Detecting a Spammer During Account Signup

From a posting by Ziggy in the Usenet Newsgroup news.admin.net-abuse.email

The players in this discussion are:

Jason (ISP) (Introduction to readers) I just got a call from the same client that had had the problems before. He had a representative from an email company on the phone, who was swearing that they only used opt-in lists etc. etc. etc. This person wanted to join my client's affiliate program, and promote his link through email. Here's how the conversation went: (paraphrased and recollected)

[Jonathan]: Hi, Jason (that's me), This is Jonathan (the "rep").

[Jonathan]: I'm told that you need our IP address or domain name before we can do this mailing. Which one do you need?

[Me]: Which one? What do you mean?

[Jonathan]: Do you need the IP Address of our mail server or what? Do you just need the last hop?

[Me]: Last hop? Why do you have more than one hop? Are you bouncing off of open relays?

[Jonathan]: No, No, No...we own several SMTP servers so that we can distribute the outgoing mail more efficiently...

[Me]: Uh huh...What's your company's name?

[Jonathan]: We are MortgagePro News, and we're owned by Verticalmail.net. We've been doing mailings to opt in subscribers...

[Me]: Uh huh (punching up rbcheck) That was Verticalmail.net, right?

[Jonathan]: Yes, but that's our parent company [blah blah blah]

[Me]: Wow. You've got a rapsheet a mile long on here....

[Jonathan]: Well, I'm sure we've got some info in some databases. Any mailing list company is going to have a few complaints.

[Me]: Yeah, I know what you mean...(pulling up SPEWS s1683)....WOW, you've got quite a record here in SPEWS....You know who SPEWS is, right?

[Jonathan]: Yeah, hold on...(get's someone else on the phone named Chris).

[Me]: What was your last name again?

[Jonathan]: Cosie.

[Me]: It says here that verticalmail.net is run by Known spammers Jonathan Cosie and Christopher Cosie.

[Chris]: Well, I can tell you that this new publication, Mortgage Pro News, is totally spam-free and totally opt-in. You won't get listed in those databases.. Even if somebody did complain, we're talking about an affiliate program here. We'll be sending the email out from our own servers and just putting a link to your site in. Nobody is going to list you for that.

[Me]: Okay. Can you give me a contract and bond that guarantees we won't be listed from your campaign, and that if we are you'll pay up to $10,000 for cleanup and to help my client find a new ISP? Because if we get complaints or get listed, he gets kicked off of my server.

[Jonathan]: Are you kidding?

[Me]: No. I'm serious. This SPEWS evidence file has a MortgagePro News email attached to it.

[Jonathan]: I can guarantee that you won't be listed...

[Me]: A $10,000 guarantee?

[Jonathan]: Look, I'm just trying to make some good money here, and I thought you guys were looking to boost your marketing..

[Me]: We are. But only through clean methods.

[Jonathan]: We are clean...everybody is going to have a few skeletons in their closet. We've cleaned up our system.

[Me]: Okay. (pulling up ROKSO, typing in Jonathan Cosie) Wow, Jonathan, you're right up here with Al Ralsky. I just pulled you up in ROKSO. Do you know what that is?

[Jonathan]: Um

[Me]: You have to have been kicked off of 3 ISPs for spamming to get in there. And then, you have to have sent spam in the last six months. If you hadn't sent any spam in the last six months, you wouldn't even be listed there.

[Jonathan]: Well, like I say, we've got a few skeletons

[Me]: Skeletons? These corpses haven't even stopped bleeding yet!

[Jonathan]: Well, I can tell this isn't going anywhere:

[Me]: (To my client) Dan, I'm sorry buddy but this can't happen if you're on my server. Jonathan here is lying through his teeth to you when he says he isn't spamming, and we don't want a repeat of that Sam Garcia incident.

[Dan]: You're right about that. Sorry, Jonathan. Thanks for your time...

[Jonathan]: But wait a [click]

It may not be as fun reading as it was being there at the time, but this guy was just shameless...And I got to do something way more rewarding that bitchlisting.

Ziggy

Follow up to this story

Cosie is still trying to do business with my client. He contacted him yesterday and said something to the effect of "Well, we can still do something without using email at all," to which my client basically recited the Boulder Pledge (even though he doesn't really know what the Boulder Pledge is.)

One client that _totally_ gets it at this point, and one spammer that never will.

Ziggy

Background

RBcheck is a Unix-style command-line test that checks for insecure servers and creates a database.

What RBCheck does. Spammers make use of insecure SMTP servers to fill your inbox. RBCheck tests the servers that sent or routed the mail to you for security, and automatically nominate the insecure site to relays.osirusoft.com. In this way, a database of insecure sites can be generated, such that these holes can be secured. Additionally, it also produces a file for use with other dns based blocking lists so that others can make use of the generated information. If you are an end user, this utility will only help you if your ISP makes use of DNS based blocking. However, and even if they don't, by running this utility, you are initiating a course of events that a) helps others, and b) wakes up the irresponsible or novice administrator.