[Gllug] re spam

[Alistair Mann]

Thus spaketh john gennard on Wednesday 23 Jun 2004 18:20:
> Have today temporarily disabled my email filters to see what what junk
> is being thrown at me. Most is as expected (drugs, sex, Nigerian scam etc),
> but there are a few where the body contains just a string of English words.
> I can see that if I try to filter for certain phrases contained in the
> body of
> an email this would not stop the thing getting through. Some contain a
> URL, and I suppose there are people who would 'have a look-see', but is
> there any other possible advantage to a spammer (other than
> bloodymindedness)?
>
> Any one know why this is done?

It's useful for the badguys to know whether a message to an email address will 
be rejected. For instance look at this attempt to email a bad address:

[a at svetlana a]$ telnet mail2.clara.net 25
Trying 80.168.69.104...
Connected to mail2.clara.net.
Escape character is '^]'.
220 Claranet Backup Mail Service ESMTP (mail2.clara.net)
mail from: al at lgeezer.net
250 OK
rcpt to: estibbelfotherington at clara.co.uk
550-estibbelfotherington at clara.co.uk is not an active address at this host
550 (Unrouteable address)
quit
221 mail2.clara.net closing connection
Connection closed by foreign host.

Clearly the address -- estibbelfotherington at clara.co.uk -- should be removed 
from the spam list, thus increasing the potential value of the remaining 
addresses.

In the real world, sending a garbage message would provide further 
information, even better if one can add a url too: in the first case, some 
refusals don't occur until after a message is sent, in the second the server 
logs would note that a particular url was accessed therefore confirming the 
address as one leading to a human.

Cheers,
-- 
Alistair
-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug