Inside the seedy underworld of spammers and phishers

Well, if you have an accurate enough system, you can send the clear, five-sigma cases to this queue and ban the more borderline customers.

And this is obviously something you can't discuss, but I wonder if you guys "seed" various sites with false emails as "markers". It would be a very cheap way to detect indiscriminate scrapers and bulk spammers.

HackerNews does the same when it hellbans people. Let's just say it works for some kind of spammers (the less professional ones).

> In our terms botnet can be a mix of a free and paid Mailgun accounts. Botnets can include anything from 2-3 to dozens and hundreds of accounts created at different time and using different billing plans.

My criticism is I've never heard of a botnet referred to as a group of accounts. To me, a botnet is a group of host computers that run some sort of proxy server (tens of thousands of hosts). I've never given thought to what someone would call a group of email accounts aimed at exploiting a service, but to me botnet seems like it would be specific to a network of computers, sometimes compromised, sometimes not, running a type of proxy or automated software.

> We are talking about Mailgun service - the time they need to invest in building some solution on top of Mailgun that pays back is just not worth it.

The problem is when it comes to a service like yours, if it really is that hard to bulk mail, then the guys using your service aren't the guys getting a 1 in 125m response rate.

Anyone sending that kind of volume would assume their messages were going to a spam folder, and sending larger volumes to compensate for it.

Someone going through the hoops you set in place, are doing it because your service gets inbox. This means they can send bulk email to higher quality lists, and their response rate will be significantly higher than 1 in 125m, more like 1% to 2% response rates.

In this case, the people actually sending mail through your service probably don't even bother making those accounts themselves. They likely find people who specialize in circumventing your security measures, and pay a premium of $x to $xx per 1,000 accounts.

> On the other hand, phishing attacks are very dangerous and this is our biggest threat - we've noticed that they get very high quality lists with 0 bounces, so it might be real bank users and build pages for every atack.

This too, but don't forget about simply cracking passwords for the accounts. Simple math. Take the top 100 most used passwords, assume your users are just as naive as most the internet, and you have x% users you can assume will be compromised at some point in the future.

IMO it's best to not optimize for mobile as it just makes it worse.

Hey, Mailgunner here

Yep, we were trying not to disclose too much information on how we catch them, however I agree that how we fight them deserves a separate post.

Some things to share:

* Naive approaches (hey, just plug in spam filter) don't work in most cases as spammers tune and create the new content specifically for our service

* Feedback (complaints) from customers is a great signal, but at the point you start receiving the complaints it may be too late.

* Bounce-based metrics (invalid addresses) are a great signal.

* There's no silver bullet as we've found, you have to collect as many signals as you can

* Rules based systems don't work as the rules change every day, you have to plug in some learning in place.

* Domain blacklists are also not very effective - as they use hijacked domains, or services providing free sub-domains to avoid blacklists.

* Ip blacklists are not very effective as well, as a lot of people are now using cloud services sharing the same NAtted ip.

* A lot of customers don't really realize they are spammers - "Hey, we've paid money for this mailing list, it's all fair"

Yes, we should put some hard numbers out there in a subsequent post.

First of all, you have a cool service and I don't really think any less of you guys for one line on a blog post.

That said, in my view, that's the entire point of your service. Every language has an SMTP library; the hard part - the thing I'm paying you for - is the constant cat and mouse.

Yep, makes sense, also interesting that you confront them with the questionable details (bad domains, bad IP match) -- does this help bring things to a conclusion faster?

I would be interested to collaborate, but I couldn't figure out how to get in touch with you via your profile. I tried your HN username @mailgun.net but that address bounced. What's the best way to reach you?

That's one of the most perplexing aspects for me; how much effort some people put into getting "a quick buck." If only they'd put that much energy into something productive, they'd be way ahead.

Personally I've seen more vitriol and misplaced anger from pro-Google commenters.

Travis from Mailgun Support here... There are several spammers located in the US and speak excellent English. Spelling and grammar isn't the best indicator. A spammer in the US will typically have a good understanding of American communication style, thus, they are good at the social engineering aspect. The problem with spammers in the US is that it's pretty difficult to fully conceal your identity. There is always something in common or amiss with the account details. For example, if your billing address is based in the US, but you're connecting to infrastructure with IPs outside the US. Or better yet, chatting with me via an IP in the Netherlands.

I think the best example of a US spammer was this guy attempting to promote his blog. (Or trying to warm up his account before sending spam) Each post was a rip off of an article from About.com. All the post dates were adjusted to appear that the site was online for months. His spelling and grammar were excellent.

He had several flaws... The domain was just registered a couple days ago. The "Corporate HQ" address on the site was a post office in New York. The billing address was a UPS store in Nevada. He refused to talk to me on the phone or provide a physical address that I could send a t-shirt to. :-P