Something Funny...no Really!

[Akuma no Houkon]

NO INSULTS INTENDED!

I've found it odd that people put NOSPAM or NO_SPAM, NO.SPAM, _NO_SPAM_, etc in their email addresses (I see this EVERYWHERE), now obviously this is to prevent email harvesters from getting your email automatically, but can these people actually think that the email havesters are THAT stupid??

Maybe originally this was a grand idea, but by now these harvesters have a database of ATLEAST 100 common variations of the no spam (and similar) inserts, and they simply remove these inserts from the email addresses that they harvest, automatically, and viola! they have your full working address. I mean, any coder that can write a system that parses websites, can write a system that removes those from your email addresses in about 15 seconds, an all they would have to do after that is keep updating it with the common usages.

This "trick" doesnt fool anyone, least of all email harvesters.

To show you how simple it is to remove these "tricks" from your email address, here is all it takes (and this includes usage, list creation, and an actual "remover" function):

GLOBAL DatabaseCount AS DWORD
GLOBAL ListOfTricks() AS STRING

SUB CREATELIST()
 REDIM ListOfTricks(3)
 DatabaseCount = 3
 ListOFTricks(0) = "_NOSPAM_"
 ListOFTricks(1) = "_NO_SPAM_"
 ListOFTricks(2) = "NO_SPAM"
 ListOFTricks(3) = "NOSPAM"
END SUB

FUNCTION RemoveTrick(BYVAL EmailAddy AS STRING) AS STRING
  LOCAL i AS DWORD
  FOR i = 0 TO DatabaseCount
    EmailAddy = REMOVE$(EmailAddy, ListOfTricks(i))
  NEXT i
  FUNCTION = EmailAddy
END FUNCTION

FUNCTION PBMAIN() AS LONG
  LOCAL RealEmail AS STRING
  CreateList
  RealEmail = RemoveTrick("blah@_NOSPAM_blah.com")
  MSGBOX(RealEmail)

  RealEmail = RemoveTrick("blahNOSPAM@blah_NO_SPAM_.com")
  MSGBOX(RealEmail)
END FUNCTION

Note this is PowerBasic code, because its easier to read for non coders as well. Simply create a list of the common tricks in ListOfTricks and this will remove them all from your email. (if you give this an email that doesnt have a "trick" in it, the email address stays how it is, no modification is done to it, so you can simply send the entire list of words through the database, filtering out email addresses and fixing them if they have no spam ticks, and spitting out a list of good, clean, email addresses after everything is done)

Anything based on any pattern of any sort can easily be removed. This trick, no matter what you think, does not work, it does not fool anyone, and email harvesters are not that stupid.

Of course, given more than the 15 seconds it took me to write that, you could refine it more, give it more options, etc..but thats all you really need to write a basic "remover" of email tricks.

And yes, if you have PB6 or 7 that code actually compiles and will remove those "tricks" from any email address you give it.

"I think I just gave away the ending"

 

[rcx21000]

What about getting a e-mail address that actually has the words "NOSPAM" in it? Or just add:

REMOVETHISANDALLTHEGOBDYGOOKUNTILTHELETTERL5809erfdnfUYW(*$Y#(*Fjhfeir8w43JKHCKJDHFDSRHiUEL

 

[Akuma no Houkon]

What about getting a e-mail address that actually has the words "NOSPAM" in it?

Thats simple, if the function removes anything from your email, they can simply take both modified email and unmodified email and assume they are both valid email addresses and send email to both, which ever one is returned by the mail system, is automatically removed from the list. Not that difficult.

As for the second part of your comment, only repeatable patterns can be detected in these fashions, which is what everyone is doing, if you put random letters and numbers in the middle of your email address, that would be about the only semi safe precaution, except remember that most people when they type random letters, it usually ends up being common combinations, which, can also, be removed.

This was just directed at those who use common words like MyEmailATblahDOTCOM or put NOSPAM or any other patterned variation in their email and think they are fooling the email harvesters by doing so.

Its not just in this forum, I have seen it on thousands of webpages/fourms this past year, I just posted my thoughts here because this is where I am active now.

If you really want to stop spam, simply download a SPAM BLACKLIST which has lists of all of the known spam servers (and most get updated daily) and all email from all known spam servers are automatically blocked. There are many free spam blacklists and some commercial ones as well.

 

[Rico]

I don't know what forums you frequent, but I rarely see NOSPAM, usually REMOVETHIS or a gap which needs to be filled in or some extra instruction (like change this word) or changing @ to at and . to dot. Most spam harvesters can't see this because they look for @ to find their mail addresses. Looking for other things takes longer, and computing time is a bit rare when you're scanning millions of pages a day. It would seriously slow down their operation.

Also 1. there are tons of mail addresses available without having to resort to such cpu-intensive tricks and 2. the people who do these tricks clearly don't want spam (remember, spam guys target that 1/100th of a percent who actually buy from the mails) so their value in an email listing is even lower. Therefore neither email list collators or actual mail senders are really interested in these modified or obfusicated addresses.

 

[Akuma no Houkon]

I don't know what forums you frequent, but I rarely see NOSPAM, usually REMOVETHIS or a gap which needs to be filled in or some extra instruction (like change this word) or changing @ to at and . to dot. Most spam harvesters can't see this because they look for @ to find their mail addresses. Looking for other things takes longer, and computing time is a bit rare when you're scanning millions of pages a day. It would seriously slow down their operation.

Also 1. there are tons of mail addresses available without having to resort to such cpu-intensive tricks and 2. the people who do these tricks clearly don't want spam (remember, spam guys target that 1/100th of a percent who actually buy from the mails) so their value in an email listing is even lower. Therefore neither email list collators or actual mail senders are really interested in these modified or obfusicated addresses.

No thats not it at all.

You notice lots of the SPAM emails have "remove me from this list" links on them? Well none of those actually remove you from the list, they actually CONFIRM to the harvester that they got a vaild active email address. So saying that they only target people who dont try to "opt out" is completely false. (maybe a couple actually remove you but the majority do not, its a simple and effective way to verify active email addresses.) I *rarely* ever publicly post my email address, yet if I turn the spam filter and blacklist off of my mail client I get atleast 100+ emails a day of spam. And each one I have "opted" to remove me from the list hundreds of times. They dont care if you want to view their spam or not, they figure if you see it often enough, one day you may see something you like and make an impulse buy.

It doesnt take many extra CPU cycles to remove no spam tricks from the email addresses, even at the rate they are parsing. A decent email harvester has a few 2ghz+ machines doing nothing but email harvesting 24/7, the better ones use low overhead OS's like UNIX to squeeze those extra cycles out, and have some nice dual P4's (or the AMD equivlents), the minimal amount of cpu cycles that a simple trick removal would generate is nothing on the grand scale.

It doesnt matter what you do to protect your email address, if its some sort of pattern, recognizeable, then its easy to modify email harvesters to cope with that.

 

[raven]

the people who do these tricks clearly don't want spam (remember, spam guys target that 1/100th of a percent who actually buy from the mails) so their value in an email listing is even lower. Therefore neither email list collators or actual mail senders are really interested in these modified or obfusicated addresses.

Email list collectors get paid for valid email-adresses they don't care if you are part of the target group, every address is worth money.
Most companies don't spam by themselves, and most do not pay based on results either. They simply pay a company a certain amount of money to spam x-million people (just like they would pay a company to print a flyer and deliver it at your door). The company spamming you doesn't care if you will buy anything, you just need to be one of the x-million.

 

[Rico]

the people who do these tricks clearly don't want spam (remember, spam guys target that 1/100th of a percent who actually buy from the mails) so their value in an email listing is even lower. Therefore neither email list collators or actual mail senders are really interested in these modified or obfusicated addresses.

Email list collectors get paid for valid email-adresses they don't care if you are part of the target group, every address is worth money.
Most companies don't spam by themselves, and most do not pay based on results either. They simply pay a company a certain amount of money to spam x-million people (just like they would pay a company to print a flyer and deliver it at your door). The company spamming you doesn't care if you will buy anything, you just need to be one of the x-million.

I know that. Email collectors have to spend more effort scanning for alternate versions of emails when they can get more than enough without the effort, and mail senders get nothing because these people are blatantly not going to reply. So nobody gains from it.

 

[Rico]

You notice lots of the SPAM emails have "remove me from this list" links on them? Well none of those actually remove you from the list, they actually CONFIRM to the harvester that they got a vaild active email address. So saying that they only target people who dont try to "opt out" is completely false. (maybe a couple actually remove you but the majority do not, its a simple and effective way to verify active email addresses.) I *rarely* ever publicly post my email address, yet if I turn the spam filter and blacklist off of my mail client I get atleast 100+ emails a day of spam. And each one I have "opted" to remove me from the list hundreds of times. They dont care if you want to view their spam or not, they figure if you see it often enough, one day you may see something you like and make an impulse buy.

It doesnt take many extra CPU cycles to remove no spam tricks from the email addresses, even at the rate they are parsing. A decent email harvester has a few 2ghz+ machines doing nothing but email harvesting 24/7, the better ones use low overhead OS's like UNIX to squeeze those extra cycles out, and have some nice dual P4's (or the AMD equivlents), the minimal amount of cpu cycles that a simple trick removal would generate is nothing on the grand scale.

It doesnt matter what you do to protect your email address, if its some sort of pattern, recognizeable, then its easy to modify email harvesters to cope with that.

Thank you for stating the obvious with the 'opt out doesn't really opt you out' thing. Do I really come off that stupid? I'm just saying, the email is worth less overall to spammers. That's different to the 'unsubscribe' method which validates your mail.

I'd agree that it probably doesn't use up many more CPU cycles. But looking for a @ and grabbing everything apart from a space is easy, looking for combinations and alternates would easily 10x the time needed to do this.

As for protection, I'll agree that NOSPAM probably doesn't work. But whatabout therico@redyonder.co.uk (replace red with blue), thericoREMOVE@THISblueyonder.co.uk, theric[ ]@blueyonder.co.uk ('o' in gap) and finally therico$blueyonder.co.uk ?

Although you seem to think spammers are uber clever, I recall a test a while back where someone set up tons of mail accounts, some advertised on usenet, others used to buy products, etc. Those that were displayed on a web page and encoded as a series of &#xxxx; entities recieved no spam - spam scanners don't check for it. A similar effect can be achieved by making a Javascript routine to write the mail to the web page. No scanner is going to parse javascript on each page as well. A simple document.write( 'the' + 'rico' + '@blueyonder' + '.co.uk' ); is all it takes.

Edit: And a lot of spam is just luck. I post my mail everywhere with only minor protection and generally get 2-5 spam mails a day, all that end up deleted due to keyword filters and Bavarian filtering, all Mozilla Mail. I don't run any other spam handlers.

 

[Akuma no Houkon]

Agreed that there are many methods that are too much work for harvesters to work out, like that replace red with blue idea, as long as you continue to keep changing methods to easy to see methods for the people reading your address but no a common used mechanism like NOSPAM and similar alternatives are, then you can get a decent security from there. Anything that becomes common useage (like the NOSPAM's), are used in filters such as I posted.

Now I give my email freely, I have auto updating blacklists that are linked to huge blacklist sites that update the list of known spam servers daily, which automatically blocks all emails from those spam servers, killing 99.999999% of all spam. Plus having good email clients like mozilla and thunderbird help out considerably with any of that spam that manages to work its way through.

 

[rcx21000]

What about using 500DES or something to encrypt your address? Spam ppls would have to spend a few second per address, and thats too much

 

[Rico]

What about using 500DES or something to encrypt your address? Spam ppls would have to spend a few second per address, and thats too much

Yeah but so would everyone else

 

[rcx21000]

What about using 500DES or something to encrypt your address? Spam ppls would have to spend a few second per address, and thats too much

Yeah but so would everyone else

But someone else doesn't collect millions of e-mail addresses Spammers would have to wait a minute to collect 10 addresses, but normal people won't collect more than one or two at a time, and if they do collect more, they can write good e-mails when they are waiting

 

[Akuma no Houkon]

What about using 500DES or something to encrypt your address? Spam ppls would have to spend a few second per address, and thats too much

Yeah but so would everyone else

But someone else doesn't collect millions of e-mail addresses Spammers would have to wait a minute to collect 10 addresses, but normal people won't collect more than one or two at a time, and if they do collect more, they can write good e-mails when they are waiting

I think he means that everyone else (the people that normally use your email) would have to decode your email address just to use it.

Like if you posted your email here, encoded, and I needed to email you, I would have to first download and install the decoder and then decode your email address just to use it.

Which I think is worth the effort IMO. As long as it is a complicated encoding proccess that takes a decent amount of time to decode.

 

[rcx21000]

And DES is very complicated/slow 3DES (doing DES 3 times on something) is the most inefficient (or one of the most) safe encryption methods there are Just do that 500-1000 times, and you get something that might take a few seconds to decode on a dual 3.2GhZ thing. A normal computer might take 15-20 seconds. If the spammer has a supercomputer, do 1quadrillion 3DES, but then it would take a few weeks for a normal user to decode it