Ask HN: Pointless Spam? | Hacker News Reader

Ask HN: Pointless Spam?

25 pointsshutter20 comments

I've noticed that a substantial amount of spam that I receive doesn't make sense -- that is, I don't understand why spammers would even be motivated to send such spam since there seems to be no gain to them.

For instance, a spam I received just now contained only the following ASCII text:

    damps sonnet quaked.
    cols merged gage.
    sadism heroic silly.
    libyan tannic pagan.

There weren't any URLs or tracking images as far as I can tell... just nonsense text. What's the benefit to the spammer? If there's no tracking image and no link to click... there isn't really anything the user can do other than be annoyed and delete it.

The only reason I could think of would be that they expect people to reply to the sender (to verify e-mail legitimacy), but that seems rather convoluted.

Unless some spammers just like to annoy people, rather than make money.

View on HN

a lot of spam nowadays is sent with the explicit purpose of pinging email names and bypassing filters, just to find out of the address itself has a person that checks it. war-emailing, as it were

perhaps that email had something like an embedded image or javascript that could/would dial out to tell the spammer that your email address is active.

other tactics i've seen are the "unsubscribe to this email" links on blatant spam which are social engineering attacks to trick the unwitting into telling the spammers that yes, someone is home at this address.

Even if you don't reply, typically the spammer will receive an 'undeliverable notice' from invalid accounts, so silence ought to indicate where an addresses exist.

In addition to that, maybe some spam filters work by automatically putting a sender on a whitelist if it gets through once, and then after the sender is on the whitelist, he can spam with something real later.

right, and what better way to ping for active accounts than with a (in this case, pretty crappy and almost worthless) bayesian poisoning attack?

silence indicates the address exists. a person clicking the unsubscribe link indicates that someone is actually reading the email sent to that address.

This is designed to distort Bayesian filters. From an economic perspective, this is fairly interesting, because the spammer that sends this gets no rent, or direct profit, from it, but helps the spammer ecosystem.

So, spammers who altruistically help each other might gain some sort of competitive benefit? And this propagates the behavior in the spammer ecosystem. I find this highly ironic, since spamming itself is the opposite of altruistic behavior.

I guess what is "altruistic" is highly contextual. This reminds me of a quip from a Raymond Smullyan book. A friend of his did codebreaking in the Pacific theater in WWII. There was one code they couldn't quite figure out, but they eventually settled on "pro-Japanese" as the meaning, but nothing really fit for them. After the war, it turned out that the code meant "sincere."

Maybe it's to throw the email system's bayesian spam filter off?

Very unlikely. It's almost certainly either to check if the addr is live or a broken spam in which the spammer forgot to insert the payload (not uncommon).

I've never seen evidence of spammers trying to poison filters. This certainly isn't. If you were trying to poison filters you'd want to include a lot more words.

If that is the case it would be cool if your email client had a "pretend bad email address" type function which sends a fake bounce email.

Many clients do have that feature. Mail.app has "Bounce" in the contextual menu. Another handy one in there that's not often used (or always duplicated) is redirect.

I forget where I heard this, but supposedly the Mail "Bounce" feature does more harm than good. Whatever method it uses to bounce is easily identifiable as fake, so it's only good for tricking humans who don't know any better.

It does way more harm than good.

Spam is sent mostly from forged addresses, so when you bounce the message it just gets sent on to the poor sucker who owns the mail address that was forged.

One of my domains was used as the 'from' address for a big spam run, and I would cheerfully strangle _everyone_ who bounces spam after recieving 90,000 or so returned mails that had not originated from my mail server in the first place.

I used to get spam that consisted of a URL followed by a long excerpt from classic literature. Was that filter poison?

No, the spammer is hoping the classic literature will get the message through the filter.

"to check if the addr is live" -- why not just send a spam?

It's actually a coded message meant for only a dozen of its 3 million recipients - Al Qaeda's way of outsmarting the NSA.

You just have to use the 'bible code'. (Or was it the Quran code?)

Did you check the headers as well? I've seen quite a few emails that had the "body" of the email in one while the real body was empty or contained similar noise - I presume there are some broken mail clients that will render them regardless.

seems almost like http://scrumy.com 's url generator.

Reply on news.ycombinator.com