Thursday, September 23, 1999, 1:32:39 PM, Arunas wrote:
> This was true perhaps 6-8 months ago. I don't know what kind of spam you are
> getting, but mine is addressed to me (well, 95 mails out of 100). I think
> this is because their mailagents are getting updated and are capable of
> addressing each mail individually. The most constant thing, appeared lately
> in spam messages, is senders address with some erratic numbers, some- thing
> like: [EMAIL PROTECTED] And this is possible to filter using
> procmail (I hope you, being *nix specialist, don't need further
> instructions..).
It is still true today. Here's why. If they are addressing the message
individually but not doing so with a huge to/cc they are sending the body of
the message for each address on their list. So give, say, a list of 5,000
addresses and a spam message that is, oh, 1k long. That is 5,000k or just shy
of 5Mb. Call it 5Mb for a nice round number (the extra is made up in headers,
for example). So, to transfer out that an SMTP connection is made and it goes
through the motions mail from, rcpt to, data, close, repeat. On a 56k modem
it would take ~35 minutes to transfer all that data.
Now, make it a BCC list. Same 5000 messages. An SMTP connection is made,
mail from goes through, then 5000 rcpt tos, one data, one close, that's it.
Notice the difference, the data is passed over that link only once. So now
instead of transferring the 1k of data 5000 times with the 5000 addresses, you
just transfer the 5000 addresses and the SMTP server then divvies it up as
needed. Net savings is that you go from ~5Mb down to, oh.... HMMM, well...
50k, maybe? All of 1 minute on a 56k modem. Or to put it another way, given
the average length of an address at a whopping 40 bytes (liberal, really), you
could send 131000 spam in the same time as sending the data block to 5000
customers.
In short, the way that spammers operate, they aren't going to put the
address in there with everyone else's since it doesn't put the ad up front and
it increases the size of the data block. They aren't going to address them
individually because that requires them to send the data block once for each
individual message. If you are getting hit by spammers that do that, rest
assured that they are newbie script kiddies who will get caught in short order
and most likely never do it again. Those who do it repeatedly, however, will
not do it that way and those are the ones that will spam you multiple times on
different ads.
--
Steve C. Lamb | I'm your priest, I'm your shrink, I'm your
ICQ: 5107343 | main connection to the switchboard of souls.
-------------------------------+---------------------------------------------
--
--------------------------------------------------------------
View the TBUDL archive at http://tbudl.thebat.dutaint.com
To Unsubscribe from TBUDL, click below and send the generated message.
<mailto:[EMAIL PROTECTED]>
--------------------------------------------------------------
