Mailinator.com: Anatomy of a Spammy Campaign

http://mailinator.blogspot.com/2018/07/mailinatorcom-anatomy-of-spammy-campaign.html

by zinxq • 8 years ago

144 71 8 years ago

mailinator.blogspot.com

gingerlime• 8 years ago

If spammers IPs are so widely spread out, then doesn’t it make most IP based RBLs fairly pointless? Or worse, more likely to get false positives?

Sending legitimate email becomes increasingly frustrating, yet spammers still to find their way to our mailbox.

throwaway2048• 8 years ago

IPs arent marked as spam forever, its easy to get delisted from DNSBLs if you arent continuing to send spam.

logronoide3• 8 years ago

The theory says it's easy to be delisted, but some very large Telcos have given up and they don't try to be delisted anymore. This task can be very time consuming and they only focus on prefixes of their static pool or business services. For example, prefixes of Telefónica de España have been included in Spamhaus Zen for a while: https://www.spamhaus.org/zen/.

Mailinator is a hack to workaround the spam flood. But for trustable business, the anonymity of the disposable addresses is a big problem because it is not possible to start a marketing process (if you register for a trial, for example, you should be "paying" with your email to let the company start a marketing process. Marketing for a service you have registered is not spam...). More and more companies deny registration from Disposable Email Addresses. Because these users are worthless.

Spam is a plague that hurts good users and trustable business.

ttul• 8 years ago

Non spammers send from a consistent pool of IPs and domains that don’t send crap. By contrast, spammers either send high volumes of crap from a small set of IPs and domains, or they spread a single content pattern over a wide diversity of IPs and domains that do not have a good track record.

So long as you can keep track of literally billions of counters in real time, you can effectively combat spammers.

Source: MailChannels CEO

kevan• 8 years ago

For anyone that's interested, fraud detection is a pretty big use case for graph databases[1]

[1] https://neo4j.com/blog/fraud-prevention-neo4j-5-minute-overv...

Fnoord7• 8 years ago

Except they're not. The vast amount of spam comes from a few IP blocks who are so-called "liberal" in their spam policy. That is to say, they're spam paradises and earn their money from those shady customers while the vast majority of the world blocks these. Not via police force, mind you, but via network/sys admin force.

The rest of the spam is done using compromised computers but once that's done the ISP of that provider gets quickly noticed and either the ISP blocks that customer or they themselves get blocked wholly due to their inaction. So they choose eggs for their money (as the Dutch saying goes).

octosphere• 8 years ago

I love these kind of writeups about services which are like plumbing for the web. If it wasn't for mailinator, managing my inbox would be a chore. I use it all the time, although there is a panoply of others to use and I suffer from disposable inbox fatigue (just as bad as suffering from an overflowing inbox).

nneonneo• 8 years ago

One of the more under appreciated features of Mailinator is the fact that they’ll take any mail sent their way, regardless of the email address domain. This means that, if @mailinator.com is blocked for a given site, you can use any number of aliases for it and still get through (my personal favorite is @devnullmail.com), or you can even set up an MX record pointing at Mailinator and effectively use a custom domain.

logronoide3• 8 years ago

Using mail.mailinator.com as MX records are something that almost all tools check to ban disposable email addresses. The only real thing that works for them is to renew their domain pool as fast as they can. In our service in https://apility.io we check for MX records of very well known DEPs, and also we crawl the web to try to keep an up to date list of these domains.

snowpanda• 8 years ago

Anti Abuse API

Why does your company consider disposable email addresses abusive?

mmt8• 8 years ago

As I mentioned elsewhere in the thread, I never understood why they don't just obfuscate the MX names.

A service like yours would certainly have no trouble noticing the fact that the MXes all have the same IP address as Mailinator, but, right now, anyone can just do a lookup and simple string comparison themselves, without paying.

strken• 8 years ago

we check for MX records of very well known DEPs

This is one of the most pointless anti-abuse measures you could implement, since a Gmail account can be created in about 20 seconds with no identifying information.

deno• 8 years ago

Do you block Abine[1]?

[1] https://www.abine.com/index.html

krageon• 8 years ago

Congratulations, you are contributing to making the internet a worse place for everyone. How did you come to work for a company that's this blatantly abusive?

creativityland• 8 years ago

Mailinator is a lifesaver. Good to see them still up and running after all these years.

mastef• 8 years ago

Oh yeah, so much "good day" spam recently.

Mailinator.com: Anatomy of a Spammy Campaign

Related Stories