Tuesday, June 06, 2006

Spam Shrapnel

I thought I had it sussed. Spam. Careful use of throwaway email addresses. A "honeypot" spam address that is all over the internet that I can use to develop Bayesien spam filters to clear out the one or two items that sneak into my real email.

It was all looking good for just a few months. Perhaps a couple of years even.

But then... Some git spammer has decided to use my com and co.uk domain as the source domain for their spam. But not the .biz interestingly. So now I get hardly any spam at all, but I get stacks and stacks of undeliverable emails where mailservers have responded to the fake spam address on the spam email sent to a fake email address, because the address didn't exist. Or it did exist and they are full. Or the mail server recognised it as spam and incomprehensibly sent an email back to the "spammer" saying so (if you are not clear on why this is brainmeltingly pointless, please ask).

So now I have had to train my spam filters to recognise undeliverables and just about any other mailserver type communication and consign them to the spam bin. Which of course means that if I ever send an email now to a typoed address, I will never see the undeliverable.

This is immensely frustrating. Somewhere there are teams of spam servers sending spam to mailservers all over the world, and I am getting the fallout.

Was this intentional? It is just part of the process these days to use real domains as source addresses, or is this aimed at me? It cannot be, but it is hard to consider it just bad luck.

A few goes at looking through the mail headers from the kind mailservers that forward the original email to me in its entirety seems to show no commonality. No clues as to who is doing this and where from. It is doubtful that the IP addresses that I glean from this process are anything more than zombie relays, so following this up and reporting to the Russian and Chinese IS abuse addresses aren't likely to help.

So that leaves me with precisely nothing to do except wait for it to stop...

Unless someone out there on the internet has any ideas...

No comments: