On Wed, 10 Dec 2003 19:37:12 -0800, "Chuck Tribolet"
wrote:

Yes, there are some domain names that you can figure out are
spamsters. Unfortunately, they are a quickly shrinking fraction. A year ago,
that worked. It doesn't work today. Here's an analysis of the From:
in the I've received since about 11/26. The number on the left of spams
I've received that purported to be From: the domain on the right.
1977 spams in a couple of weeks. Do the math -- black listing doesn't
work. But try the Mozilla spam filter -- it really does.

snipped list

Mozilla does help, so does ISP cooperation like Earthlink Webmail.
Nothing is 100%.

One important factor that most "ISP blockers" are neglecting is that
email addresses can be "spooged". In other words, spammers can send
email which appear to be from *any* email address. I have received
several fraud-mails, asking for "account and credit verification",
which DID NOT come from the address listed. Three of them were
dead-ringers for my ISP account. I forwarded them to my ISP, and they
reported spooged headers. Simply blocking a bunch of domains or ISPs
is like killing all the chickens because you got a rotten egg. You
might as well shut down all your email accounts or, better yet, turn
off the computer. They sure as hell can't get you then! )

Repaired my boat cover today. The damage was my own fault. 20" of
wet snow is a bit more than a cover can hold. Gotta' build a shed, or
get one of those "Suburbian Teepees".

Regards,
noah

Off-topic posting is a bit like farting in a house of worship.
Only children, the arrogant, or the ignorant, can truly enjoy it.
Only the arrogant and the ignorant insist on it.

To email me, remove the "OT-" from OT-wrecked.boats.noah.
....as you were. )

Chuck Tribolet wrote:
Yes, there are some domain names that you can figure out are
spamsters. Unfortunately, they are a quickly shrinking fraction. A year ago,
that worked. It doesn't work today. Here's an analysis of the From:
in the I've received since about 11/26.

Your list confirms my experience: yahoo in its various incarnations is
by far the most popular spoofed return address...I wonder why so many of
'em choose it over all the others on your list. I finally just set up
Mailwasher to delete ALL email with a yahoo return address.

Peggie
----------
Peggie Hall
Specializing in marine sanitation since 1987
Author "Get Rid of Boat Odors - A Guide To Marine Sanitation Systems and
Other Sources of Aggravation and Odor"
http://shop.sailboatowners.com/detai...=400&group=327

http://www.seaworthy.com/html/get_ri...oat_odors.html

It's "spoofed" not "spooged"

--
Chuck Tribolet

http://www.almaden.ibm.com/cs/people/triblet

Silicon Valley: STILL the best day job in the world.


"noah" wrote in message ...
On Wed, 10 Dec 2003 19:37:12 -0800, "Chuck Tribolet"
wrote:

Yes, there are some domain names that you can figure out are
spamsters. Unfortunately, they are a quickly shrinking fraction. A year ago,
that worked. It doesn't work today. Here's an analysis of the From:
in the I've received since about 11/26. The number on the left of spams
I've received that purported to be From: the domain on the right.
1977 spams in a couple of weeks. Do the math -- black listing doesn't
work. But try the Mozilla spam filter -- it really does.

snipped list

Mozilla does help, so does ISP cooperation like Earthlink Webmail.
Nothing is 100%.

One important factor that most "ISP blockers" are neglecting is that
email addresses can be "spooged". In other words, spammers can send
email which appear to be from *any* email address. I have received
several fraud-mails, asking for "account and credit verification",
which DID NOT come from the address listed. Three of them were
dead-ringers for my ISP account. I forwarded them to my ISP, and they
reported spooged headers. Simply blocking a bunch of domains or ISPs
is like killing all the chickens because you got a rotten egg. You
might as well shut down all your email accounts or, better yet, turn
off the computer. They sure as hell can't get you then! )

Repaired my boat cover today. The damage was my own fault. 20" of
wet snow is a bit more than a cover can hold. Gotta' build a shed, or
get one of those "Suburbian Teepees".

Regards,
noah

Off-topic posting is a bit like farting in a house of worship.
Only children, the arrogant, or the ignorant, can truly enjoy it.
Only the arrogant and the ignorant insist on it.

To email me, remove the "OT-" from OT-wrecked.boats.noah.
...as you were. )

The problem is that there are a LOT of legit folks on yahoo.
I've had 16 legit e-mails from yahoo residents in the last two days.
So just blocking everybody on yahoo doesn't work.

Again, try the Mozilla spam blocker. I've been a software nerd for
35 years, and I'm hard to impress. It impressed me.

--
Chuck Tribolet

http://www.almaden.ibm.com/cs/people/triblet

Silicon Valley: STILL the best day job in the world.


"Peggie Hall" wrote in message ...
Chuck Tribolet wrote:
Yes, there are some domain names that you can figure out are
spamsters. Unfortunately, they are a quickly shrinking fraction. A year ago,
that worked. It doesn't work today. Here's an analysis of the From:
in the I've received since about 11/26.

Your list confirms my experience: yahoo in its various incarnations is
by far the most popular spoofed return address...I wonder why so many of
'em choose it over all the others on your list. I finally just set up
Mailwasher to delete ALL email with a yahoo return address.

Peggie
----------
Peggie Hall
Specializing in marine sanitation since 1987
Author "Get Rid of Boat Odors - A Guide To Marine Sanitation Systems and
Other Sources of Aggravation and Odor"
http://shop.sailboatowners.com/detai...=400&group=327

http://www.seaworthy.com/html/get_ri...oat_odors.html

On Thu, 11 Dec 2003 16:06:38 -0800, "Chuck Tribolet" wrote:

It's "spoofed" not "spooged"

"Spooge" is that yukky stuff in the middle of the freeway that you want to avoid
when you're riding a motorcycle.

Joe Parsons

Chuck Tribolet wrote:
The problem is that there are a LOT of legit folks on yahoo.
I've had 16 legit e-mails from yahoo residents in the last two days.
So just blocking everybody on yahoo doesn't work.

So...it catches a few people who actually have yahoo addresses. But they
also have real email addresses...which they'll have to use if they want
to email me. IMO, the best way to kill off yahoo as the spammers'
favorite spoofed address is to make it impossible for anyone else to
use, forcing 'em to close it. If someone is determined to have a free
anonymous address, there are other services that offer free email
addresses...that don't attract 10% of the spammers that yahoo does.

Peggie
----------
Peggie Hall
Specializing in marine sanitation since 1987
Author "Get Rid of Boat Odors - A Guide To Marine Sanitation Systems and
Other Sources of Aggravation and Odor"
http://shop.sailboatowners.com/detai...=400&group=327

http://www.seaworthy.com/html/get_ri...oat_odors.html

On Fri, 12 Dec 2003 01:16:51 GMT, Peggie Hall wrote:

Chuck Tribolet wrote:
The problem is that there are a LOT of legit folks on yahoo.
I've had 16 legit e-mails from yahoo residents in the last two days.
So just blocking everybody on yahoo doesn't work.

So...it catches a few people who actually have yahoo addresses. But they
also have real email addresses...which they'll have to use if they want
to email me. IMO, the best way to kill off yahoo as the spammers'
favorite spoofed address is to make it impossible for anyone else to
use, forcing 'em to close it. If someone is determined to have a free
anonymous address, there are other services that offer free email
addresses...that don't attract 10% of the spammers that yahoo does.

I suspect those aren't actual Yahoo addresses. The spammers just want to put
something in the sender field.

Joe Parsosn


Peggie
----------
Peggie Hall
Specializing in marine sanitation since 1987
Author "Get Rid of Boat Odors - A Guide To Marine Sanitation Systems and
Other Sources of Aggravation and Odor"
http://shop.sailboatowners.com/detai...=400&group=327

http://www.seaworthy.com/html/get_ri...oat_odors.html

On Thu, 11 Dec 2003 16:06:38 -0800, "Chuck Tribolet"
wrote:

It's "spoofed" not "spooged"

I guess it depends on where you are. My ISP referred to the problems
as "spooged", and their email was .
I don't care what they called it, they handled it.

I know, it's tough for us old farts to keep up.
Regards,
noah

********************
Off-topic posting is a bit like farting in a house of worship.
Only children, the arrogant, or the ignorant, can truly enjoy it.
Only the arrogant and the ignorant insist on it.

To email me, remove the "OT-" from OT-wrecked.boats.noah.
....as you were. )

And if you kill off yahoo, the spamsters will pick something else (hotmail, aol, ...)
and you'll be no better off.

I get as much legit e-mail from yahoo.com as I get spam purporting
to be from yahoo.com. The legit stuff is from friends I wouldn't want to
cut off. So a simple "all yahoo.com is spam" blacklist just doesn't work.
Mozilla does.

And for many (most?) of those folks, the "real" e-mail address is a
business address, and they want to have an address that will be constant
across job changes and is not implicitly associated with their employer.
I got the garlic.com address a number of years ago when I had a visible
position with the Northern California Underwater Photographic Society,
and I didn't think it was appropriate for NCUPS stuff to be coming and
going from an IBM.COM e-mail address. I willing paid $20/month for
that separation of address.

And if you look at what I posted, yahoo.com spam is perhaps 15% of
spam. Mozilla catches 95+% (I get 150+ spams a day, Mozilla catches
all but about five or six.)

--
Chuck Tribolet

http://www.almaden.ibm.com/cs/people/triblet

Silicon Valley: STILL the best day job in the world.


"Peggie Hall" wrote in message ...
Chuck Tribolet wrote:
The problem is that there are a LOT of legit folks on yahoo.
I've had 16 legit e-mails from yahoo residents in the last two days.
So just blocking everybody on yahoo doesn't work.

So...it catches a few people who actually have yahoo addresses. But they
also have real email addresses...which they'll have to use if they want
to email me. IMO, the best way to kill off yahoo as the spammers'
favorite spoofed address is to make it impossible for anyone else to
use, forcing 'em to close it. If someone is determined to have a free
anonymous address, there are other services that offer free email
addresses...that don't attract 10% of the spammers that yahoo does.

Peggie
----------
Peggie Hall
Specializing in marine sanitation since 1987
Author "Get Rid of Boat Odors - A Guide To Marine Sanitation Systems and
Other Sources of Aggravation and Odor"
http://shop.sailboatowners.com/detai...=400&group=327

http://www.seaworthy.com/html/get_ri...oat_odors.html

I suspect those aren't actual Yahoo addresses. The spammers just want to put
something in the sender field.

Yup...and it seems that 90% of 'em choose Yahoo. Yahoo now controls my
ISP's email and news servers, but they can't even be bothered to try to
match up return addresses on incoming mail to their own servers against
their own account list. I'm happy to do my part to put their free email
out of business by blocking all of it, legit AND spoofed. The spoofed
ones aren't bounceable, but if enough people block everything from 'em,
people who do have real yahoo.com email addresses will start complaining
to that their email isn't getting through either.

If I had nothing better to do, I wouldn't block spam with spoofed yahoo
addresses, I'd forward every bit of it to yahoo and encourage everyone I
know to do the same. If everyone else is averaging the same 100+ a week
that I get, and were willing to do the same, that would clog up their
system so badly that it would amount to a denial of service
attack...which, since there'd be nothing illegal about it, MIGHT finally
force 'em to do whatever it takes to stop it.

There has to be a reason why yahoo is the most popular spoofed
address...I'd love to know what.


Peggie
----------
Peggie Hall
Specializing in marine sanitation since 1987
Author "Get Rid of Boat Odors - A Guide To Marine Sanitation Systems and
Other Sources of Aggravation and Odor"
http://shop.sailboatowners.com/detai...=400&group=327

http://www.seaworthy.com/html/get_ri...oat_odors.html




--
Peggie
----------
Peggie Hall
Specializing in marine sanitation since 1987
Author "Get Rid of Boat Odors - A Guide To Marine Sanitation Systems and
Other Sources of Aggravation and Odor"
http://shop.sailboatowners.com/detai...=400&group=327

http://www.seaworthy.com/html/get_ri...oat_odors.html