Wandering Thoughts archives


The persistence of spammers, illustrated

Recently, I saw the following line in the SMTP logs of one of my machines:

RCPT TO:<3c1989aug25.162653.25755@ziebmef.mef.org>

In the old days, software tended to put more information into various identifiers than it usually does today. One of the vaguely convenient things that this does is that it provides a way to carbon-date certain sorts of spammer behavior.

As you might guess, this particular identifier dates from August of 1989. It is not a valid email address and in fact has never been a valid email address, because it is (or was) a Usenet message-id. Never the less, spammers have kept it around for almost 22 years now (and have, as it turns out, repeatedly tried to mail it over the past couple of years). At this point, I expect that they will keep trying to do this for as long as there is an MX record for ziebmef.mef.org.

(It's almost enough to make me curious about what sort of spam they're trying to send it. In theory it would be relatively easy to find out, at least for that specific address.)

I knew that spammers were persistent and that addresses they'd grabbed tended to never stop getting spam. But it's one thing to know it and another thing to see it in my logs, right there in front of me.

(To save curious parties the effort of looking: Google Groups doesn't have that message-id.)

spam/SpammerPersistenceIllustrated written at 01:40:31; Add Comment

Page tools: See As Normal.
Login: Password:
Atom Syndication: Recent Pages, Recent Comments.

This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.