Spammers use a particularly insidious technique to determine if an
email account is valid. Each address to which they send HTML Spam
contains an IMG tag unique to that email address. If the Spamee open
the HTML Spam in a graphical browser or, god forbid, has images turned
on in their HTML enabled email client, the Spammer's webserver logs
the request for the unique IMG tag. Since the IMG tag is associated
with the Spamee's email address, they have just validated their
address as one that can and does view HTML emails. The poor Spamee
then gets their address placed on one of those "eighteen trillion
email addresses for just $19.95" CDs that seem to be half of what Spam
companies sell. . . apparently to each other. The IMG doesn't even
have to be served up by the webserver since all the Spammer really
wants is to know whether it's a valid email address with the bonus of
knowing that whoever's at the address can and does view HTML.
This, at long last, brings me to my question: I know that Spam
companies have been doing this for some time. I am currently working
on a research project on the history of this practice.
I am looking for references dated prior to 1998 that explain the
practice of sending HTML Spam containing an IMG tag and waiting for a
request for the unique IMG tag. The best references would probably be
newspaper or magazine articles. Not as good, but still useful would
be references in a USENET or mailing list archive. However, in each
case, the references *must* have verifiable dates. I'm not really
interested in any references after 1997, although references in 1997
are fine. The more references the better. |
Request for Question Clarification by
pafalafa-ga
on
15 Jun 2004 12:19 PDT
Mr. I,
Wow! I thought this was going to be easy. I guess if it was, it
wouldn't be priced the way it is.
I've been looking through a nubmer of sources for old newspaper and
magazine articles, as well as internet postings, and nothing yet hits
the nail on the head. Closest I've come is this:
http://lists.w3.org/Archives/Public/www-talk/1995NovDec/0000.html
and I'd appreciate your comments on whether something like this is:
a) of no value at all
b) a little bit valuable
c) actually, not too bad
or however else you'd care to characterize. Your feedback will help
me to better understand what you need.
Thanks.
pafalafa-ga
|
Clarification of Question by
mrinquisitive-ga
on
15 Jun 2004 14:49 PDT
Unfortunately, this is a) of no value at all.
To clarify, the URL you provided was an email thread discussing how to
specify a reference to another MIME part in the same email.
The IMG tag must be unique to the email address, it must reference an
image on a web server somewhere, and accessing the URL contained in
the IMG tag must be used to identify the email address associated with
the IMG tag.
For instance, if I were an evil spammer, I?d have a database that
associated IMG tags with email addresses.
Here?s an example: Let?s say that I associate the number 3618461436
with the email address mrfoo@bar.com. Then I send an HTML spam to
mrfoo@bar.com that contains the tag <IMG
src=?http://evil.spammer.com/cash-3618461436-.jpg?>. I might have
apache configured to discard everything between the two ?-?characters
to serve up the cash.jpg image. But whether or not I actually serve
up an image, I have a record that cash-3618461436-.jpg was requested
from the server. Knowing this I know that mrfoo@bar.com opened the
email and that either his HTML enabled email client attempted to
display the image or he opened the HTML in a browser. I then repeat
this process with a large number of email addresses, each one having a
unique serial number or other string associated that I can use to
identify the users foolish enough to view my Spam. In this way I can
harvest a great deal of email addresses that I know both receive email
and can and do read HTML email.
References to this practice are what I?m looking for.
|
Request for Question Clarification by
pafalafa-ga
on
15 Jun 2004 16:50 PDT
Yeah...I knew that link was likely to be in category (a), but I had to
ask anyway...the dialogue helps me to focus my research more
precisely.
I've found some pages that strongly suggest the practice you are
referring to came into use around the year 2000. For instance, have a
look at this link dated April 2001:
http://www.planet-source-code.com/vb/scripts/ShowCode.asp?txtCodeId=6602&lngWId=4
It certainly sounds as if this use of the IMG tag is pretty new, at this point.
Do you have reason to believe the practice stretches back earlier? If
so, anything else you can tell me about what you know re: the history
of this practice, would be a great help in tracking it down further.
Thanks.
pafalafa-ga
|
Clarification of Question by
mrinquisitive-ga
on
15 Jun 2004 18:45 PDT
I recall conversations about this at USENIX LISA conferences going
back to at least 1997 and, I suspect, as far back as 1995. I?m quite
certain the practice was around and in common use by 1997. Articles
about the mechanics of setting such a system up are great, but any
reference to the practice at all would be of potential use.
|
Request for Question Clarification by
pafalafa-ga
on
16 Jun 2004 09:13 PDT
Sheesh! I am not finding ANYTHING on this topic that dates back
before the year 2000.
I'm going to unlock the question so that other researchers can have a
crack at it as well...they may have access to sources I haven't
checked, yet (though I've been through Lexis/Nexis, several
magazine/journal/engineering databases, usenet, and a few others!).
In the mean time, I'd like to ask you a question or two.
-Are you aware of any links dated 1998 or 1999 that discuss this? If
so, please let us know what they are.
--Are there any other terms you can think of that might have been in
use ca. 1997 to refer to this practice?
--Conversely, are there terms you know of that are now in common use,
that wouldn't have been used in 1997 (e.g. was the phrase "email
harvesting" in use back then?).
The answers to these questions would be a big help in fine-tuning some
search strategies that -- thus far -- are striking out when it comes
to finding materials from the long-ago '90s.
pafalafa-ga
|
Clarification of Question by
mrinquisitive-ga
on
16 Jun 2004 11:18 PDT
-Are you aware of any links dated 1998 or 1999 that discuss this?
No.
--Are there any other terms you can think of that might have been in
use ca. 1997 to refer to this practice?
No.
--Conversely, are there terms you know of that are now in common use,
that wouldn't have been used in 1997 (e.g. was the phrase "email
harvesting" in use back then?).
?Spam? was in common use. The phrase ?email harvesting? was probably
not, but it?s not that common today, either. UCE and UBE were not in
use that I know of.
One possible avenue of research would be to search for articles prior
to 1998 with admonitions to disable the displaying of images in HTML
enabled email clients. If you find any they will probably have
explanations of why, which could either be the references I want or
lead to the references I want.
|
