cogdogblog: Spam: The International Game of Intrigue and Mystery Comments and Trackbacks

CDB Entry: Spam: The International Game of Intrigue and Mystery

Sun, 03 Oct 2004 08:11:41 -0700

Our hourly comment spam assaults on the Maricopa Learning eXchange ceased around 10:00pm local time yesterday. My best guest is that the spammers mommy finnaly told him/her it was time to shut fof the computer, brush their teeth, and off...

comment by: Dave Bauer

Sun, 03 Oct 2004 10:10:30 -0700

Gandi.net is a great service and I use it for domain registration. I think it is just a coincidence that your adversary happened to use the service. It is really disingenuous of you to imply that Gandi.net is a service FOR spammers, where it is merely a domain registration service. No domain registrar requires more than a credit card to register a domain.

comment by: Alan Levine

Sun, 03 Oct 2004 10:25:49 -0700

Pardon my ignorance, David-- I am kust grasping at domain straws.

But someone at Gandi.net has taken money for the spammers and thus has a connection. Who then is responsible? How do I find them?

comment by: Martin

Sun, 03 Oct 2004 11:59:10 -0700

I have also used gandi.net for domain name registration for several years and they seem to be perfectly respectable - certainly not "a spammers best friend". I'd also be a bit more careful about advising people to ban IP addresses unless you're VERY sure that they are the originators of the spam.

comment by: Alan Levine

Sun, 03 Oct 2004 13:47:44 -0700

Okay, I am WRONG to imply or implicate the domain registrar. I admit it. I am WRONG, WRONG, and apologize to all friends of Gandi.net.

But look at my crooked line of reasoning...

(1) Ihave on the hour logs of spam insertion attempts of more than 30 different URLs. Eacth hour the format of the message is the same, the message shuffled slightly. They all come from IPs that can be traced to some nebulous place in southeast Asia.

(2) ALL of the URLs that are trying to be inserted have Whois records where the email contact is a company in Antigua.

(3) When I look up the Whos is record for this company, Gandi.net is listed as the terchnical contact for the domain.

Are they still clean and pure as you all say?

I do not know- I am looking for help in tracing this. I am not an IP detective just someone tired of being victimized by spammers.

As far as proof, the IPs I am trapping are the ones that have issued the http request to our comment form. Do I have to catch them in the act or what?

comment by: Martin

Mon, 04 Oct 2004 00:45:22 -0700

Gandi as technical contact - I think the domain registrar could be a whois default if other details are not available. In any case how likely is it that Gandi would provide their own contact details to the whois database if they actually were spammers?

IPs issuing http requests - I think it may be possible for people to spoof this or work through relays or something. Not sure. It just again seems unlikely to me that it could be that easy to "name and shame" spammers.

I'm perhaps a bit over sensitive about this sort of thing because a friend of mine's business was very badly affected when spammers started sending out e-mail using her address (which is of course very easy to spoof). Before she knew it, she had been named and shamed, her e-mail was being blocked, and she was generally being presumed guilty with the onus on her to prove her innocence.

comment by: Alan Levine

Mon, 04 Oct 2004 08:15:32 -0700

Okay Martin,

I am not suggesting Gandi is the spammer, but I think they do business with the people that do or may mave information that may lead to them. It is time for buisnesses to stop hiding behind this shiled of "I am not involved" igorance and DO SOMETHING.

Since I cannot trust any evidence I can find, I should just allow spammers to attach 15 URLs for viagra and top-poker-sites on every MLX package because I cannot provide iron clad proof that these are spams from the IP address reported? Or perhaps we just cave in and just turn off the ability for people to provide feedback?

I am sorry, but I will not cave. If someone contacts me and let's me know that our system is reporting their IP as spam and they are not, I will lift it from our Blacklist....

But caving in to spammers? Fuggggeddaboudddddit.