dot net
o Managed Hosting
o VoxCAST Content Delivery
o Raw Infrastructure

Login

Related Links
o Slashdot
o Also by enterfornone


Display: Sort:
He who fights with spammers... | 22 comments (19 topical, 3 editorial, 0 hidden)
Answer to your question (3.66 / 6) (#2)
by itsbruce on Wed Jan 16, 2002 at 05:55:00 AM EST

If I didn't know better I would think this spammer deliberately harvested a list of the stupidest people on the net. But where would you harvest such a list from?

Here.


--It is impolite to tell a man who is carrying you on his shoulders that his head smells.

Hmm... (none / 0) (#16)
by BurntHombre on Thu Jan 17, 2002 at 01:55:44 AM EST

I don't get it. Just a vaguely anti-Christian joke?

[ Parent ]
No (none / 0) (#19)
by itsbruce on Thu Jan 17, 2002 at 07:02:12 AM EST

"Promise-keeper" is not synonymous with "Christian".


--It is impolite to tell a man who is carrying you on his shoulders that his head smells.
[ Parent ]

Okay. (none / 0) (#20)
by BurntHombre on Fri Jan 18, 2002 at 02:19:13 PM EST

True, and kuro5hin is not synonymous with geek, and the ACLU is not synonymous with liberal, but I still don't get the joke.

[ Parent ]
Very simple resolution... (4.50 / 10) (#3)
by ti dave on Wed Jan 16, 2002 at 06:33:37 AM EST

First, we all take a flight to Vienna.

Second, while using this map, we all rent a bus (I can translate) and travel to Gutenstein.
It's only a 1 hour and 40 minute trip, so we'll get some snacks and clean our weapons on the way.
Don't forget to tell the Bus-Driver that Ferdinand Raimund - Strasse is in the Northeast corner of town!

Third, we take care of Herr Gruber's e-mail program, then bitch-slap his webmaster for the gratuitous use of Flash on the fucking page.

Let's all synchronize our watches, starting...now!

ti dave


"If you dial," Iran said, eyes open and watching, "for greater venom, then I'll dial the same."

Admit it (4.00 / 4) (#4)
by fhotg on Wed Jan 16, 2002 at 06:48:32 AM EST

You set up that list. Somehow it's like the old take two phones, call two people who don't know each other at the same time, connect them, listen and laugh.
~~~
Gitarren für die Mädchen -- Champagner für die Jungs

heh (none / 0) (#18)
by enterfornone on Thu Jan 17, 2002 at 05:48:28 AM EST

Somehow it's like the old take two phones, call two people who don't know each other at the same time, connect them, listen and laugh.
Didn't make the list, but I used to do that all the time.

--
efn 26/m/syd
Will sponsor new accounts for porn.
[ Parent ]
God damnit you beat me to it!!! (3.00 / 3) (#5)
by Scott Lockwood on Wed Jan 16, 2002 at 08:20:35 AM EST

I was going to write this same piece on the same topic! I too got this spamail yesterday, and have been laughing ever since. :-)

"I have no respect for a man who can only spell a word one way." -- Mark Twain

I think it's safe to say... (3.50 / 2) (#6)
by maynard on Wed Jan 16, 2002 at 11:49:08 AM EST

that those voting for this article are likely revieving SPAM (and remove requests) from this list. I didn't catch on that it was a /. harvest until I saw enterfornone's reply... then I sort of caught on. Of course I haven't been actually reading the remove requests, so I feel OK about missing the obvious. I just thank God no one on the list is running vacation...

--M

Read The Proxies, a short crime thriller.

The auto reply loop (3.25 / 4) (#11)
by I am Jack's username on Wed Jan 16, 2002 at 05:12:07 PM EST

I was once subscribed (digest) to a mailing list, and an imbecile set up auto "I'm on vacation" replies, which went to the list, and since he was subscribed went to him, which was then of course auto replied to...

The masses of panicked messages with "Unsubscribe me NOW !^&*" was hilarious because the unsubscription procedure (unsubscribe-listname@) were appended to all messages on the list.
--
Inoshiro for president!
"War does not determine who is right - only who is left." - Bertrand Russell
[ Parent ]

The subject of my favorite spam message ever was: (5.00 / 2) (#7)
by Whyaduck on Wed Jan 16, 2002 at 12:15:07 PM EST

No More Spam

Oh Lydia, oh Lydia, say, have you met Lydia?
Lydia The Tattooed Lady.
She has eyes that folks adore so,
and a torso even more so.

Replying to spam (3.66 / 3) (#8)
by rde on Wed Jan 16, 2002 at 01:17:15 PM EST

I'm on a number of technical lists, the sort that you'd expect to consist of slightly clueful people. Not a bit of it. On one such list - postable from anywhere - an item of spam sneaks through the filter about once a month, engendering the same fucking thread every fucking time.

- Spam
- Wry comment on spam
- Death to all spammers
- Can't we filter this?
- Maybe the list should be available only to subscribers
- Nah. That's a bad idea and it's not going to happen
- Who the fuck are you to decide?
- I'm the guy who owns the box and runs the list
- Yeah, but why can't we make it closed?
- Cos the address is widely published in the media
- Yeah, but we should still make it closed
- It's not going to happen
- It's a pity
- Yeah.
- Segue to equally off-topic subject

Somewhere in the middle of all this, the subject will change, and someone'll write a new message rather than hitting reply, so pretty soon there's a huge multiple-headed thread consisting of multiple subject lines. Every time it happens, I get closer and closer to adding an abusive comment. Last time, I got as far as entering my GPG passphrase before I backed down.

Who's worse, the spammer or the fool who replies to spam?

[OT] Use mutt... (none / 0) (#17)
by arafel on Thu Jan 17, 2002 at 05:26:17 AM EST

If you use mutt (http://www.mutt.org/), together with Cedric Duval's thread-editing patch (http://cedricduval.free.fr/), you can edit threads in mbox mailboxes to your hearts content.

Not IMAP and maildir, though, unfortunately...


Paul
[ Parent ]

What I like to do (none / 0) (#12)
by scanman on Wed Jan 16, 2002 at 08:51:32 PM EST

Here's what I like to do:

If they have an e-mail address you're supposed to reply to if you're interested, mailbomb it until it starts bouncing messages. Repeat every day for 2-3 weeks. Problem solved. Be sure to include a nasty message with a lot of vulgarities. I've written a little Perl script just for this purpose.

If they have a web site with forms to fill out, I use my script that continuously submits forms, entering random vulgarities in all text fields. I leave it running for a few weeks, the site invariably goes down within a few weeks.

I've never had to resort to this, but if they keep harassing you, do a WHOIS lookup, and send them nastygrams via snail mail and/or telephone. And I mean really nasty grams. You could even hire a professional complainer (no joke!)

"[You are] a narrow-minded moron [and] a complete loser." - David Quartz
"scanman: The moron." - ucblockhead
"I prefer the term 'lifeskills impaired'" - Inoshiro

Bad, bad, bad! (4.00 / 1) (#13)
by khym on Wed Jan 16, 2002 at 11:11:38 PM EST

Don't mail bomb spammers, please! Other people at the same ISP can be affected by the traffic. Plus your own ISP will wack you if they catch you at it.

--
Give a man a match, and he'll be warm for a minute, but set him on fire, and he'll be warm for the rest of his life.
[ Parent ]
Not neccessarily (none / 0) (#14)
by scanman on Wed Jan 16, 2002 at 11:36:58 PM EST

Here, I'm assuming that you have a fast net connection. If so, you can fill up a mailbox beyond a modem user's ability to download it in mere seconds. I'd hardly call that a major increase in traffic. You can also run your own mail server, thereby getting around the problem of ISP snooping.

"[You are] a narrow-minded moron [and] a complete loser." - David Quartz
"scanman: The moron." - ucblockhead
"I prefer the term 'lifeskills impaired'" - Inoshiro

[ Parent ]

Shouldn't have said traffic... (none / 0) (#15)
by khym on Thu Jan 17, 2002 at 12:58:40 AM EST

Sorry, a single person doing a mailbombing would have a very small chance of saturating an ISPs connection (though lots of people doing it would be a different question). However, if the spammer has their mailbox on the ISP's server, then filling up their mailbox can have a negative impact on the other users of the system.

Also, regardless of how you send out the mail bombs, it's likely the spammer will report the mailbombing (they seem to be the self-righteous type), and mail bombing is a violation of most ISPs' acceptable use policy (AUP), so you'll wind up busted for it.



--
Give a man a match, and he'll be warm for a minute, but set him on fire, and he'll be warm for the rest of his life.
[ Parent ]
ISP Configuration (none / 0) (#21)
by sgp on Mon Jan 28, 2002 at 01:56:17 AM EST

Their ISP should have quotas configured so that it does not affect other users; if it does, it's a badly-run ISP.

It would probably be a waste of time, though, since most spammers give false email addresses (which seems futile, but there you go)

PS. I like your .sig

There are 10 types of people in the world:
Those who understand binary, and those who don't.

[ Parent ]

perl script (none / 0) (#22)
by fourseven on Thu Feb 21, 2002 at 02:23:24 PM EST

hey.. would you care to post the said script.. for the benefit of mankind? ;-)

[ Parent ]
He who fights with spammers... | 22 comments (19 topical, 3 editorial, 0 hidden)
Display: Sort:

kuro5hin.org

[XML]
All trademarks and copyrights on this page are owned by their respective companies. The Rest © 2000 - Present Kuro5hin.org Inc.
See our legalese page for copyright policies. Please also read our Privacy Policy.
Kuro5hin.org is powered by Free Software, including Apache, Perl, and Linux, The Scoop Engine that runs this site is freely available, under the terms of the GPL.
Need some help? Email help@kuro5hin.org.
My heart's the long stairs.

Powered by Scoop create account | help/FAQ | mission | links | search | IRC | YOU choose the stories!