in the past 24 hours i have received 3,500 more-or-less identical spam messages from “Magalu”, or “Magalu Ofertas”, or Magalu Recomenda”, or “Ofertas Magalu”, with “Queima de Estoque Magalu: Televisores 4k a partir de: R$ 698,99 – APROVEITE – [ SOME-RANDOM-NUMBER ]” as the subject line. however they all have slightly different “From:” email addresses that end with @SOME-RANDOM-SHIT.magazineluiza.com or @SOME-RANDOM-SHIT.magazine-luiza.com or @SOME-RANDOM-SHIT.magazineluiza.com.br

my host provider (which recently sold out to a large, foreign corporation, but, in the past, has built a considerable reputation for responding to tickets within an hour) has not responded to my REPEATED ticket updates concerning this spam. 😒

i have taken the unprecedented (for me) step of setting up global filters that actually DELETE these messages, instead of forwarding them. 😠

it’s unprecedented for me, because i am painfully aware of the fact that filters that are set up to DELETE messages frequently delete “false positives” as well as spam, but this sender has been CONSISTENTLY sending me DOS mail-bombs of anywhere from 5,000 to 500,000 spam messages, for a number of years, and i’m as sure as i can be that i have narrowed down the filters to the point where i’m PRETTY sure they’re only going to delete spam, and NOT false positives.

😒

SPAM IS BAD! END SPAM ON INTERENT! (for all the good it will do… 🙄)

dear 183.60.243.188, CHINANET Guangdong province network, Data Communication Division, China Telecom, CN.

you have been banned from this network.

TWICE.

once on 140127 and once today, 140208.

the reason you have been banned is because you tried to access a part of our web that is off limits to people who aren’t supposed to be there, in other words, the “admin” section of our web site. the reason you aren’t supposed to be there is because people who access our admin section should know the password, and be honourable and “sattvah” enough NOT to do evil with the information that resides there (which is one of the reasons why i decided to put the “admin” section of the web site somewhere OTHER than in the directory called “/admin”)…

because of the fact that you tried, TWICE to access that part of the site, without a request to lift the ban the first time, the possibility that you are EVER going to be allowed to access any of the site, at all, in the future, is, at this point, practically non existent.

get a clue, spam-boy… you’re not going to break in, so you might as well just give up.

i have been getting a lot of comment-spam recently, that is along the lines of this:

{
{I have|I’ve} been {surfing|browsing} online more than {three|3|2|4}
hours today, yet I never found any interesting article like yours.
{It’s|It is} pretty worth enough for me. {In my opinion|Personally|In my view},
if all {webmasters|site owners|website owners|web owners} and bloggers made good
content as you did, the {internet|net|web} will bee {much more|a
lot more} useful than ever before.|...

i don’t really understand the purpose behind such things… moreso than i don’t understand why people send spam at all, i mean probably 85% to 90% of ALL internet traffic is spam, and, as far as i have been able to tell, only a very minute fraction of a percentage of internet users actually think spam is a good thing, but… this is a new low: a person who uses a faulty, undoubtedly third-party script to drop faulty comment spam into a blog that WILL NOT publish it the way it was received…

it makes me understand a lot more how people like ken at popehat have policies like pasting. although i’m sure that, in this case, what they’re most interested in is a hyperlink, and i’m not going to do that for ’em, because their comment is obviously spam… and low quality spam (if there could be such a thing).

so i got this fine potted meat food product spam message today, which read:

Hello,

We are in the process of promoting a website about drug and alcohol rehabilitation. Would you be open to the idea of placing a text link ad on this page: http://www.hybridelephant.com/K2.php?

We hope to hear from you soon, so we can discuss rates and other pertinent details.

Thanks.

Stephanie Harper

first of all, categorically, NO!!! i AM NOT interested in doing business with anyone who uses spam as a marketing tool, regardless how appropriate it seems on the surface…

but then i looked at the message a little more closely… you see that part about “promoting a website about drug and alcohol rehabilitation”?

did they even READ the page at http://www.hybridelephant.com/K2.php, or were they just trolling for pages whose titles seemed appropriate… ’cause if they actually read the page, they would quickly realise that i am not suggesting that people who use alcohol or drugs go into rehabilitation, but the opposite… i am proposing that ALL “drugs” be legalised, which is an entirely different ball o’ wax…

the message also had a toll-free phone number and a web site link (which i have removed, because i don’t want anyone to get the idea that i support what they’re doing), so i called “Stephanie Harper” and got a computerised-voice answering service that said there was “NOBODY AVAILABLE. TRANSFERRING TO VOICE MAIL.” but i didn’t leave a message because there’s a very strong probability that they’ll ignore it anyway, and i don’t want to waste my breath. i then went to the console, and did some arcane and mystical things to discover that the domain is “owned” by a company called “Domains By Proxy” whose motto is “Your identity is nobody’s business but ours.^®“… in other words, they don’t want to tell you who they are…

if i were running a company that marketed web sites by “directed mail”, i would want people to be able to find out about my business. sure, there’s the web site link, but that’s what i say about who i am, not what other people say about me… and, if i were a legitimate business (which, because they market using spam, it isn’t to begin with), i would give a way to get in touch with me that doesn’t involve a WHOIS privacy company. i did a more conventional google search and discovered that “Stephanie Harper” is, sometimes, “Valerie Elden”, or “Ella Easton” or “Derek Holden”, and they’re searching for all kinds of pages on which to put their filthy dreck, using the form

We are in the process of promoting a website about (X). Would you be open to the idea of placing a text link ad on this page: (Y)?

We hope to hear from you soon, so we can discuss rates and other pertinent details.

and they make a habit of randomly spamming, because i found a number of pages, from a number of different web sites (both legitimate and less-than-legitimate) saying, essentially, the same thing this one does, i.e. WTF, spammers? i also discovered that, despite their fancy looking front page, their “web site” has only two pages and is powered by wordpress… not the way to make me believe that they’re a legitimate company doing legitimate business with anyone… 😐

so i just thought i’d put it out there… since, apparently, some people just won’t take a hint…

every spam comment that is submitted to my blog is marked as spam (which is why it doesn’t immediately appear as a comment: for that, i have to approve your comment, which won’t happen if it’s spam) and shuttled off to a “spam” folder, where i get to take it apart, dissect it, and add any domain names, IP addresses and specific key words to my blacklist and my anti-spam plugin, so that any further spam which contains ANY of the previously mentioned items will also be marked as spam.

in other words, any message that I DON’T LIKE will be dissected and any domain names, IP addresses and any key words that i find therein, will be added to my blacklist,
GUARANTEED!

i currently have almost 300 IP addresses (blocked at the /16 or /24 level), and almost 600 domain names blacklisted, and EVERY SINGLE SPAM COMMENT that gets submitted to my blog just makes the possibility that you will be able to post a comment on my blog that much less likely…

just give it up, already… go and bother someone else, why don’t you? 😐

i don’t often admit to hating pretty much anything, but i will admit, whole-heartedly, to hating spam with a white-hot passion… 😛

i’m going to use this as an example of how i determine something which is not labled spam, is actually spam.

the following is a text-dump of the entire message, with the headers intact. the only thing i have done is to obscure my host server.

Return-path: <x>
Envelope-to: [email protected]
Delivery-date: Fri, 01 Oct 2010 03:40:48 -0700
Received: from hybridel by x with local (Exim 4.69)
     (envelope-from )
     id 1P1d2m-0005OP-Im
     for [email protected]; Fri, 01 Oct 2010 03:40:48 -0700
To: "salamandir" <[email protected]>
Subject: Enquiry from Hybrid Elephant
X-PHP-Script: www.hybridelephant.com/contact_us.php for 122.163.114.169
From: "Randall Tuttle" <[email protected]>
MIME-Version: 1.0
X-Mailer: osCommerce Mailer
Content-Type: text/plain;
  charset="UTF-8"
Content-Transfer-Encoding: 7bit
Message-Id: <E1P1d2m-0005OP-Im@x>
Sender:  <hybridel@x>
Date: Fri, 01 Oct 2010 03:40:48 -0700
X-Bogosity: Unsure, tests=bogofilter, spamicity=0.583091, version=1.2.0
X-UID: 
Status: RO
X-Status: R
X-KMail-EncryptionState: N
X-KMail-SignatureState: N
X-KMail-MDN-Sent:  

We noticed that you are not at the top of the search engines for a number of your key terms.
We have helped companies similar to yours to achieve top organic rankings. Please reply to this
message and we will prepare a special proposal for you, to show you how we can achieve similar
results for you.

first, i look at the subject line: “Subject: Enquiry from Hybrid Elephant”

this is not labled “spam” because it’s an enquiry from my web site, which means that if it turns out to be spam, i can’t report it, because it doesn’t have a message path that can be traced. i get a lot of spammers trying to abuse my response form (hint, it only sends to me, so it’s not much use for spamming), so that increases the probability that it is, actually, spam.

next, i look at the sender name and email address. usually people who submit legitimate enquiries to my business have an email address that doesn’t stand out. this one – From: "Randall Tuttle" <[email protected]> – stands out: “Randall Tuttle” has an email address that includes the name “rachelle”? the probability that it actually is spam just went up to 99.98%. i have never seen an example of a message that comes from someone who is apparently male, which has an email address that includes a female name, unless they were trying to mislead people in some way.

as i said, because of the fact that it is an enquiry from my web site, i can’t report it, but i can delete it without even reading further.

but i am going to force myself to read further, because deep down, i am a masochist… or something like that…

now i’m starting to get perturbed… i knew i shouldn’t have read any further… patience, patience… 😐

yes, i know that. it is because i haven’t gotten to the top yet. if you google “html escape sequences” you’ll probably notice my site within the top 5 on the list. that is because i have offered the only complete list of html escape seqences on the net, for the longest time, without changing its URI. i haven’t been offering incense for anywhere near as long as i have had that list of escape sequences on the net. not only that, but i just upgraded from a flat html structure to a php/database structure within the past couple of years. one of the advantages is that if you search for specific products, like “aparajita special durbar incense” you will find my web site on the first page, despite the fact that i have upgraded my web site recently.

yeah, i’m not at the top of the list for all of my keywords, but i’m getting there, and if i leave my web site alone for long enough, i’ll probably get there without using possibly illegal and most likely nefarious ways to get there sooner, which is what you’re probably suggesting…

organic ratings? organic ratings!? nothing about the web is “organic” in any sense of the term. and if they were, in some miraculous way, “organic” ratings, then why would a person named “Randall” be trying to sell them to me, writing to me from “rachelle”‘s email address, at gmail.com?

reveal more about how my mailserver works to you, and give you new and innovative ways to break into my web site and email server, so that you can “prepare a special proposal” for me? i don’t think so, especially since you haven’t actually proven to me that you have actually done that for anyone.
 

 
oh, by the way, the form gives me a little bit more information about the sender than he probably realises:

aha, his IP address. a quick “host 122.163.114.169” tells me that his computer is named “abts-north-dynamic-169.114.163.122.airtelbroadband.in” which is a dynamic range coming from AirTel Broadband, in india.

yeah, i’m really going to respond to a person who didn’t give me his real name, offering sketchy SEO services from a wireless connection in india… 😐

LinkedIn Zeus spam run targets prospective business marks – i’ve been getting this spam for three weeks and i haven’t picked up the ZeuS trojan yet…

of course, i haven’t been clicking on any links in mail that crosses my desk labled as “spam”, and i have been reporting messages that claim to be from LinkedIn that are labled “spam” for three weeks… i have opened (as text-only, not as html) precisely one message that claimed to be from LinkedIn that was labled “spam”, about three weeks ago, to determine that it was, in fact, spam, and that has been it.

once again, the principal reason that email should not be sent as “formatted” or containing html code, is because, if it is, you can’t tell immediately that things are not as they should be. most people don’t think to look at the bottom of their screen, at the status bar of their email client or browser, to make sure that the link that they think they’re clicking is actually the link they’re clicking. most people assume that when they see a link, if they click on it they will be taken to the site indicated in the link, but that is NOT TRUE and especially so when the link is in an email message.

if i type in a link – http://www.hybridelephant.com/ – if that link is “active” (which this one is not), most people would assume that clicking it will take you to the site indicated, which is Hybrid Elephant. however, if you see the words Hybrid Elephant with no link, unless you look down, at the status bar of your browser (because you are viewing it in a web page, which is formatted using HTML), you won’t know that the link takes you to somewhere you may not have been expecting.

email was originally intended for communication on a very basic level. the web was intended for delivering “richer”, more “complete” content. you can say “check this out” without saying it in letters that are “formatted”. it may be “cooler” to say it in bold, purple, 72-point letters, but if you send such a message, the only thing you’re doing is forcing people who may not want it, to get a large quantity of essentially meaningless code along with a relatively short message, and sending people the possibility of getting their machines infected with a virus without you or them knowing about it, until it’s too late.

it not only saves space, but doesn’t have the potential for screwing up someone’s entire machine, as this LinkedIn/ZeuS spam tries to do.

HTML in Email is EVIL!
TEXT-ONLY EMAIL!
THE WEB IS THE PLACE FOR HTML-FORMATTING!

😛