Spam Fighting Strategies for Webmasters

by: Paul Wilcox

Battling spam is just like fighting any other activity that is illegal and needs to be fought in many areas. There are some easy steps that you can take to minimize the impact of spam in your email, as discussed in Part I. However, the webmaster of your email service has many more tools they can use to fight spam.

The effort would be small if a spammer had to collect email addresses one by one. This is why they take advantage of programming that is automated, such as using a spambot. A spambot is a program that looks through Internet websites for legitimate email addresses. These addresses are then "harvested" and put into huge lists.

The best way to deal with spammers is by raising their cost without putting too much of your own effort into it. Some of the techniques described in Part I can also be used by a webmaster.

CAMOUFLAGE

A spambot will only do what it has been told to do through a program. Many times a spambot will pass you by simply if you've disguised your email address. This is because a spambot is usually programmed to search for character strings that look like this: Jane_email@emailaddressdomain.com. You can fool a spambot by changing the email to Jane_email_at_NOSPAMemailaddressdomain.com.

Should the disguised email address be harvested by a spambot it will still need to "scrubbed" before it can be used. A program for scrubbing can be difficult to write since there are many variations that are possible, such as NO_SPAM and no*spam. Try to be as creative as possible.

There is a disadvantage to the above method: you need to remember to take out the extra letters as well as put in th@ sign.

You can make an email address impossible to harvest by putting it into a graphic instead of plain text or mailto:. Not many spambots are smart enough to translate a graphic and understand the pixel pattern as text that is usable. This is particularly true since graphics can have many shapes. Again, this method can be inconvenient because you won't just be able to reply to this address or copy and paste it.

Another approach is to get rid of the accessbile and visible email address completely. You can use a form for feedback that stores data in areas where a spambot can't search. You can also store the data inside of easy to write code that is difficult to decipher due to encryption. An example of this would be javascript.

BARRIERS

Communication becomes more difficult between trusted sources when visible email addresses are hidden in graphics or banned from visibility. You want to hinder the spammer by putting a block on any spambots that are known.

Many times they will have a signature that is easily seen through an IP address that is well known or a process name (and sometimes both). Other times they can search for User-Agents that are a non-browser form.

Webmasters can easily block IP addresses as well as block any unwanted processes. The webmaster just needs to begin a cron job that will scan the network for the name of a process and then terminate any IDs that are associated with the process.

A more experienced webmaster will have a daemon that will sleep until that time when a process name is noticed. The daemon will then "wake up" and terminate the process before any spam harvesting can occur. Sample programs, which are only a bit harder to implement, can be used and are available online.

You can get traps for spambots that will block any request that is incoming simply based on search patterns and behaviors. This method to fight spam is slightly more difficult to set up and attend to because it needs certain patterns to define it, changing the pattern slightly for different spambots. How-to information and sample perl programs are available online.

RAISE THE PRICE

After time most spammers will tire of trying different variations in programming just to get email addresses, making the reward much less than the effort. This is what you want to do: make the spammer cost much higher than the reward which will make your reward much more than the effort.

A spammer won't give up until there is no profit in the effort. US legislation, such as CAN-SPAM, has only seemed to deter businesses that are legitimate and that were never the guilty ones to begin with.

There are, however, some things being done to reduce the problem of spam to just an annoyance: there are penalties for sending spam, filters for junk mail are becoming smarter, and there are proposals underway that include needing a mailer ID.

This is all bad news for the spammer while at the same time is great for the rest of us computer users.