You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Marc Perkel <su...@junkemailfilter.com> on 2015/06/19 22:41:55 UTC
Help me waste spammers resources
I found a great trick for wasting spammer's resources and getting them
blacklisted that I'd like to share will all of you.
On my main spam filtering servers I advertise authenticated login even
though I don't actually have any authenticated users. Anyone who tries
to authenticate is a spammer.
I accept all passwords as good and we accept the email which is then
added to my black list and I then ship copies of the spam off to all my
spam filtering partners who use it to add to their black lists. And I'm
wasting a lot of their resources absorbing spam that just isn't being
delivered.
Just last week on my main good email processing server I accepted
37,232,709 spams.
So - this works. I encourage others to do the same thing. Or - you can
just help me do it.
If you have domains you are filtering just add this as your highers
numbered MX record.
tarbaby.junkemailfilter.com
or you can CNAME to it if you want.
And I'll absorb the spam for you as they hack mt servers and that's spam
you don't have to process.
--
Marc Perkel - Sales/Support
support@junkemailfilter.com
http://www.junkemailfilter.com
Junk Email Filter dot com
415-992-3400
Re: Help me waste spammers resources
Posted by RW <rw...@googlemail.com>.
On Fri, 19 Jun 2015 21:06:17 +0000
David Jones wrote:
> >From: Marc Perkel <su...@junkemailfilter.com>
> >Sent: Friday, June 19, 2015 3:41 PM
> >To: users@spamassassin.apache.org
> >Subject: Help me waste spammers resources
>
> >I found a great trick for wasting spammer's resources and getting
> >them blacklisted that I'd like to share will all of you.
>
> >On my main spam filtering servers I advertise authenticated login
> >even though I don't actually have any authenticated users. Anyone
> >who tries to authenticate is a spammer.
>
> >I accept all passwords as good and we accept the email which is then
> >added to my black list and I then ship copies of the spam off to all
> >my spam filtering partners who use it to add to their black lists.
> >And I'm wasting a lot of their resources absorbing spam that just
> >isn't being delivered.
>
> Could get some legit senders in this list. See below.
I don't see why it would if it's only listing those that try to
authenticate.
Re: Help me waste spammers resources
Posted by Marc Perkel <su...@junkemailfilter.com>.
We accept all authenticated email to tarbaby as spam. Normal email to
tarbaby.junkemailfilter.com gets a 4xx error. But if it's spam or virus
bots it can also make our black lists. But good email from greylisting
won't be affected.
On 06/19/15 14:06, David Jones wrote:
>> From: Marc Perkel <su...@junkemailfilter.com>
>> Sent: Friday, June 19, 2015 3:41 PM
>> To: users@spamassassin.apache.org
>> Subject: Help me waste spammers resources
>> I found a great trick for wasting spammer's resources and getting them
>> blacklisted that I'd like to share will all of you.
>> On my main spam filtering servers I advertise authenticated login even
>> though I don't actually have any authenticated users. Anyone who tries
>> to authenticate is a spammer.
>> I accept all passwords as good and we accept the email which is then
>> added to my black list and I then ship copies of the spam off to all my
>> spam filtering partners who use it to add to their black lists. And I'm
>> wasting a lot of their resources absorbing spam that just isn't being
>> delivered.
> Could get some legit senders in this list. See below.
>
>> Just last week on my main good email processing server I accepted
>> 37,232,709 spams.
>> So - this works. I encourage others to do the same thing. Or - you can
>> just help me do it.
> I like this idea and I think I will setup my own instance of this and add
> IPs to my private RBL.
>
>> If you have domains you are filtering just add this as your highers
>> numbered MX record.
> This can cause problems (legit email lost) if you accept all mail and the
> lower MX servers have greylisting enabled. Same is true if the lower
> MX servers go offline for some reason. It would be safer to temp
> fail everything with a short greeting delay.
>
>> tarbaby.junkemailfilter.com
>> or you can CNAME to it if you want.
>> And I'll absorb the spam for you as they hack mt servers and that's spam
>> you don't have to process.
>> --
>> Marc Perkel - Sales/Support
>> support@junkemailfilter.com
>> http://www.junkemailfilter.com
>> Junk Email Filter dot com
>> 415-992-3400
>
--
Marc Perkel - Sales/Support
support@junkemailfilter.com
http://www.junkemailfilter.com
Junk Email Filter dot com
415-992-3400
Re: Help me waste spammers resources
Posted by David Jones <dj...@ena.com>.
>From: Marc Perkel <su...@junkemailfilter.com>
>Sent: Friday, June 19, 2015 3:41 PM
>To: users@spamassassin.apache.org
>Subject: Help me waste spammers resources
>I found a great trick for wasting spammer's resources and getting them
>blacklisted that I'd like to share will all of you.
>On my main spam filtering servers I advertise authenticated login even
>though I don't actually have any authenticated users. Anyone who tries
>to authenticate is a spammer.
>I accept all passwords as good and we accept the email which is then
>added to my black list and I then ship copies of the spam off to all my
>spam filtering partners who use it to add to their black lists. And I'm
>wasting a lot of their resources absorbing spam that just isn't being
>delivered.
Could get some legit senders in this list. See below.
>Just last week on my main good email processing server I accepted
>37,232,709 spams.
>So - this works. I encourage others to do the same thing. Or - you can
>just help me do it.
I like this idea and I think I will setup my own instance of this and add
IPs to my private RBL.
>If you have domains you are filtering just add this as your highers
>numbered MX record.
This can cause problems (legit email lost) if you accept all mail and the
lower MX servers have greylisting enabled. Same is true if the lower
MX servers go offline for some reason. It would be safer to temp
fail everything with a short greeting delay.
>tarbaby.junkemailfilter.com
>or you can CNAME to it if you want.
>And I'll absorb the spam for you as they hack mt servers and that's spam
>you don't have to process.
>--
>Marc Perkel - Sales/Support
>support@junkemailfilter.com
>http://www.junkemailfilter.com
>Junk Email Filter dot com
>415-992-3400
Re: Help me waste spammers resources
Posted by Torpey List <li...@torpey.org>.
What if I am already using mxbackup1.junkemailfilter.com?
From: Marc Perkel
Sent: Friday, June 19, 2015 2:41 PM
To: users@spamassassin.apache.org
Subject: Help me waste spammers resources
I found a great trick for wasting spammer's resources and getting them
blacklisted that I'd like to share will all of you.
On my main spam filtering servers I advertise authenticated login even
though I don't actually have any authenticated users. Anyone who tries
to authenticate is a spammer.
I accept all passwords as good and we accept the email which is then
added to my black list and I then ship copies of the spam off to all my
spam filtering partners who use it to add to their black lists. And I'm
wasting a lot of their resources absorbing spam that just isn't being
delivered.
Just last week on my main good email processing server I accepted
37,232,709 spams.
So - this works. I encourage others to do the same thing. Or - you can
just help me do it.
If you have domains you are filtering just add this as your highers
numbered MX record.
tarbaby.junkemailfilter.com
or you can CNAME to it if you want.
And I'll absorb the spam for you as they hack mt servers and that's spam
you don't have to process.
--
Marc Perkel - Sales/Support
support@junkemailfilter.com
http://www.junkemailfilter.com
Junk Email Filter dot com
415-992-3400
Re: Help me waste spammers resources
Posted by John Hardin <jh...@impsec.org>.
On Sat, 20 Jun 2015, Axb wrote:
> On 19.06.2015 22:41, Marc Perkel wrote:
>> I found a great trick for wasting spammer's resources and getting them
>> blacklisted that I'd like to share will all of you.
>
> https://en.wikipedia.org/wiki/Tarpit_%28networking%29
>
> Wasn't this last decade's FUSSP ?
>
> Also see
> http://labrea.sourceforge.net/labrea-info.html
>
> iirc, John Hardin wrote a very good howto sometime around 2006/2007
And I still use it for repeat offenders. Sadly I only administer a couple
of very small domains now.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
No representation without taxation!
-----------------------------------------------------------------------
Re: Help me waste spammers resources
Posted by Axb <ax...@gmail.com>.
On 19.06.2015 22:41, Marc Perkel wrote:
> I found a great trick for wasting spammer's resources and getting them
> blacklisted that I'd like to share will all of you.
https://en.wikipedia.org/wiki/Tarpit_%28networking%29
Wasn't this last decade's FUSSP ?
Also see
http://labrea.sourceforge.net/labrea-info.html
iirc, John Hardin wrote a very good howto sometime around 2006/2007
Re: Help me waste spammers resources
Posted by Bob Proulx <bo...@proulx.com>.
Marc Perkel wrote:
> If you have domains you are filtering just add this as your highers numbered
> MX record.
As long as this isn't for any valid domains. Don't add the honeypot
to a valid domain's MX because valid senders may get trapped
otherwise. For example if I were to add your tarpit to my domain but
then my network goes offline that would cause a lot of valid email to
fall through to your tarpit. This is only okay for domains that can't
get any valid email.
> tarbaby.junkemailfilter.com
I think you meant to say tarpit not tarbaby there. The non-racist
usage of tarbaby is of a problem that gets worse trying to solve it.
(However if you really do mean to add MX of valid domains then that is
correct slang for it.) The racist interpretation is best avoided too.
Bob