The Spam Trap

There are more and more problems with junk mail these days .. :-(

People scan the USENET newsgroups for postings, and get your address from there. Some will mail you within 24 hours of your post (our test case: 4 posts in the first 24 hours all of which where junk email).
People scan web pages for email addresses, and use those to email you. They use this method since most web page addresses are accurate.
People connect to SMTP servers and try and brute force their way into finding lists of usernames.
People get throw-away accounts with ISP's, just to get the user list.
People buy lists of email addresses from others, obtained with the above methods.
People are using other ISP's mail servers, to try and get around mail blocks. Cyber Promotions is one such outfit that does this. Few pieces of junk mail come from the same mail server where the sender actually has an account. Commonly abused mail servers include Worldnet, Netcom, UUNET, and AOL, probably due to their size and popularity (not to mention, lack of protection).

We have implemented a special front-end to our mail server that has several unique qualities to it that you may find interesting.

Our mail server does not permit "mail relaying" unless it is *to* or *from* one of our customers, ie, the spammers out on the net, can not use our mail server to send their spam to other ISP's. In other words, you must be one of our customers to send outgoing mail via our server.
We have sent out a newsgroup message to USENET with no redeeming value, one that would cause no replies from "interested individuals". Any responses to the address we posted from, therefore must be unsolicited bulk email (UBE), otherwise more and more commonly known as spam. [Spam used to only be referred to the newsgroups; the severity of junk email problems is causing it to become well known for email as well now].
If we receive any responses to that address, the combination of that sender's address and mail machine are blacklisted. The message is forwarded to the postmaster at Med TechNet for verification and monitoring purposes.
Several spam traps are imbedded in web pages throughout. They are hidden and non-visible except when snooping the .html files specifically. We won't comment on which pages have the spam traps :-).

Some notes to the junk mailers..

We are not against junk mail itself per-se; we are against UNSOLICITED junk mail. If you are sending junk mail to our users, please be sure they asked for it. As long as you follow that rule you will not be filtered out. We have set up the spam trap as an address that is simply not capable of requesting information, subscribing to lists, etc. If you send it any email at all, it will be deemed as unsolicited, and you will be blacklisted. If you are identifiable, logs will be sent to your ISP or upstream network service provider, as well as published on various spam discussion lists.

Again: SOLICITED mailings are permitted. UNSOLICITED, will be blacklisted.

Some notes to our users...

Please, do not send us reports of junk mail. We will not take individual reports on the matter, as they are highly biased and the trustworthiness of such can not be taken for granted. It would also be considered "editorial control", something we wish not to get involved in :-). The filtering that is in place is strictly automatic, both to keep personal bias out of making policy, and to minimize the number of hours spent maintaining things. You are, however, more than welcome to complain to the provider of the person who sent you the junk mail. Please make sure you research it carefully; many innocent victims get targeted because of their name being in the headers, when it was not really them. Suggested reading is at http://spam.abuse.net - suggestions on how to read the headers and determine what is right and wrong are listed.

Our method is not perfect; it can not detect unsolicited bulk email, until the spam trap itself has been hit. If you receive your unsolicited messages before the spam trap does (or the spam trap doesn't get a copy at all), we won't be able to block the message, and you'll still get it :-(. However, it _does_ work quite well in most cases. At an alternate location where the same software is being run, spam runs of 100-200 addresses usually only get a few through and the others are all subsequently blocked. That site has been running the software for 6 months, however, and has had time to collect it's addresses :-).

Mail is NOT filtered based on content whatsoever. [To do so would require a lot more computing power.. and such motives would be highly questionable.] We also do not filter based on our own personal biases or hold grudges against any other location.

If you are having problems with junk mail beyond what our spam trap can catch [happens to all of us, sigh] you still have some options available to you.

Eudora 3 has filtering options
Microsoft Internet Explorer & Outlook have filtering options
Pegasus Mail has filtering options
Procmail is available for unix mail readers, and have the added benefit of processing the mail on our time instead of yours. Windows based options, require you to still download the message in order to process it. "man procmail" for details.

There may be other options as well; these are just the ones we are aware of. If your mail reader doesn't support filtering, you should consider scouting out the other options. http://www.gigo.com/junkmail.htm has some pointers and links to FAQs and software vendors to give you a head start.

The list keeps growing ...

Our blocked list of domains (known spammers) keeps growing. We block hundreds of E-Mail attempts each month. If you're curious who the offenders are, we have a spammers list you can view online that was updated on 17Jul97.

Feel free to use this list to block unsolicited E-Mail at your site, either through a filter on your mail reader, or as we do, by blocking the transmission altogether in the smtpd daemon.

Additional Reading

Bill Hliwa
[email protected]