Subject: Re: [Asrg] Some data on the validity of MAIL FROM addresses

From: Scott Nelson <[email-masked]>
Date: Sun, 18 May 2003 20:25:39 -0700

At 07:52 PM 5/18/03 -0600, Vernon Schryver wrote:
>> From: Michael Rubel <[email-masked]>
>
>> ad> Even worse, there is no proven connection between the spam and the
>> ad> hotmail/yahoo account which is allegedly the sender.  The data are
>> ad> entirely consistent with spammers using lists of verified email
>> ad> addresses to forge 'From:' lines.
>>
>> vs> That would be make sense only if the number of hotmail/yahoo spam
>> vs> sender addresses were proportional to the number of hotmail/yahoo
>> vs> addresses among all targets of spam.
>
>
>> Wouldn't this objection only apply if you assume that spammers are
>> selecting MAIL FROM: addresses uniformly?  That is, if you assume each
>> address in their lists is given equal probability?
>
>That's my point.  Spam source addresses are obviously not uniformly
>distributed accross domain names.  Unless you make surprising
>assumptions about spam target addresses, they are not uniformly
>distributed accross those either.
>
>Why is that?  It cannot be because free provider mailboxes are harder
>to check for validity.  Many large corporate domain names give no
>indication that an invented address is bogus during the SMTP transaction.
>(Think about corporate MX servers and firewalls to see not only why
>that is but why it must be, at least as SMTP is practised today.)
>
>It also cannot be because free provider addresses are good sender
>addresses for spam, because a noticable albeit small minority of
>organizations are like Rhyolite Software and reject all mail
>apparently from strangers at free providers.  If you're going to
>pick a random domain name, it would be better to pick any of the
>Fortune 1000 not associated with a free provider.
>

I would expect that /if/ the majority of return addresses are forged, 
then the spammer would pick the domain at random from their collection
of lists.

If that's right, and if a lot of spam is being forged, 
(both are untested assumptions) 
then the majority of forged spam would come from the domains which
appear most often on the lists.  I.e. since there are many more 
"big domain" email addresses, they would get forged more often.
But the small domains would be forged sometimes.

So what domains /aren't/ showing up in spam?

I know striker.ottawa.on.ca has a lot of addresses on a lot of spam lists,
but checking the last 20,000 spams I received, not a single one 
has the word "striker" in it anywhere.
No fortune 1000 domains either.
For the addresses checked, there was only one exception to the rule that 
spam has a return address that can be purchased for less than $25.00 US,
and that exception is notable.
It's spamcop.net, who claims to have been joe-jobbed.

Scott Nelson <[email-masked]>

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 19 May 2003 09:07:03 -0400

> has the word "striker" in it anywhere.

  I've talked to people with large spamtraps, and they see do see it.
Not in the same volume as hotmail, though.

  Alan DeKok.

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 19 May 2003 09:54:32 -0400

>then the spammer would pick the domain at random from their collection

As I noted in my mail.  This appears to be happening now--although I 
had not seen symptoms of it before.  Is anyone else starting to see 
low-level occasional bounce back from spam?

Prior to that, all of the bounce-back instances I had heard of or 
experienced (and I used to get one or two a week) were major--where 
the entire spam load got sent out with the same return address.

-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 19 May 2003 09:47:42 -0600 (MDT)

> From: Kee Hinckley <[email-masked]>

> the entire spam load got sent out with the same return address.

For more than a year I've heard from ISPs asking how to make the DCC
filter such bounces because they upset users.  For years there have
been occassional reports in news.admin.net-abuse.email of such bounces
and speculations that some spammers apply the obvious tactic of using
their target lists for their sender addresses.  I've occassionally
received such bounces.  The question isn't whether it happens, since
that's long settled, but how often it happens, and what if anything
people trying to stop spam should do in response.

Spam characteristics ebb and flow.  It's important to avoid making
generalizations from a single wave or one high tide.  Two or three weeks
ago I was seeing a more forged senders in my traps.  Within the last
week, that wave has broken and I've noticed an increase in spammer using
their own domains in Mail_From values.  I could speculate that sounds
from the FTC and New York have motivated a shift in tactics or that
Hotmail or Yahoo are doing something, but that would only be speculation.

Other recent waves include:

  - base64 encoding increased so much a month or two ago that I added
     special hand tools to the set I use to watch my spam traps.
     Those tools became important.  This week I've rarely used them.

  - the wave of <!-->HTML comment<--> spam has definitely crested.

  - some recent spam contains HTTP HREF URLs of the form
     http://xxx.example.com__foobar
    Does some HTML-aware MUA treat '__' like '/'?

  - some recent spam contains several purely garbage URLs in HREFs or
   two valid ones.  They're not even hidden (e.g. <A HREF="asdf"></A>)
   What's the point of telling spam targets to "click on this" when it
   is pure garbage?

  - I've finally seen what others have mentioned, "hashbusters" in
   HTML tables instead of bounded by <font></font> or other screens.
   The tables look perfectly valid and so visible to spam targets.
   So what's the point?

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Chris Lewis" <[email-masked]>
Date: Fri, 30 May 2003 23:59:01 -0400

> has the word "striker" in it anywhere.

I had an opportunity to compare striker with our spamtraps.  They were 
forging each other.

We have 1/1000th the number of users as AOL.  Our email addresses are 
being forged several thousand times per day...