No post body was provided.
A little trick to spam the spammers (2021)
81–90 of 231 posts
Re: A little trick to spam the spammers (2021)
#82Earlier quoted context omitted.
I would also recommend naming yourself Viagra, Cialis or CBD.
This is actually kind of clever, but only if you give us a real email address. We will often take your name and insert them into emails (for some dumb reasons around personalization supposedly increasing opens). But an email being stuffed full of spam words is a good way to get it flagged by anti-spam software and potentially hurt our sender reputation score. You would probably have to do it en masse and use real inb…
Keep a short list of your enemies' email addresses and use those as the destination for these likely-to-be-flagged signups to hedge your bet.
Re: A little trick to spam the spammers (2021)
#83I do a similar thing with web crawlers that do not respect the robots.txt https://github.com/cl-test-grid/cl-test-grid/blob/873b2fa978... I don't know if this snippet is really effective, can be improved a little, especially that I noticed a couple of new crawlers that ignore `User-agent: * Disallow: /path` in robots.txt, and do not fix that even after reported.
I wonder if you could abuse gzip compression on responses to send a zip bomb back to them.
You can, but most bots do timeout. If you get a lot of bad bots that are vulnerable, then you'll probably waste a lot of resources on those connections.
Re: A little trick to spam the spammers (2021)
#84I do a similar thing with web crawlers that do not respect the robots.txt https://github.com/cl-test-grid/cl-test-grid/blob/873b2fa978... I don't know if this snippet is really effective, can be improved a little, especially that I noticed a couple of new crawlers that ignore `User-agent: * Disallow: /path` in robots.txt, and do not fix that even after reported.
I wonder if you could abuse gzip compression on responses to send a zip bomb back to them.
Yes you can. There ar also ways to protect the crawler server from crashing.
Re: A little trick to spam the spammers (2021)
#85Earlier quoted context omitted.
https://datatracker.ietf.org/doc/html/rfc2142
> SECURITY CONSIDERATIONS > Denial of service attacks (flooding a mailbox with junk) will be easier after this document becomes a standard, since more systems will support the same set of mailbox names.
I've managed a number of RFC 2142 mailboxes and while they all got spam (the dumb spammers would even send to abuse@!) it wasn't any worse than the other published email addresses on those systems and the volume was spam was still less than what our typical user would see (since nobody using postmaster@ used it to sign up for everything under the sun).
The spam we got was often useful for abuse handling and spam filtering too. It was a good thing!
Every network should have an abuse@ address. Web forms are pretty popular these days too, but every extra hoop you force reporters to jump through can cut down on the reports you get of problems on your network. It's worth dealing with the spam to make sure you're getting notified as quickly as possible.
Re: A little trick to spam the spammers (2021)
#86I run marketing email databases. This is cute, but it doesn't actually do anything in most systems - either the employees all already get the marketing emails or there is a system-wide rule to suppress against the email domain. If you actually want to (potentially) break something, try submitting some obscure characters or malformed html into some fields. Blank spaces in emails can particularly be a nuisance. And if…
I think Log4shell was about the closest we got to this. It’s still crazy to me you could exploit an unknown machine by leaving a string of text somewhere and waiting for a vulnerable client to process it. I imagine many spammers are running a lot of insecure PHP and Perl scripts to support their operation. That was certainly the case back in ~2006, and I imagine most “new entrant” spammers are not using email but rat…
Blind XSS is a thing.
not my fault you haphazardly inserted into an HTML field in some browser at some point in the future.
DNS records, facebook statuses, titles of apps on the playstore, Wifi SSIDs, BIO's on obscure forums, names of children, recipe ingredients, your TV's network nick name...anything that can hold the input of a user, that a scraper or content mechanism will eventually naively come across...
eventually it will get added to the DOM of some unknownst messenger, and I will receive a ping, letting me know that someone, somewhere, somewhen, sniffed my digital fart.
Re: A little trick to spam the spammers (2021)
#87I do a similar thing with web crawlers that do not respect the robots.txt https://github.com/cl-test-grid/cl-test-grid/blob/873b2fa978... I don't know if this snippet is really effective, can be improved a little, especially that I noticed a couple of new crawlers that ignore `User-agent: * Disallow: /path` in robots.txt, and do not fix that even after reported.
I wonder if you could abuse gzip compression on responses to send a zip bomb back to them.
I did just that for a while with a spare server I had. I set it up to literally only respond to bad bots. I know the crawlers don't care but it amused me at least. I tried to also keep redirecting slowly before it could time out. There was one bot that seemed to create a new instance each redirect so I could keep it in a loop for essentially ever. Just about every other bot only followed a few redirects before giving up. Fun times.
Re: A little trick to spam the spammers (2021)
#88The terms ceo@ / sales@ / marketing@ / info@ can be fun. Or state-level intelligence addresses / TLAs of various stripes.
I also like using support@, surprising number use that to create tickets which can annoy someone very quickly.
Re: A little trick to spam the spammers (2021)
#89I run marketing email databases. This is cute, but it doesn't actually do anything in most systems - either the employees all already get the marketing emails or there is a system-wide rule to suppress against the email domain. If you actually want to (potentially) break something, try submitting some obscure characters or malformed html into some fields. Blank spaces in emails can particularly be a nuisance. And if…
The extended version where he sends signs up his list of other spammers for each other's newsletters should get around that problem.
Re: A little trick to spam the spammers (2021)
#90When I get spam from a local-ish company I always send an abuse mail to their ISP or email provider. Sometimes it's ignored and I keep getting spam from that particular bunch of shitheads. So I set up my .forward to bounce spam from that company right back to any email addresses I can find for them and their ISP. Every spam I get, I add another copy to the list. The folks at xertog.com currently get 8 copies each to…
Wow, that's dedication!