Mmmm, honey-glazed spam

January 18, 2008 12:41 AM

Anybody else interested in participating in a MeFi spam honeypot?

A few days ago, in response to mudpuppie's stated intent to spam the hell out of the scammer who hijacked his girlfriend's Hotmail account, I pointed out that since the scammer had a Gmail address, this wasn't going to achieve much other than improve Gmail's spam filter. In the spirit of putting my money where my mouth was, I included my own Gmail address in that reply.

Within an hour, my Gmail spam folder was accumulating messages at about ten times the previous rate, which it continues to do. Also, I did actually start seeing one or two spam mails a day in the Inbox. That seems to have settled down now - I'm currently seeing about one a day.

And then this post got me thinking about the value of cooperation in the Fight against Evildoers, which brings me (at last) to the point:

If a bunch of Mefites with Gmail addresses in regular use were to post them in the same thread, we'd all likely get harvested by the same spambots, we'd all end up getting the same spam, and we'd all be sharing the (minimal) load of reporting that spam to the Gmail filters. I'd be really interested in finding out whether doing that would make a noticeable difference to the quality of those filters, as measured by the percentage of spam we each end up having to report.

If nobody else wants to play, that's fine by me; there is very little spam making it past the filters in my own account right now, and dealing with it makes me happy: clicking Report Spam feels like playing a fun FPS right in my inbox.

There are enough disposable Gmail accounts posted by anonymous Askers that I'm sure a MeFi honeypot effect is already happening to some extent. I still think it would be fun to play with this using Gmail accounts in regular, everyday use. Like this one:

[e-mail]

Heeeeere, bot bot bot bot bot!

posted by flabdablet to MetaFilter-related at 12:41 AM (95 comments total)

In the ongoing battle between spam and its filters, spam keeps winning. Just sayin'
posted by Blazecock Pileon at 12:56 AM on January 18, 2008 [3 favorites]

I used to believe that too. However, it seems to me that Gmail may well have achieved some sort of critical mass. I'm currently seeing well over 200 per day in the Spam folder, and about one in the Inbox.

I'm not sure an 0.5% penetration rate counts as "winning".

It seems to me that this is quite an interesting point in the arms race.
posted by flabdablet at 1:02 AM on January 18, 2008

In the ongoing battle between spam and its filters, spam keeps winning. Just sayin'

In the ongoing battle between spam and its filters, not only do I keep managing to refrain from buying penis creams or herbal v14gra, but I also seem to be able to avoid sending my bank account information to the Assistant to the Undersecretary of the First National Bank of Ouagadougou. Just sayin'.
posted by dersins at 1:04 AM on January 18, 2008

Someone doesn't manage to refrain, sadly, which is why we all keep getting spam.
posted by Blazecock Pileon at 1:06 AM on January 18, 2008 [1 favorite]

Wait... that mail from the First National Bank of Ouagadougou was spam?
posted by flabdablet at 1:25 AM on January 18, 2008 [1 favorite]

Someone doesn't manage to refrain, sadly, which is why we all keep getting spam.

Well, then.

Let's find everyone who buys penis creams, herbal viagra, or penny stocks based on unsolicited recommendations from strangers with names like "Dr. Chauncey Ayala" and "Ulysses Triplett" and shoot them in the face with a bazooka.

Problem solved.
posted by dersins at 1:34 AM on January 18, 2008 [6 favorites]

mmmmm. Spam + Honey.
sorry, what?
posted by From Bklyn at 2:08 AM on January 18, 2008

Don't bazooka the messenger yet, "Ulysses Triplett" sounds like a character from Thomas Pynchon and they create some pretty amazing inventions / investment options.
posted by Free word order! at 2:16 AM on January 18, 2008

Ulysses Triplett was my grandfather.

He not only founded the First National Bank of Kneiss, he was the first Boy Scout leader in Western Arizona, and the Triplett name still graces the Kneiss Vocational High School gym (home of the Fighting Hair), despite the slanderous allegations that eventually caused him to move the family (including my mother, Abigail Triplett) up north to Saskatchewan.

That's when the story really starts, but I won't bore you with the family lore any longer.

Funny, though, to see grampa's name on Meta!
posted by Joseph Gurl at 3:51 AM on January 18, 2008 [7 favorites]

I would just like to say that I like the term "honeypot."

That is all.
posted by exlotuseater at 4:03 AM on January 18, 2008

I would just like to say that I like the term "honeypot."

Personally I'm more of a buttercup fan myself.
posted by burnmp3s at 4:18 AM on January 18, 2008

Grampa liked the Dutch oven
posted by Joseph Gurl at 4:20 AM on January 18, 2008

A few days ago, in response to mudpuppie's stated intent to spam the hell out of the scammer who hijacked his girlfriend's Hotmail account

Her, for the record.

And no, I have no interest, but I hope you have a great time.
posted by Divine_Wino at 4:40 AM on January 18, 2008

260 spams in the last 24 hours. One needed reporting.

Does anybody know of a spam filter that performs better than Google's? Because I'm starting to get seriously impressed.

Bring it on, botnets.
posted by flabdablet at 4:46 AM on January 18, 2008

Begging your pardon, ms. mudpuppie.
posted by flabdablet at 4:48 AM on January 18, 2008

Bring it on, botnets.

You know who else told evildoers to bring it on?
Kirsten Dunst.
posted by Horace Rumpole at 4:54 AM on January 18, 2008 [2 favorites]

The guy who bought all the penis cream?
Me.
Sorry about that...


Oh:
I also bought a whol
˜˜e
posted by Dizzy at 4:58 AM on January 18, 2008

Sorry. Can't type very well because of the penis cream; it makes me
posted by Dizzy at 4:59 AM on January 18, 2008 [2 favorites]

Does anybody know of a spam filter that performs better than Google's? Because I'm starting to get seriously impressed.

Fastmail.fm. I got my first piece of spam in about forever yesterday.
posted by Brandon Blatcher at 5:05 AM on January 18, 2008

My favorite trend in spam email now is email coming from [random synonym for large]+[random euphemism for penis]+[common first name]

MonstrousShlongChristoper
VoluminousDickErin

then there was a twist on the format with...
FranciscaSizableErectileorgan

Spam Assassin keeps them on the server so they never make my inbox. I might start using them as a sockpuppet name generator.
posted by birdherder at 5:05 AM on January 18, 2008 [1 favorite]

Brandon, could you give me an idea what volume of spam is actually heading your way before it hits your filter?
posted by flabdablet at 5:18 AM on January 18, 2008

I clicked to read the rest of this thread because I thought "honeypot" was something dirty.

I was promised smut.
posted by sneakin at 5:31 AM on January 18, 2008

I have 1632 pieces of smut - no, wait, 1633 pieces of smut - in my spam folder right now. Get yourself a Gmail account, post the address here, and you shall have all the smut your little heart desires!

Nobody's up for this, are they.
posted by flabdablet at 5:59 AM on January 18, 2008

who wants to put some money in the honey pot and bet that flabdablet works for google?
(i keed..)
posted by localhuman at 6:04 AM on January 18, 2008

mudpuppie is actually female.
posted by jessamyn at 6:07 AM on January 18, 2008

Indeed.

I don't actually work for Google. Not for want of trying, though.
posted by flabdablet at 6:24 AM on January 18, 2008

Ya'll quit pickin' on wendell.
posted by BeerFilter at 6:24 AM on January 18, 2008 [1 favorite]

If a bunch of Mefites with Gmail addresses in regular use were to post them in the same thread, we'd all likely get harvested by the same spambots, we'd all end up getting the same spam, and we'd all be sharing the (minimal) load of reporting that spam to the Gmail filters. I'd be really interested in finding out whether doing that would make a noticeable difference to the quality of those filters, as measured by the percentage of spam we each end up having to report.

Spammers send these emails to kajillions of email addresses at a time. How can getting 10 or 20 more victims in this thread have any effect whatsoever on the avalanche of email Google is sorting through?

260 spams in the last 24 hours. One needed reporting.

Don't rate Google's (really Postini's, I think) spam-fighting skills based on the spam you don't get, rate it on the non-spam email you do get. Not delivering email is something anyone can do.
posted by popechunk at 6:26 AM on January 18, 2008

I currently have 77601 messages in my spam folder at Gmail. I am pretty sure that everything I want gets through. Except the comments from one of my wbsites. Doesn't matter how many times I mark them as "not spam", they always get shitcanned.
posted by dirtdirt at 6:43 AM on January 18, 2008

My email address, [e-mail] forwards to my Gmail account, [e-mail]. It's listed on the contact page on my website, so I think it's probably on every spammer's list already.

I wish I could tell which spams I reported and which were auto-reported. If I had to guess, I'd say the false-negative rate is about 1/100. And I know of only a single false positive since I've had a Gmail account (7 May 2004, 10k non-spam emails ago).
posted by Plutor at 7:06 AM on January 18, 2008

everything I want gets through. Except...

That's been my experience, too. It always works, except when it don't ;-)
posted by popechunk at 7:06 AM on January 18, 2008

Nobody's up for this, are they.

Not so much, no.
posted by sneakin at 7:09 AM on January 18, 2008

I also seem to be able to avoid sending my bank account information to the Assistant to the Undersecretary of the First National Bank of Ouagadougou

For heaven's sake, you don't send it to the Assistant to the Undersecretary, you send it to the Undersecretary himself. I'm expecting my cut of $20,000,000 within the week.
posted by languagehat at 7:12 AM on January 18, 2008 [1 favorite]

Honeybucket > honeypot. FYI.
posted by cortex at 7:13 AM on January 18, 2008

And I know of only a single false positive since I've had a Gmail account (7 May 2004, 10k non-spam emails ago).

I've had two. One of them came from the mefi mailer daemon that we use to track metatalk posts. That was pretty neat.
posted by cortex at 7:14 AM on January 18, 2008

I set up a honeypot on my back yard in an attempt to catch spam. All I got were ants and bears.

Are bears considered spam? Because if so, spam is scary close up.
posted by quin at 7:20 AM on January 18, 2008 [3 favorites]

I think pigs are considered spam, if only on a technicality.
posted by nebulawindphone at 7:25 AM on January 18, 2008 [2 favorites]

[e-mail] is the one I use when I sign up for random crap on the net. And to read the TextMate mailing list.
posted by chunking express at 7:26 AM on January 18, 2008

You want scary?
Try returning 264 tubes of penis cream.
Had to keep using a bigger box.
posted by Dizzy at 7:27 AM on January 18, 2008

could you give me an idea what volume of spam is actually heading your way before it hits your filter

I had exact figures and wrote'em up, copied them and was going to MefiMail you, but oh, you don't use MefiMail, so I copied your email address and well, there went info.

So, i have several addresses going into a main account, 3 of them comcast.net addresses which produce most of the spam. Outta 56 emails in the folder from those 3 acounts, 12 were spam and from today 38 pieces of spam were attributed to the comcast accounts. Otherwise, just 2 or 3 emails a day in my spam folder.
posted by Brandon Blatcher at 7:30 AM on January 18, 2008

I just got a piece of spam.

I hold flabdablet personally responsible.

Where are my reparations?

Honeybucket > honeypot. FYI.
posted by cortex at 9:13 AM on January 18

Are those the wings from KFC?
posted by Ynoxas at 7:35 AM on January 18, 2008

Hah. And people called me an idiot for insisting on an obfuscated email address, and being upset when the option to publish a noncompliant address was removed.

I want to draw the admins' attention to this. When we say we want things, there's often a very good reason for it. I, at least, don't yell about stuff that doesn't actually negatively impact me... non-obfuscated email addresses was one of them. Yes, it got fixed, but getting the feature through the counter-argumentation felt like getting pecked to death by ducks.
posted by Malor at 8:00 AM on January 18, 2008

(and it never did directly get fixed, the admins did the absolute minimum possible; rather than adding an email field, they made us do our own obfuscation in our 'about'. This was not an unreasonable request on our part, as you are seeing here.)
posted by Malor at 8:02 AM on January 18, 2008

Malor, people getting spam here are posting their full email in a public thread. Your email on your profile is NOT shown to the public, so bots will not scrape it automatically.
posted by mathowie at 8:35 AM on January 18, 2008

All the great spammable product lines are aimed at men. They even have penis creams now that refinance your mortgage for you.
posted by amyms at 8:48 AM on January 18, 2008

[e-mail]
posted by everichon at 9:15 AM on January 18, 2008

[e-mail]
posted by davey_darling at 9:23 AM on January 18, 2008

I'm probably just confused, but wouldn't it make more sense to give out your email address here as [e-mail], and set up a filter to mark everything to that address as spam? That way, you won't see any new spam in your inbox.
posted by SAC at 9:34 AM on January 18, 2008

cortex: Honeybucket > honeypot. FYI.

Honeybucket? What an awesomely cute pet name... Oh, wait, hell no.
posted by Pronoiac at 9:35 AM on January 18, 2008

Shitstorm Honeypot, the greatest derail evar.
posted by carsonb at 9:45 AM on January 18, 2008

[e-mail]
posted by hermitosis at 10:12 AM on January 18, 2008

cortex: Honeybucket > honeypot. FYI.

Honeybucket? What an awesomely cute pet name... Oh, wait, hell no.

I was just coming here to point that out, Pronoiac. The word "honeybucket" has been permanently tainted for me, ever since the great storm of 1997 when honeybuckets lined the mud-soaked main street of Ashland, Oregon.
posted by oneirodynia at 10:21 AM on January 18, 2008

the great storm of 1997

That was a gnarly couple of weeks, with the honeybuckets and all. Great flood, though.
posted by everichon at 10:45 AM on January 18, 2008

...that explains the balloon payment on my 30-year fixed, amyms.
posted by Dizzy at 10:48 AM on January 18, 2008

The site probably could participate in Project Honeypot if it wanted to be a spam trap.
posted by jeversol at 10:54 AM on January 18, 2008

I would like to order a honeypot. Please tell me where to send a check.
posted by desuetude at 10:57 AM on January 18, 2008

Oh, bother.
posted by box at 11:10 AM on January 18, 2008 [2 favorites]

clicking Report Spam feels like playing a fun FPS right in my inbox.

Someone needs to show you some better games.
Having said that, [e-mail]

I get way more legitimate email for people who can't spell their own (or from people who can't spell their recipient's) email addresses than I get spam.
posted by juv3nal at 11:56 AM on January 18, 2008

I already get around 300 spam messages a day, so [e-mail]
posted by tehloki at 12:01 PM on January 18, 2008

Ohhh, now I have "Shitstorm Honeypot" running through my head to the tune of "Sugerpie Honeybunch".

Thanks for that. Thanks a pantload.
posted by dirtdirt at 12:10 PM on January 18, 2008 [1 favorite]

Whoa.

I was totally kidding about the spam, by the way.
posted by mudpuppie at 12:17 PM on January 18, 2008

Spam is a serious meat product. Please save your "kidding" for bologna, and other inferior animal carcass spreads. Thanks.
posted by It's Raining Florence Henderson at 12:46 PM on January 18, 2008 [1 favorite]

Spam is a serious meat product.

I don't follow you here. I can't take any meat product seriously that doesn't identify itself in its name as meat product. That leaves, uh, Potted Meat Food Product. Now that's a meat product I can take srsly. Ain' no kiddin' around when you've got partially de-fatted cooked pork fatty tissue on your hands*, nuh uh.

*Partially de-fatted cooked pork fatty tissue on other body parts may in fact involve kiddin'.
posted by carsonb at 12:59 PM on January 18, 2008

What about Meat Thins? It's "the cracker that chews like a steak".
posted by cortex at 1:05 PM on January 18, 2008 [1 favorite]

Dizzy is back, yay!
posted by deborah at 1:07 PM on January 18, 2008 [1 favorite]

I used to collect the names of the "people" who sent me spam. Some of my favorites:

Cuzzart072 dutchtown
Zetta Jones
Akgreybull malmo
Xandra Weems
Hopcadyville colfax

They're all amusing, though. Interesting idea, but I don't need any more crazy names.
posted by Rinku at 1:30 PM on January 18, 2008

Malor, I've had my Gmail address in plaintext in my profile since I joined MeFi, and until I posted it in a public thread, my spam folder was getting about ten a day; about the same as before I joined MeFi. Now it's rising 300. I'd say Matt's anti-bot stuff works pretty well.
posted by flabdablet at 4:34 PM on January 18, 2008

Hello I am [e-mail] and I need a repliaca watch and ci@liss please me deeper online casino.
posted by kuujjuarapik at 8:46 PM on January 18, 2008

There's no reason to post a useful e-mail address. If a non-useful e-mail address is used, then you know that every e-mail sent to it is spam and you save yourself the labor involved in
separating spam from non-spam.

I don't really get why this needs to be done and I really don't understand why this needs to done this way.
posted by rdr at 10:42 PM on January 18, 2008

The gmail spam filter works very well. What it really needs is a whitelist. That would be just about perfect.
posted by krinklyfig at 12:26 AM on January 19, 2008

I have a honeypot (spamtrap) which could use a bit more exposure... so why not.

[e-mail]

Anything sent or cc'd to this account is rejected outright, and after several rejections from the same IP in an hour, the IP is blacklisted for a day.
posted by kindall at 12:46 AM on January 19, 2008

I use mailinator as much as possible- recommeded.
posted by mattoxic at 3:01 AM on January 19, 2008

I've only got 14 spam so far this year. Hopefully, things will improve.
posted by tellurian at 6:01 AM on January 19, 2008

Last few times I tried mailinator, the e-mail never got through.

That said, [e-mail] . . .
posted by klausness at 6:13 AM on January 19, 2008

Currently showing 1957 in the spam folder, one report needed for today and yesterday. Thought it was two for a minute, before realizing that "You can win an iPhone from VMware when you update your VMware Profile" was actually legit. Gmail's spam filter is better than mine!
posted by flabdablet at 1:40 PM on January 19, 2008

Where is the "your approach to fighting spam will not work because..." checkbox that always pops up on slashdot? surely someone can think of some witty answers for that.
posted by lohmannn at 3:09 PM on January 19, 2008

[e-mail]
posted by roll truck roll at 4:19 PM on January 19, 2008

wow, 5 or so spam messages just got into my gmail inbox. these spambots are powerful stuff.
posted by tehloki at 6:34 PM on January 19, 2008

I just added a "reported" label to my Gmail so I can keep track of the ones I actually get to report amongst the auto-filtered flood. Because spam doesn't show up under normal label searches, I have to search for

in:spam label:reported

to see them. I'd be interested to find out whether we do in fact end up seeing the same spam as a result of this little game.
posted by flabdablet at 6:45 PM on January 19, 2008

I think my email was already on enough crawlable pages that this is pretty much a bust for me. I haven't gotten to report a blessed thing since this game started.
posted by juv3nal at 5:59 AM on January 20, 2008

1036 pieces of spam since the 18 Dec (32 days?). Maybe 4 have gotten through in that time. I think Google is doing well enough without me doing more than using my real email on the internet.
posted by furtive at 3:26 PM on January 20, 2008

How about sending the spam into a honeywagon?
posted by MythMaker at 5:39 PM on January 20, 2008

415-407-3522 (I rarely check my gmail account)
posted by ryanrs at 1:56 AM on January 21, 2008

2204 in the spam folder. Still waiting to use my shiny new "reported" label.
posted by flabdablet at 5:39 AM on January 21, 2008

[e-mail]
posted by schyler523 at 12:57 PM on January 21, 2008

Count me in...

[e-mail]
posted by Samizdata at 9:14 PM on January 21, 2008

2318 in spam folder, one reported. No false positives that I know of. I've signed up for a few things, and the confirmation emails have all got through.
posted by flabdablet at 11:18 PM on January 21, 2008

late as always... [e-mail]
posted by somanyamys at 1:07 PM on January 23, 2008

ahh yes, here it is.

Your post advocates a

(x) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

(x) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(x) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
(x) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
(x) Eternal arms race involved in all filtering approaches
(x) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
(x) Blacklists suck
( ) Whitelists suck
(x) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(x) Feel-good measures do nothing to solve the problem
(x) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
posted by lohmannn at 1:44 PM on January 23, 2008 [4 favorites]

Two labelled "reported" out of 2714 in spam folder. No false positives noticed.
posted by flabdablet at 3:32 PM on January 24, 2008

4 reported out of 3264 in spam folder. Still getting all the mails I'm expecting, as well as some I wasn't; false positive rate is perfectly acceptable.
posted by flabdablet at 1:52 PM on January 28, 2008

9 reported out of 4012 in spam folder. Still no false positives as far as I know.
posted by flabdablet at 3:37 PM on February 2, 2008

in:spam 4856
in:spam in:starred 9
False positives detected 0
posted by flabdablet at 4:09 PM on February 7, 2008

My post advocates a

(x) widespread (x) united (x) technical

approach to fighting spam. So far it seems to be working very, very well.

I don't think it's unfair to say that from the average end-user's point of view, the spam problem has been solved, and the solution's name is Gmail.
posted by flabdablet at 4:12 PM on February 7, 2008

So, it's now been a month since I started this little test, meaning that all the messages in my Spam folder have got there since it started, and I now have:

in:spam 6621
in:spam in:starred 27
Alleged false positives 1
posted by flabdablet at 3:20 PM on February 16, 2008