Gray Listing Spam Blockers

Large e-mail service providers, such as Gmail, have the ability to crowd-source identifying spam since they have millions of users which results in few false positives. But, what do you use if you're a small time e-mail service provider?

A poor-man's technique to stop spam is called gray listing.

Here's one implementation of how it works...

If the gray listing e-mail service provider hasn't received any e-mails from the sender recently (say, within the last two weeks) they will tell the sender's mail server to try again later. This isn't a problem since the e-mail protocol (SMTP) is designed to keep trying for a couple days before giving up.

As long as the sending mail server waits a small amount of time (say, ten minutes) before trying again, then the e-mail will go through on the second attempt. If the sender has recently sent an e-mail to the recipient's e-mail address then the e-mail goes through on the first try since the sender's e-mail address is on the gray list. (The e-mail is black listed first, then it's white listed. Black + White = Gray)

Because of how this works, users sometimes notice the first two e-mails, sent from the same person (who hasn't sent an e-mail in the past two weeks) may be delivered out of order if the e-mails are sent within a few minutes of each other. (I've personally seen this happen, but it's rare.)

The reason that gray listing works so well is that spammers rarely configure their servers to try to deliver an e-mail more than once. If spammers did configure their e-mail servers to try multiple times then their spam servers would be overwhelmed.

Following a Spammer's Trail

Yesterday, a friend posted an odd message to my Facebook wall. As soon as I read it I realized that her account was highjacked, probably by visiting a nefarious website.

This can happen when you click on a link that takes you to a website while you're still logged into Facebook. At this point, the nefarious website will exploit a vulnerability in your web browser and post something to Facebook on your behalf.

I decided to follow the trail. It started with a post that took me to allfreeipad.com (to be on the safe side, don't visit these websites).

AllFreeiPad.com redirected my web browser to www.ipadfree4me.com which lead me to www.ipadfree4me.com/freeipad.htm.

This is where things got interesting, at least from a technical point. Most people know that you can view a web page's HTML source code to see its details (View -> Page Source). This is the first step to finding out the "where and how" a webpage was created, and the source code is almost always human readable unless you're trying to hide something. Instead of normal HTML, the actual source of this page uses JavaScript encoding (called escaping).



This is what you get if you decode (unescape) the JavaScript:



This escaped JavaScript tells your web browser to create an HTML frame and display the contents of elitesiteemporium.com/ipad-for-testers/?mn=54321.

After all these hops, you're now at elitesiteemporium.com. This domain name is private, so you can't see who actually owns it, but you can find out that its IP address (92.241.169.14) reveals that it's located in Russia. However, this isn't the end of the line, after a few more hops, you'll end up at a web page that wants you to enter your e-mail address so that they can send you a free iPad.

The trail ends at yourrewardinside.com's servers (IP address 204.51.78.152) running on a network leased to MPC Systems LLC which could be based in Delaware or perhaps Texas, depending who you ask.

Keep in mind that there are two parties (confederates) involved in this scheme which could be unrelated, but that's usually not the case. One party created the nefarious web page which posted their message to your Facebook wall, without you knowing, and the second party is located at the destination website (yourrewardinside.com) which claims that it will give you an iPad for the low (free) price of giving them your e-mail address.

I wouldn't recommend giving them your e-mail address.