Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A little trick to spam the spammers (2021)

misc.l3m.in

Post reply on HN
Print view View original

71–80 of 231 posts

Re: A little trick to spam the spammers (2021)

#71

Post by hinkley »

temp0826 wrote: post #47
DonHopkins wrote: post #25

https://news.ycombinator.com/item?id=12951917 DonHopkins on Nov 14, 2016 | parent | context | favorite | on: The NHS's 1.2M employees are trapped in a 'reply-a... Back in the days of ARPANET mailing lists, there used to be an "educational" mailing list called "please-remove-me", that was for people who asked an entire mailing list to remove them, instead of removing themselves, or sending email to the administrative…

Something similar happened (multiple times?) when I worked at AWS when someone decided to send a mass email to literally the entire company and people inevitably reply-all enough to clog the system and bring it to its knees. Many confused people were replying "UNSUBSCRIBE" (again, to the whole company) as if it would take them off

Then you get a group of people panicked about the panic who start replying all saying please stop replying all to this email, and then people replying to them to point out how they are just making the problem worse...

Re: A little trick to spam the spammers (2021)

#72

Post by IronWolve »

Speaking of annoying email lists, spammers are using government state/federal email lists that dont need confirmation. Trolls can just sub people up to hundreds of daily emails. How about spam someone all the train/bus schedules for a city? DOT updates, parks and rec, health updates, DHS, ICE, weather, etc.

You cant just remove yourself with replying either, you have to go to a website and remove them, either 1 at a time or if lucky a unsubscribe all.

But its ironic the government email lists are being abused to such an extent to annoy people.

I had users get caught in such an attack, but easily enough to just spam their domains. Hammer solution, but quick fix.

Re: A little trick to spam the spammers (2021)

#74

Post by nonameiguess »

temp0826 wrote: post #47
DonHopkins wrote: post #25

https://news.ycombinator.com/item?id=12951917 DonHopkins on Nov 14, 2016 | parent | context | favorite | on: The NHS's 1.2M employees are trapped in a 'reply-a... Back in the days of ARPANET mailing lists, there used to be an "educational" mailing list called "please-remove-me", that was for people who asked an entire mailing list to remove them, instead of removing themselves, or sending email to the administrative…

Something similar happened (multiple times?) when I worked at AWS when someone decided to send a mass email to literally the entire company and people inevitably reply-all enough to clog the system and bring it to its knees. Many confused people were replying "UNSUBSCRIBE" (again, to the whole company) as if it would take them off

This happened to the entire US federal government in 2014. Someone reply-all'd a mailing from the General Fund Enterprise Business System notification asking to be taken off the list, and it escalated as then thousands of people who didn't realize they were on this list did the same thing, then got worse when smart asses reply-all'd telling other people not to reply-all.

Re: A little trick to spam the spammers (2021)

#75

Post by avodonosov »

I do a similar thing with web crawlers that do not respect the robots.txt

https://github.com/cl-test-grid/cl-test-grid/blob/873b2fa978...

I don't know if this snippet is really effective, can be improved a little, especially that I noticed a couple of new crawlers that ignore `User-agent: * Disallow: /path` in robots.txt, and do not fix that even after reported.

Re: A little trick to spam the spammers (2021)

#76

Post by janci »

DonHopkins wrote: post #25

https://news.ycombinator.com/item?id=12951917 DonHopkins on Nov 14, 2016 | parent | context | favorite | on: The NHS's 1.2M employees are trapped in a 'reply-a... Back in the days of ARPANET mailing lists, there used to be an "educational" mailing list called "please-remove-me", that was for people who asked an entire mailing list to remove them, instead of removing themselves, or sending email to the administrative…

Once I got on some internal distribution list of a client. I was not needing those emails, plus they were all in Hungarian I do not understand a word. I tried multiple times to contact the sender and asked to remove me to no avail.

The ultimate thing that helped immediately: reply-all to hundred recipients. (Also got my account blocked from sending emails for a while. Fun)

Re: A little trick to spam the spammers (2021)

#78

Post by sodimel »

avodonosov wrote: post #75

I do a similar thing with web crawlers that do not respect the robots.txt https://github.com/cl-test-grid/cl-test-grid/blob/873b2fa978... I don't know if this snippet is really effective, can be improved a little, especially that I noticed a couple of new crawlers that ignore `User-agent: * Disallow: /path` in robots.txt, and do not fix that even after reported.

That's pretty neat! I should set up something similar for my domains that keep being spammed.

Re: A little trick to spam the spammers (2021)

#79

Post by amiga-workbench »

avodonosov wrote: post #75

I do a similar thing with web crawlers that do not respect the robots.txt https://github.com/cl-test-grid/cl-test-grid/blob/873b2fa978... I don't know if this snippet is really effective, can be improved a little, especially that I noticed a couple of new crawlers that ignore `User-agent: * Disallow: /path` in robots.txt, and do not fix that even after reported.

I wonder if you could abuse gzip compression on responses to send a zip bomb back to them.

Re: A little trick to spam the spammers (2021)

#80

Post by TechBro8615 »

legitster wrote: post #18

I run marketing email databases. This is cute, but it doesn't actually do anything in most systems - either the employees all already get the marketing emails or there is a system-wide rule to suppress against the email domain. If you actually want to (potentially) break something, try submitting some obscure characters or malformed html into some fields. Blank spaces in emails can particularly be a nuisance. And if…

I think Log4shell was about the closest we got to this. It’s still crazy to me you could exploit an unknown machine by leaving a string of text somewhere and waiting for a vulnerable client to process it. I imagine many spammers are running a lot of insecure PHP and Perl scripts to support their operation. That was certainly the case back in ~2006, and I imagine most “new entrant” spammers are not using email but rather social media tactics and the like, so I doubt email spam infrastructure improved.

That said, the real guilty spammers are the companies doing it under the flag of a sales tool. RIP your email if you put it in a git commit.

Post reply on HN