4

There are several pages on the Web that generate fake e-mail addresses so spammers can harvest them; the purpose is to fight spam. (Some examples of this concept under discussion and, in some cases, in practice.)

For this to work, the spammers have to (a) harvest addresses off of the Web, (b) not 'blacklist' such pages (either on autodetection or on manual detection), and (c) care that their mail gets sent to real addresses. Are all these true? Do these address generators work?

And if so, then how do they work? Is the idea that the spammers will be inundated with returned mail and implode? That they'll have too a low a return (real responses) on their investment (e-mails sent out) and go out of business?

Improve this question
1
  • I don't think that would work, spammers will use fake return addresses just so they wont get inundated (or use a mail server that spits out a "user unknown" error as soon as an incoming mail is a bounce message) – ratchet freak May 1 '12 at 1:40
6

Fake email addresses most typically server as spamtrap (kind of honeypot). They idea is, since that such a email address would never be used to receive any legitimate emails, anything that comes is a spam. These spam messages are later analysed and used to update various RBLs (Real-time Blackhole List), nowadays most typically DNS based black list.

Upon receiving connection from blacklisted spammer, rather than rejecting connection right away many servers would use tar-pit technique. Which means basically keeping connection open until it times out. The idea is, that SMTP is typically transported over TCP, meaning that single computer has limited number of simultaneous connections (open sockets) it can make. Thus, should spammers use standard SMTP server with standard settings, tar-pitting would seriously hamper their throughput. However, all of above techniques are completely useless when spammers use botnets.

Improve this answer
1
  • 1
    For the botnet case, you counter with Bayesian filtering. Basically, the idea is that if a botnet is used to send out a new spam, the spamtraps will get many copies of the message very quickly. They will then develop a filter that detects the fingerprint of the message and distribute that. This will block the spam regardless of what DNS/IPs the botnet uses. (The spammers counter this by smarter randomizing of the spams to make them hard to match with a filter. It's an arms race.) – David Schwartz May 1 '12 at 11:33
0

Since this idea is at least 15 years old (See Wired Feb 1997) and spam e-mailing has continued, I suspect that this particular approach has not worked to prevent spam.

In fact many spammers invent their own lists of addresses to try (though usually with genuine domains): harvesting is so last century.

Improve this answer
2
  • 1
    -1: although you are probably right, you do not give good references to your answer and fail to consider an incredible amount of confusing factor, such as the fact that in 1997 not many people had an email address compared to today or that in 1997 the "hype" was viruses rather than Viagra spam, or that anti-spam filters were aweful at the time, and so on... – nico May 1 '12 at 7:32
  • 1
    Got to disagree - it's still a great way of keeping your bayesian filters fresh – symcbean May 1 '12 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.