Category: Net: Spam

This entry is mainly for my records, but it’s here if anybody else requires reference…

Basically, at 19.20, I made the following complaint to ICSTIS and The Telephone Preference Service in relation to a spammy text (SMS) message I received:

A SMS text message was sent at around 19:05 GMT (although the timestamp on the message reads 00:43:53 31-12-2003) from +08717120395 to my telephone preference service registered mobile phone (07732XXXXXX) with the message:
“You have 1 new BPQ voicemail message. Please call 0871 712 0395 to listen to it.”

When calling the number it says (in a format similar to a voicemail) “Sheila Brown of the BPQ awards department” tried calling and for me “reagrding an award prize which has to be claimed within 48hours” and for me to call 090 65393698 with NO cost of call disclosed.

I think I’m just about to give up on the email addresses provided by my ADSL provider (Demon). Why? Well, over Christmas Eve (from 4pm) to Boxing Day (2pm), I received nearly 25,000 emails. That’s a lot – but I’ve got a couple of custom Perl scripts which can crawl through my POP3 email box and zap spam (as it’ll probably be dictionary attack sort of spam).

It’s now 4 days on and I’ve managed to delete over 44,450 emails and there are another 47,552 still awaiting deletion. Yep – that’s over 90,000 emails in a space of a few days(!) I’ve spent most of today re-writing my email zapper (it’s called cleardemon.pl by the way) to be more efficient (previously it was making a separate connection to the mail server for each “attack name”: but now the last of “spammed addresses” is over 1,400 I needed to make it work on the mail as a group). But still running TOP on the emails in 1,000 blocks and then sending the DELETE command didn’t have much affect (it was taking around a quarter of a second to a second to send the delete command for each email: in that time 2 more emails came in!).

I’m now running a quick script to try and clear the POP3 mailbox down a bit more (by just sending 50,000 “DELETE” commands to the server), but I don’t hold up much hope. It’s looking like I’m going to have to give tech support a call tomorrow to get them just to flush my mailbox.

Why don’t I run something like SpamAssassin? Well, I would if I could. But it’s a “dialup/ADSL” POP3 email account, Demon don’t provide SMTP delivery to ADSL customers (but they do to conventional dial-up Modem users: go figure!) and I can’t change the MX records either. The good news is is that in the new year, they are introducing Brightmail filtering which should hopefully see spam drop (I’ve heard of figures between 75% and 98% with less than 1 in one million false positives!).

Ho hum. Oh, since typing the last two paragraphs I’ve now got 47,729 emails awaiting deletion: that’s nearly 200 emails in a matter of minutes(!).

[add] Actually, I’ve just taken a five minute average from 00:52 to 00:57 and I’m getting 16.6 emails per minute: that’s 996 per hour or 23,904 per day! Gulp!

My system has just tagged that Driveway.com (aka IBackup.com) and Sandbox.com have sold on their mailing lists with one of my email addresses to a spammer. I receive almost identical emails to two tagged addresses: one I used on driveway.com, the other sandbox.com: contents follow….

Both were sent from were “injected” directly into my incoming SMTP server (instead of being sent via their ISP), both claimed to have been sent via Eudora, and both had incorrect/faked Message-Ids (that message ID’s were actually created by my mail server). Oh – and they were both in HTML format and had “web bugs” in them (images loaded from a remote server which would enable the spammer to see who opened the email and therefore whose email address was valid).

Needless to say, both spams got reported via Spamcop.net to their upstream providers.

Further to a telephone call I received (along with some of you) on the 16th of September, I have just received the following letter from ICSTIS (the regulatory of premium rate telephone numbers in the UK) which basically states the company has been fined £10,000 and barred access to “The Prize Warehouse”‘s service for twelve months (so it’s quite a breach: checking action they’ve taken against other companies shows an “average” of around £1,000 fine and 6 months barring).

Success! Just shows – if you complain to the right people you can get the scumbags removed! I’m just waiting for the response from The Telephone Preference Service and mwhhaa! I’ve actually just received a spam SMS text message to my mobile phone (which is registered with TPS) so I’ll be sending off another complaint in the next day or so.

Read on for a copy of the letter.

Quick notification: if you’ve got an email address for me ending in .demon.co.uk (such as example.demon.co.uk) please change it to just .com (so an email address of joebloggs@example.demon.co.uk will change to joebloggs@example.com ). I’m having to migrate all my email accounts to my main server from my 8year old+ Demon ISP mailbox as the spam levels have just got too high. Yesterday I deleted over 15,000 emails from my Demon ISP account leaving less than 5,000 to delete today: by the time I woke up the levels were back up to 14,700 and growing 🙁

This wouldn’t be too bad apart from the fact Demon’s mail servers are suffering from the load – as Gradwell’s ISP Mail System Performance chart shows, emails sent to demon.co.uk email addresses are taking over 6 hours on average to arrive: and that’s just not good enough for me (plus the lack of “server side filtering” makes things even worse).

I’m still planning on keeping Demon for my ADSL connectivity at the moment (I haven’t got time to currently hunt ADSL providers that can offer over 3Gb/traffic per day), but I no longer trust them with my email.

However – the Gradwell chart shows that one of our (ie my employers) main rivals in one portion of their business – UK2.net – is just as bad as Demon. 5hours+ delays and 13 missing emails.