Hacker News Reader

Comment by gscott | Hacker News Reader

I once applied for a position at what I found out to be a spam marketing company. In order to send their spam they worked with a local hosting company that would take unused legacy ip addresses and put them in their router so the spam could be sent over them. They would just burn the ip's and move on to the next set. My job would be to update their firewall with the new ips, update their mailing software with the current set of ip's each day. They made their own mailing software it had an interface like a stoplight where red meant the mail wasn't going out, yellow a lot of it was getting blocked (so move to the next ip's) and green is things are good. I didn't end up taking the position. This was around 12 years ago.

View on HN

Today if you try to send a lot of emails from new IP address - most of these emails will go to spam folders (even if emails are legitimate).

In order to send large numbers of emails from an IP address -- you need to gradually ramp up number of emails sent (and have low complaint rate and low bounce rate).

> In order to send large numbers of emails from an IP address -- you need to gradually ramp up number of emails sent

As a spammer you would not go for dedicated IP; you would rather want to use a shared pool as pissing in a big pool plenty of people who hold their liquids to themselves will help your pee to be less visible and detectable.

Here are samples of my spam box from this week so far, courtesy of Sparkpost (their complaint/spam/abuse mailbox is probably going into null, as I have never received a single response and majority of spam I see these days comes from them)

cristo.cumplirmideseo.com mta609d.sparkpostmail.com

diana.unavidaprospera.com mta678b.sparkpostmail.com

michele.felicidadyprosperidad.com mta717d.sparkpostmail.com

alexa.umavidaprospera.com mta678b.sparkpostmail.com

to.believeinmyfuture.com outbound40.sparkpostmail.com

These are shared pools and finding abusers is harder when you stay in large pool.

Finding abuser is not hard, every message sent have customer id encoded in headers.

It is not hard to identify each abuser, my point is that in a large pool you will have lots of small abusers to go thru and vet. When someone is using dedicated IP that's what it is. Its dedicated so you immediately know whether the actors acts in bed faith or not (perhaps sent a few more-than-usually-spam-looking messages).

I don't know whats going on with Sparkpost honestly. I actually uncovered a large international scam artist (CNN did an investigative reporting on similar one milking population to the tune of $400MM/annul) with over 30 dedicated IPs running thru Sparkpost network, but frankly they don't care. I reported that multiple times and also tried to talk to them about it over twitter but they quickly banned me. I think their rules in terms of anti-spam/anti-scam are more guidelines than rules they abide by. I would imagine someone with such vast setup brings tens of thousands of dollars in revenue, so that makes sense why they would turn a blind eye. Its sad actually, the CNN reporting was about broken families and suicides that were to some degree a result of emails' content that perpetrators sent (like romance-type scams send to seniors in hopes to get them send money oversees).

I guess if Rich Harris sleeps well at night knowing his company abides in scam artists pushing senior citizens into taking their own lives, then the business continues as usual. But its sad IMHO nonetheless...

I wonder if governments could somehow vouch for emails addresses being a little like verified twitter accounts, so that we can have a good whitelist of legit email addresses.

Right now it seems gmail is benefiting from the chaos because they have the training data that allows them to know if a mail is spam. I just wish that the internet could adopt more security standards and processes. You can't trust only google now.

No thank you. I don't want to need a government sanctioned e-mail address to send an anonymous (whistleblower) e-mail for example.

Whistleblowing is the last of my concerns. I live in Italy and PEC is a thing, it’s a government certified email with legal value.

Technical rules for the formation, transmission and validation are mandatory: read receipts are automatic.

To use the service you must have a PEC box with one of the authorized managers. The publication of the list of authorized operators, the supervision and coordination is entrusted to the “Agency for digital Italy” (AgID).

This means that every citizen with a pec is paying to obtain an email from a bunch of friends of friends of the government, in a market with virtually no competition, and that your mail box is heavily surveilled but left unsecured.

To be fair, email is a very poor medium for whistleblowers in any case.

The notion of a regulated "official" communications channel (akin to postal mail) for bills and such isn't a terrible idea, although it would make more sense to build something new for this. Email has too many weaknesses to be a good choice.

I prefer an Internet where people can do what they want without needing approval. This also invites bad actors, but I think that's a necessary evil.

As for spam, Thunderbird's filter works quite well for me.

Email addresses aren't relevant, because they're not authenticated unless DKIM/SPF etc are in place. It's the IP addresses that matter.

I'm glad you didn't. Tech doesn't really have the ethics standards that more mature fields like law or medicine have, but they should, and that sort of thing shouldn't pass muster.

Reply on news.ycombinator.com