New Spam Site Found Every Three Seconds 164
Stony Stevenson writes "New figures suggest that 92.3 percent of all email sent globally during the first three months of 2008 was spam. The data from Sophos also indicated that 23,300 new spam-related web pages were created every day during the period, or one about every three seconds. For the first time Turkey's contribution to the global spam problem puts it in the top three offending countries. Compromised computers in Turkey are now responsible for relaying 5.9 percent of the world's junk email, compared to 3.8 percent in the final quarter of 2007."
ntpdate time.spam.net? (Score:5, Funny)
I hate spam... (Score:1)
Re:I hate spam... (Score:5, Funny)
Re: (Score:1)
Won't sombody think of the children? (Score:4, Insightful)
Yes, sir! something should be done about spam!
And, while we're at it, someone should really do something about domain squatting.
Oh year, and what about phishing? Why isn't anyone doing anything about that!?
Seriously, guys; get on it. I'll be watching the third season of Seinfeld DVD.
Re: (Score:1)
My idea is that if x% of the traffic coming out of a country is abusive then those controlling, let's pick the U.N. for now but it could be another group of countries, then 100% of that traffic will just be bit-bucketted at the gateways. I have absolutely no clue how that would work but I'm th
Re:Won't sombody think of the children? (Score:5, Interesting)
If you block a country because it is relaying spam, it will be switched to go via another country before the week is out. Meanwhile millions of innocent people will find themselves cut off.
Specifically, if required, then the U.S. of A. should be subject to these same rules.
You bet. Clean up your own act first. I'm not holding my breath. Easier to blame nasty foreigners.
Did you RTFA:
And see the ROKSO list [spamhaus.org], note the nationalities.I live in Hong Kong. About 80% of the spam I get is from the US. And yet I find my emails often bounced from US addresses because of similar enlightened attitudes.
Most of the world's spam ORIGINATES in the USA, is PAID FOR by USA companies. Your government does nothing to stop it. (What is it, two or three prosecutions in the last 5 years?) American companies lobby to prevent any effective measures to stop spam. Bit bucket Florida and you might make a dent in it for a while. But attack the source, not the routing.
Re: (Score:2)
I disagree. Most of the world's spam may be sent by zombie computers in the US, but it originates in countries like Russia, where the owners of those large bot-nets reside. And the spam isn't being sent by US companies. Stock pump-and-dump schemes seem to come mostly from Europe.
The reason so much spam comes from the US is simply that we have so many idiots with zombie computers over here. The "owners" of those zombie nets are
Re: (Score:2)
If you want more enlighenment I suggest you look at the list of the worlds most prolific spammers, and specifically what country they reside in: http://www.spamhaus.org/Rokso/ [spamhaus.org]
Re: (Score:3, Informative)
Re: (Score:2)
"Originates" not "comes from". I still say USA. Anyway, at the moment most of my spam is about viagra and penis enhanceement, and references US sites. (Honourable mention to Nigerian 419ers, but these are small in volume.) I haven't seen any stock spam for a few months, actually.
More importantly, almost all
Re: (Score:2)
Most spam is selling fraudulent or non-existent goods. If investigated, the senders could be convicted for breaking existing laws. But each instance is too small for prosecutors to bother. So they do nothing. If even 1% of spammers weer tracked to source and the senders charged, it would disappear pretty quickly. If the spammers want to make money they need to be hooked into the financial system. Regard
Re: (Score:3, Interesting)
Re: (Score:2)
You mean like spam filtering? Seriously, there's no excuse these days to be using a mail account that doesn't have decent filtering. You shouldn't be getting more than a few spams a week. I realize that it doesn't solve the problem, but oh well.
Ranking is unimportant (Score:5, Insightful)
Third placed Turkey and tenth placed UK are wthin a +- 6% band, probably close to the margin of error in the analysis.
Belated generalized anti-spam suggestion for Gmail (Score:2)
The goal of this suggestion is to intelligently leverage and focus Google's expertise and credibility against the spammers and their accomplices. But where will the intelligence come from? From me, from you, from *ANYONE* who has a Gmail account and who wants to help oppose the annoying evil that is spam. Aggressively implemented, it could make Gmail into Spammer Heck--maybe to the point where only a fool would send spam to Gmail. (Yeah, there are pl
I dont get it... (Score:5, Interesting)
Re:I dont get it... (Score:5, Insightful)
Yes; it takes plenty of processor time, electricity, memory, bandwidth, and administrator time to make sure that you don't get spam. Also, not everyone uses e-mail the same way you do. Some of us actually want to hear from people we don't know.
Re: (Score:2)
Re: (Score:3, Informative)
Also for some reason I am more likely to get spam on my hotmail/gmail accounts than I am on my work account, and I don't hand those emails out to anybod
Re: (Score:2)
it started as an experement. i wanted to see if my gender made a difference in the number of 'v1agra' ads that i got, so one account listed me as male, the other, female.
(it made no difference - aparently, spammers think females want to have a bigger pen1s too)
while my main yahoo account (myr
Re:I dont get it... (Score:5, Interesting)
IIRC there was someone who tried an experiment some time ago. They tried to buy some of the v1|4|g|r|4 that they'd seen advertised in spam.
They couldn't find a single spam which actually led to someone genuinely trying to sell something. I think they concluded that spam had mostly become a pyramid scheme, with a handful of people at the top trying (with some success) to persuade everyone below that they could make lots of money from spam - all they needed to do was buy this mailing list software and that list of email addresses...
Re:I dont get it... (Score:4, Informative)
Try it yourself. I just did, went to my trash folder and opened the first mail. Took me to sale-drug.com, which certainly looks like they have stuff for sale (or at least, they'll take my money). No need to take anyone's word for this, we all have plenty of spam.
After a few months with most of the spam being stock scams, it's back to good old penis enlargers, generic viagra and cialis. It's all so fucking repulsive and insulting.
Re: (Score:2)
i do exactly that, for the past 7 years or so (since 2001, i think, not sure) i have had 2 email accounts, one is personal, the other is used for online forms, registrations, notifications, ebay, amazon shopping, etc.
[...]
It takes very little effort on my part.
for me, spam is not an issue.
My first e-mail address was cluttered with spam, and the primary method to access it was through a 2400 baud modem. The interface later improved where you could use web-mail alongside a faster connection - however, the quantity of spam compared to legitimate messages still made it a lot of work to go through. (It also had a size limit for "possible junk" but didn't delete the most likely spam items.)
My second e-mail address, even though it has a 6.0 MB limit, eventually received enough spam on a daily bas
Re:I dont get it... (Score:5, Insightful)
- Included you on a To: or CC: list of recipients,
- Used your email address to search for you on social sites,
- Sent you e-cards/e-invites
That's pretty amazing. I'm sure most of the spam in my "friends only" or "business only" email accounts were not leaked by me but by a trusted party who didn't know better.Re:I dont get it... (Score:4, Funny)
- have only geek friend
- have no friends
Take you pick - I don't know what's worst.
Re:I dont get it... (Score:4, Interesting)
* Used your email address to search for you on social sites,
* Sent you e-cards/e-invites
There is an astonishing number of people who've had email accounts for years now, and still do the very first and worst thing you mention in your no-no list. I guess it's the most convenient (read: lazy) way to re-send the same lame joke to fifty people. The CEO of the company I work for keeps doing this in my business account!
Or those blasted chain emails. I can imagine that many of those were created by spammers harvesting addresses, exploiting peoples' superstitions in machiavellian fashion.
Back in the days of dialup, when the "Dalai Lama wisdom tidbits, send this to twenty people you know" type pps files were already bugging me beyond belief, some bitch that somebody knew that somebody knew that I knew had the nerve to send out a gigantic list of CC: recipients to hundreds of people, with no message whatsoever, just the headline "Let's see what happens". Needless to say, she was bombarded with hate mail, but it was too late. In a few months' time, I was getting about a hundred and fifty spam mails a day, so I created a new address, notified my inbox contacts and asked them to never, ever put me on a CC: list.
It worked for a while, then I started getting spam again, and I couldn't figure out why. Then it hit me: "Damn, I used my address to register in Amazon (also buying stuff through its' independent affiliate sellers), Paypal, eBay and the like". Could that be an additional reason?
Re: (Score:2)
Re: (Score:2)
I get it a lot, it drives me mad. I don't give out my main personal email address to certain people for this reason.
Re: (Score:2)
until the spammers start using rainbow tables to brute force email address. Of course I'm joking but imagine if the payoff justified that level of resources. It's scary.
All that effort to create policy for policing P2P should be shifted to the spam problem.
Re: (Score:3, Insightful)
Then you do get spam. You've just chosen to deal with it by making sure it all goes to a particular address.
As soon as you sign up to a public mailing list, post on usenet or put your email address on something not terribly well known for privacy (eg. Facebook), you'll find that - lo! - you get spam.
Either that or your school's email admin staff have finally discovered the Holy Grail of anti-spam solutions. Perhaps they
Re: (Score:2)
On the average day, our spam filter discards between 1 and 1.5 kilomessages, and allows ~.5 kilomessages through
On the webmaster account, I get maybe 3 spam messages a day which filtered through the spam filter, and those are almost always tagged as "Probably Spam"
our solution: spamassassin, keep the rules up to date, and we've tweaked a few scores very slightly.
Re: (Score:2, Funny)
Re: (Score:2)
> Am I missing something here?
Yes. You simply haven't got any SPAM *YET*. It's not you giving it out that you've got to worry about - if anybody you've ever emailed gets a virus, their whole address book could easily be uploaded to the net (since hundreds of viruses are created simply to harvest address books).
One day you WILL get spam at that address and it doesn't take long once it's "out there" for you to get a LOT of spam.
Re: (Score:2)
Wooohooo!!! Go Turkey! (Score:3, Funny)
Re: (Score:2)
A video from the Spam Dept (Score:2, Informative)
http://www.youtube.com/watch?v=anwy2MPT5RE [youtube.com]
Enjoy!
Re: (Score:3, Interesting)
Wait a minute (Score:5, Funny)
Re:Wait a minute (Score:5, Interesting)
I think you may have answered your own question there
Officially, S.P.A.M originally stood for "Shoulder of Pork And haM". However, it most often referred to as "Something Posing As Meat" and "Spare Parts Animal Meat."
There are also, completely unsubstantiated of course, rumors that old man Hormel himself thought he was going to hell for his part in creating it...
Re: (Score:2)
Re:Wait a minute (Score:4, Funny)
Sturgeon's Law (Score:3, Informative)
Re: (Score:2)
In the same period I've gotten 25,818 spam.
That means 99.69% of all my email is spam.
Re: (Score:2)
GMail deletes spam older than 30 days.
In 30 days I've gotten 45 legitimate e-mails and 1792 spam. Most were automatically filtered, a few manually.
So 97.55% here... hrm.
An interesting percentage would be how much of the spam snuck through, but I don't have that metric.... couldn't be more than a couple dozen though.
Facebook (Score:1)
Re: (Score:1)
Re: (Score:1)
Re:Facebook (Score:5, Funny)
Re: (Score:2)
Browser Share in Turkey? (Score:1)
Re: (Score:3, Insightful)
More interesting is the ratio of infected computers. It isn't stated. But take the population of the US and the Population of Turkey and do a comparison. The other interesting number is the number in Russia. Russia has a large population, but how many of them even own a computer or have internet? Something tells me they have a very high proportion
A Rate Comparision (Score:5, Funny)
I didn't think it was possible.
Re: (Score:2)
Don't be silly! Of course it's not actually possible. You see the sex "thought process" is actually a continuously running background process with at least one dedicated processor at all times. The size and strength of that processor varies of course, but is nonetheless always active. Furthermore, the rate at which some people are measuring this process is incorrect, as they only measure when it gains control over the active "window", which is about once every few seconds.
Was anyone surprised here? (Score:5, Insightful)
And the part about a new spam site created every 3 seconds shouldn't surprise anyone either. As much as people despise spam, there is still money to be made in it. Thats why people continue to send spam, of course. Thats also why people continue to buy new domain names to sell discount "drugs" and "software".
This just tells us what many of us already knew. The spam problem will continue to get worse until we actually apply a economic solution to this economic problem.
Re: (Score:2)
Re: (Score:3, Informative)
Except of course for those who use botnets controlled by compromised servers to send spam, which is most of them nowadays.
Re: (Score:2)
One proposal that's been thrown about is a sort of micro-tax on emails
Thats a good idea, however if your own experience with spam is similar to mine, it would have almost no meaningful effect. I say this because, at least in my inbox, the vast majority of spam comes from overseas. Even if the spamvertised domains are .com, the domains themselves are registered overseas, and the spam originates from open relays on other continents as well.
Which of course would make tax collection nearly impossible.
Re: (Score:2)
The ratio is completely wrong for that. (Score:4, Interesting)
The reality is that a single sale of "herbal \/1agr4" can mean a profit for the spammer. The cost of spamming is that low for them.
In order to make it economically unsound for the spammers, you'd have to make it economically annoying for the rest of humanity. More annoying than simply putting up with the spam.
UNLESS we get rid of the stupid CAN-SPAM law and allow each state to institute its own anti-spam laws and allow citizens in those states to sue the spammers for violating those laws.
Yeah, this will hurt "legitimate" fucking "email marketing" companies
Re: (Score:2)
Not necessarily. If you have a trust network or database telling you which sources are more likely to spam (like RBL but with degrees instead of "either you're a spammer or you're not"), mail servers could demand more of sources that are likely to spam. Just connect this thing to another network of cryptographic time stamp serv
Re: (Score:3, Insightful)
The reality is that a single sale of "herbal \/1agr4" can mean a profit for the spammer. The cost of spamming is that low for them.
No, the reality is that spammers don't care if the product they're pumping sells at all. Spammers sell spam, it's the fool that's buying the spam that wants to sell "herbal \/1agr4". Sure, spammers would like it if someone would buy the stuff, but when the current fool finally realizes he's not making any money there's always another sucker with a get rich quick scheme and a little cash to buy the spammer's services.
Re: (Score:2)
In order to make it economically unsound for the spammers, you'd have to make it economically annoying for the rest of humanity. More annoying than simply putting up with the spam.
UNLESS we get rid of the stupid CAN-SPAM law and allow each state to institute its own anti-spam laws and allow citizens in those states to sue the spammers for violating those laws.
I think that depends on how one uses the internet. From my own experience, I can say that a good portion of spam is propagated because of complacent registrars and their lax policies towards spam. Spamvertised domains are usually shut down fairly quickly by ISPs, however, new domains are sold at a bewildering rate. As soon as a spammer loses one domain he just opens a website on the next and the global game of whack-a-mole continues.
I say therefore that we could reduce spam dramatically by coming d
ASSP is the answer (Score:4, Informative)
30 minutes to install on an exchange server... filters out all the spam.
I run it on all my clients, and they average about 95% of all mail intercepted as spam with a zero false positive rate.
http://assp.sourceforge.net/ [sourceforge.net]
ASSP (Score:3, Funny)
Re: (Score:2)
Re: (Score:3, Interesting)
I too can install a filter that filters out all the spam.. Send it to dev null. A good filter should have a low false positive rate along with removing most spam. Many filters that remove most (or all) spam also have a high false positive rate.
My ISP seems to lose about 50% of my business mail. Some comes marked spam and some doesn't even arrive.. Either that or my requests for quotes are ignored by my vendors.
I've been trying to ge
Idiot email admins. (Score:2)
#2. Any mail rejected MUST be rejected at SMTP time and include the phone number of the email admin of the rejecting server.
That's how I do it. If my machines are rejecting your messages, your server is getting my phone number along with the 5xx error message. Exim4 rocks.
If your server does not deliver that rejection notice to you, that's the fault of your email admin.
I've pretty much cut spam out completely at the company I work for. The only problem is the rather l
Re: (Score:2)
Or the fault of anybody who's backbone it transverses. Many ISP's bulk filter to reduce the traffic that transverses the network. A spam blast of image spam and the following bounce traffic followed by the bounces of bounces can be eliminated by simply dropping high probability spam traffic. This includes most of my request for product bids and requested offers. SPAM from compromised home users make it thr
Re: (Score:2)
It might not be my request to a manufacture that was rejected. It may have been the reply, and the manufacture would have recieved the bounce..
How long have you been an email admin? A common way for a long way to pass filters was simply bounce spam off a mailserver with forged headers. This used to deliver all the bounced mail messages with your spam right on to your spam reciepient list. Don't tell me you
Re: (Score:2)
Re: (Score:2)
Thanks, I'll check it out. I know many filters are poisoned (Nonsense text mails) to reduce their effectiveness. I hope this one can keep working when poisoned.
Re: (Score:2)
I don't know about ASSP, but I use third party solutions for my servers as well. Your not the only one that seems to have a handle on it.
I get perhaps 8% of all inbound email messages labeled as SPAM and STILL placed into the Junk Mail folders. I don't have a zero false positive rate though, but it is very low. Less then 10
Re: (Score:3, Interesting)
Re: (Score:3, Funny)
Or I can blacklist his ass.
summary is misleading (Score:4, Interesting)
What everyone gets in their mailbox are mainly American spam messages intended mainly for Americans, sent via hijacked Windows computers around the world. There's also a significant fraction of messages intended for a handful of other rich countries, but the only third world country seriously contributing their own spam is probably Nigeria.
Re: (Score:2, Informative)
Phrases such as "Turkey's contribution to spam" are highly misleading. Turkey doesn't actually contribute significantly to spam. How many Turkish language spam messages have you got recently in your mailbox? How many spam messages advertizing a Turkish company's products? None? Then Turkey's contribution to spam is negligible.
I disagree. There needs to be a means of getting all these Turks to get their computers infected. I can tell you that there are many many web-sites targeting Turkish internet users for all sorts of attacks. Plus, downloading music using clients saturated with spyware is common and I'd be shocked if many of these were not also trojans.
So, yeah I think Turkey is totally contributing to the spam problem.
Re: (Score:2)
Actually, in the past year or so I've noticed a trend in my spam toward the CJK section of Unicode... all that newfound Chinese buying power is searching for an outlet.
Re: (Score:2)
From this you can draw conclusions like anti-virus and firewall software is too expensive for home users in Turkey, and decide how best to fix the problem.
Re: (Score:2)
Different kinds of numbers (Score:3, Informative)
But the 1st number, the amount new web pages related to spam, needs to be explained a bit more. The original Sophos report [sophos.com] at least explain that are the related to the web links included with the mails, but not sure if that implies more spam realted domains, more spam related servers or if the big numbers are more related to different ways to write urls in the same servers,
One day... (Score:2, Interesting)
Never give up! (Score:2)
"But this does not mean that other countries can give up the fight."
That's right, it's still early in the year, no one is down and out quite yet. Plenty of chances for any up-and-comer to catch up and make an appearance on the leaderboard - who knows what the second quarter may hold!
While American spam offers girth and inches... (Score:4, Informative)
Why (Score:3, Funny)
This is just so utterly ridiculous to me that it actually makes me sick to think about it. The shear amount of waste being dealt is just insane. And it's not just Email, it's regular postal mail too. The US Mail System is so clogged up with junk that it amazes me that my paycheck gets to me each month. Every single day my mail box is full of, basically, junk that goes straight into the fire.
Re: (Score:2)
Stubborn sysadmins. Think about how much spam would be eliminated if you forced the from address to be the same server that was actually delivering the email.
If my email address is bob@example.com, the only machine that should be allowed to send mail proclaiming to be from example.com is example.com.
But noooo.. sysadmins demand the ability to forge the from address. It's a *feature*.
Email is broken by design.
Re: (Score:2)
Simple but no one will do it (Score:3, Insightful)
This is the problem with decentralized control.
Isp's are part to blame.
I use Gmail (Score:2)
I mean, sure, I get a few per week in my Inbox, but that's hardly the problem it used to be with my former accounts. I've stopped using those and forward them to the Gmail account now.
No solutions to spam? (Score:2)
My own solution still stands - The parasite will eventually destroy the host at which point "huge investment to existing SMTP infra" becomes dodgy enough that it will be replaced by something else.
Hard to see how you can stop zombie-nets, thought. Even if you had some super-duper cryptographic challenge system in place, spammers can throw 100k botnet at that which can do whatever the legitimate u
Do the numbers mean anything? (Score:3, Insightful)
But I have to wonder, how does that statistic that 92.3% of all email sent is spam relate to the rate of junk mail sent via snail mail? I don't know about you, but I'd say that 90% or more of the mail that comes to my home is junk mail, so I'm not sure that the spam statistic is all that surprising. This may just be the expected signal/noise ratio.
Re: (Score:2)
On the other hand, I know there are peopl
Tarpits (Score:3, Informative)
I have the ability to turn my mail server into a tarpit, but it won't do much good unless there are a lot of other tarpits out there too.
Re: (Score:2)
Even with a single email address, if you determine that an inbound message is spam, you can keep the spammer's connection open. I'm running Exim with SpamAssassin, connected with SA-Exim, and while I had it in tarpit mode I held some spammers' inbound email connections open for four days. (It would have been longer, but I set 100 hours as an arbitrary limit.) Imagine enough tarpits out there not letting go of the spammer's connections, and eventually the computer bein
Re: (Score:2)
The reason tarpits work is that many spambots follow the SMTP protocol, at least nominally. According to RFC 821, as long as the server continues sending lines whose reply codes are followed with hyphens, the client is not supposed to disconnect - and ve
One man could fix this... (Score:3, Funny)
Re: (Score:2)
No, you're not.
However, Zombied machines on Turkish dial-up or broadband connections aren't the biggest problem I have - they seem to get added to various blacklists fairly rapidly. The biggest headache I have right now is those wacky Nigerians and their national sport, abusing Hotmail and Gmail and Yahoo accounts for fun and profit.
Let's tell Dubya that Osama has been seen hanging out in Lagos, and that most of the proceeds from
Re: (Score:2)
Re: (Score:3, Funny)
( ) technical ( ) legislative ( ) market-based (*) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the mone