Subject: Re: filtering of mailing lists and NATs

From: Vernon Schryver <[email-masked]>
Date: Tue, 22 May 2001 15:12:35 -0600 (MDT)

> From: grenville armitage <[email-masked]>

> ...
> Who knows. I suspect it would be a *vastly* long time before the
> ratio of 'blocked mailing list' to 'personal email addresses' becomes
> so high that spammers will special-case their code just to target
> mailing lists. Today mailing lists are accidental inclusions on spammer
> master target lists.

That last is clearly false for much of the spam that hits IETF lists.  At
least some spammers evidently already understand that one message through
a working and large list will hit a lot of valid addresses, often very
well "targeted" addresses.  Besides, mailing list traffic tends to be
"white listed" and so bypass individual spam filters.

>                      They already deal with email addresses that get
> stale and bounce,

Serious spammer do not care about stale or bouncing addresses.  That's
demonstrated by the "dictionary attack" spammers who have lists of 100's
to 1000's of user names that they try at every domain they hit.  If you
have a vanity domain, then watching for dictionary attack bounces and they
wiring those addresses to automated body filters can be very effective
measured in low false positives and false negatives.

>                   the trick is to convince them our mailing list address
> is similarly 'stale'. This *is* social engineering, by us, of them,
> using technology.

That assumes that that spammers prune their lists.  However, they clearly
do not.  My best body spam trap address today is a misspelling of my
username that first started getting hit several years ago, and that has
*never* been valid, and bounced for years until I recently wired it to
body filters.  The mispelling was apparently a harvesting software bug,
because many other people reported seeing equivalent bad addreses.

Vernon Schryver    [email-masked]

---

From: grenville armitage <[email-masked]>
Date: Tue, 22 May 2001 16:15:36 -0700

Vernon Schryver wrote:
	[..]
>  Besides, mailing list traffic tends to be

Which is why some of us would encourage the use of
techniques that make mailing lists less attractive
to opportunistic spammers.

I feel dizzy.

cheers,
gja