I received a rather lengthy question that mentioned a specific service that claims to turn the tables on spammers either by spamming them back or by somehow using the content of their spam messages in an attempt to harm them in some way… or at least annoy the heck out of them.
Now as much as spam angers us, besides ultimately being ineffective, vigilante justice just isn’t the answer.
Become a Patron of Ask Leo! and go ad-free!
Spamming the spammers
One common idea is to take incoming spam email and reply to it with thousands of messages in return.
There are so many problems with this idea that it’s hard to know where to begin. The biggest one is simply that the spammers don’t pay attention to the email that gets returned. Either the “From” address is forged and you’re actually spamming an innocent bystander, or the “From” address is completely fake, in which case you might just find yourself the recipient of thousands upon thousands of bounce messages.
In either case, what’s happened here is that you have become a spammer, or perhaps this third party service you used for this has.
The fact is spam is spam, whether or it comes from a spammer, or from you, or from a service. You are causing thousands of unsolicited email messages to be sent, which makes you a spammer.
Depending on how things are set up, you actually run the risk of losing your email account, or your email provider being placed on blacklists, and your legitimate email not being able to make it out. You even run the risk of running afoul of the law since what you would be doing is, as I understand it, quite illegal.
So it’s illegal, it’s ineffective, and the only person potentially impacted by your actions is you.
Don’t do it.
Using the spam’s content to spam or annoy someone
Well, first of all, you can’t send email to a link. A link goes to a page on a website which is quite different than an email address. In a spam message the two actually can be completely unrelated and often are. Even though you might know the domain that the link goes to (the “whatever.com”), you simply can’t know the email address at that domain at which to target your attack.
But it gets much worse. Once again, the link in the spam is rarely the actual website of the spammer. These links actually fall into two buckets:
- hidden pages on websites that have been hacked
- and temporary websites on temporary domains
The first one is little understood and actually so very common that it’s worth explaining.
What spammers like to do is this: they actually hack a legitimate site. For example, they’d love to hack AskLeo.com. In a folder on the hacked site they then place their own malicious code. Perhaps simple HTML, perhaps JavaScript, perhaps a redirect, perhaps something else entirely.
The spam emails then contain a link to that page on the hacked site. So, if it were on AskLeo.com for example, it might be something very random like AskLeo.com/wp-content/uploads/something-or-other. Ideally (for the spammer) something that I as the site owner might never even notice, or at least not notice for a long time.
Since it’s a link going to a legitimate site, the email is not flagged by spam filters. When you click on that link, the malicious code that has been placed there by a hacker does something to redirect you to some other site that then has the real content, or perhaps even some other intermediary site, to further obscure the final destination.
If you can’t spam ’em, then maybe DDoS em?
Now, while you can’t send email to those kind of links, you could, I suppose, try to mount a denial-of-service attack on them. Basically, instead of sending thousands of emails, you would attempt to make thousands and thousands of requests of that URL with the intent of crippling the spammer’s server, or just annoying the heck out of them.
The problem is that as I’ve explained, it’s not the spammer’s server at all! If you succeed, you’ve only succeeded in taking down some innocent third party whose site happened to get hacked.
Oh, and once again, I’m pretty sure you’ve broken the law.
Fighting spam the right way
Fighting spam just isn’t that simple. Yes, authorities often do follow the complex trail of obfuscated and hacked email addresses and links, and they often do manage to stop spammers and their networks. Or at they at least slow them down. But it’s not nearly as simple as some kind of individual “fighting back” service would make it out to be.
The best thing you can do to avoid spam is to use the “this is spam” button in your email program appropriately. Only flag true spam – unsolicited commercial email – as spam. Use the “not spam” button on any email you find that was mistakenly placed into your spam folder.
And never, ever, buy anything that comes to you as spam. It’s the fact that just enough people do this that makes spam the industry that it is.
This article reminds me of a company called Blue Security which produced a Windows client called Blue Frog in an effort to combat spammers. It was back in ’06 I think. If memory serves, it didn’t go so well.
As you say, just use that ole “this is spam” button. I’ve been using Gmail for many years and its spam filters work remarkably well.
About that last part:
In my opinion, if someone wished that a company would die off, destroying their product or throwing it in the trash doesn’t help because once that person pays for it, what happens to the product doesn’t matter: the price of manufacturing it has already been more than made up for and the company made a profit from it. This could be said not only of spam products, but also of legitimate companies, as haters are just going to hate.
And trying to “return” spam in quantity, is simply cluttering up the Web for everyone.
Like the spammers, I have many disposable email addresses. When the spammer asks me to write back with Western Union cash info and things of the type, I bombard them with polite notes asking them to “unsubscribe” my address AND hundreds of news articles, poetry, jokes, and whatever else can be easily forwarded via rss feeds. I also write polite notes asking about the weather and things of that sort.
As I said, I have many different email addresses of my own. I flood their mailbox with whatever can be easily sent using several different email addresses of my own. The spammers often get the message and go away. Not always, but often.
So you fight the spammers by stooping to their level and becoming a spammer yourself? This is not recommended. You could lose your legitimate email accounts and your ISP could boot you if it were to generate complaints. ISPs in particular take spamming very seriously.
Old thread I know but someone else will read this after me. No, most ISPs do not care. Limestone Networks is in business as far as I can tell to service spammers. I now have blocked most every IP address range they own due to the spam from them. I email their abuse department and receive nothing back from them. The server hosting farms do not care as long as they are getting paid.
In the case of hacked sites, a nasty thing is to add an alternate stream. Those are created by having something like somefile.html:a secretpage.html
Under Windows, you can have c:\:nasty\ that can’t be suppressed short of reformating.
The same can be done under MacOS and Linux/Unix and may look as root:nasty.
The part after the colon is the alternative stream. What is nasty is that it will NEVER show when you show a folder’s content AND whenever you copy or move the original file, of even whole folder, the alternative stream will tag along.
The only sure fire way to get rid of those, if you don’t know the exact name to use, is to move the file or folder to a destination that don’t support alternative streams, delete the original, then restore the file/folder. If it’s the root of a volume, you’ll need to reformat it.
That artikle made me laugh :D
I did just read till the Ddos section. First you mention Ddos (distributed denial or service) and then you just talk about Dos (denial of service)
Know the difference? Dos doesnt work nowadays since every firewall is able to block a Dos attack.
Ddos however, is if the attacks come from virtually thousands of different clients. You would need a botnet for that. If you are at that level, you wont have problems with spam anyway ;)
I would like some advice and help, with a problem a bit different to the other posters but connected, after trying to sign up with three different expat forums and rejected by all, it turns out i’m a spammer it seems my email address from three different providers have all been hacked, as an 81 yr old i would’nt have a clue about creating spam or spamming anyone, i find now i’m rejected by everything i try to sign up for, in the last case a new email provider, which i thought might help, again turned down, can Leo or anyone help with this problem in fairly simple terms please, i would be very grateful
So you have three different email addresses from three different email providers, and each of them gets rejected when you try to sign up with this forum? I’m thinking it’s something other than the email address that’s causing the problem. I’d reach out to the forum owner for help. The specific words used by whatever rejection message you get would also likely give more details.
Leo thanks for your swift reply, what i meant and did’nt explain very well, i have three email addresses that i have used for years hotmail, yahoo. gmail,with no problems, when i tried to register with an expat forum i got rejected because as explained for the rejection it turns out i am a spammer, how this came about i have no idea, probable (i thought) relates to my email accounts, and more to the point what too do about!
The reference to another email account i tried to register with and rejected also was i think, on account of my record as a spammer, i thought by getting another email account different company different name etc. would enable me to join the expat forum mentioned above,sorry for confusion and hope it is clearer now!
I posted mainly to point out to the above posters pointing not all spammers know they are spamming as in my case
Thanks for your help Leo you have always been a good source of info much appreciated!
I send spammers a a reply with “thank you for signing up for daily SHIT pictures” Enjoy!
I then send photos of dog crap.
Funny as heck
And probably completely ineffective. In fact, you’re probably spamming innocent victims, since replying to spam almost never goes to the actual spammer.
and in the rare case your email gets to the spammer, that tells them your email address is a live one and makes it worth more on the spam address list market.