Archive for the ‘spam’ Category

Do not use xinetd to create an obscure port for SMTP

Monday, February 27th, 2012

Years ago I created a simple xinetd rule to use a custom port for SMTP.

I set this up  years ago when my local ISP started to block outbound SMTP connections on port 25 as an anti-spam measure. I had been using our web server for SMTP relay for several years before this because this same ISP had quite poor uptime in the past. When my ISP blocked port 25, my email stopped going out. I could either switch to the ISPs mail servers, or find another way to get my mail to our web server.

I can’t recall the exact reasoning, IIRC, the ISP also required that you use an email address from their domain in either the from or reply-to lines. Whatever the reasons, I created a custom port to route email through our server to continue to bypass our ISP’s email system altogether.

I chose an unused, non-standard, low TCP port and set up the redirect in xinetd. Sendmail, our SMTP server, was previously configured to  relay for specific IP addresses, I didn’t change that.

That was at least 5 years ago. It was a simpler time and spammers stuck to searching on default ports for open email relays.

Well, today I can confirm that spammers will do a port scan to find open email relays – surely there are better ways to make money that come up with crazy ways to send a bit of spam?

I learned that I had created an open relay on a non-standard port by accident. When an inbound connection is relayed by xinetd to a different port number (at least the way I did it) the service has no idea what is the real  remote IP address. Sendmail thought it was relaying for email from localhost! Argh.

Unfortunately, for a few hours today our web server was relaying spam for some Brazil IP address and advertising something or other in Portuguese. The old relay rule was turned off as soon as I traced the hole.

 

SPAM Registrations to a Blog?

Wednesday, May 25th, 2011

This blog started getting hundreds of automated new user registrations per day, starting a few days ago.  I’m not entirely sure what the point of that would be, nor, do I have any idea why now, after several years of this blogs existence, these are showing up now.

Anyway, skipping to the point of this post: If a spammer used your email address to create an account on this blog, we’re sorry.  No one at Perceptus had anything to do with it.

We’re playing around with the well reviewed SABRE plugin for WordPress to try and stop this annoyance.  Fingers crossed.

Shaw email SPAM filters for shaw.ca addresses are mediocre

Monday, January 24th, 2011

 

Shaw SPAM filter catches a lot of false positives.

Shaw SPAM filter catches a lot of false positives.

I have mentioned my disdain for Shaw’s email at least once on this blog.

Today, I’ll write a bit on Shaw’s mediocre spam filter.

We manage a fully legitimate, opt-in email newsletter for a local retail chain. This client has a large (relative to the business size) email newsletter list.  The vast majority of the email subscribers reside in the trade radiuses of their stores in the GVRD, Kelowna, Victoria, and Calgary.

By a slim margin over hotmail.com, shaw.ca email is the most popular email domain in these areas, at about 25% of email addresses on the list. The list subscribers is heavily female; however, I doubt that this affects the ratio of  email providers by very much.

The point is that for a BC or Alberta merchant, your email newsletter effectiveness is highly dependent on Shaw’s hit and miss SPAM filter.  We have a test shaw.ca email account, and subscribed to dozens of opt-in newsletters.  For months we have built up an archive of all the items flagged as SPAM. And we’ve seen many, many,  false positives.  See the thumbnail at the right.  Everything that I’ve highlighted in yellow is a false positive, in other words, they should not have been flagged as SPAM.

The Bay, Beyond the Rack, indulgeliving.com: Your emails are being flagged very frequently as SPAM at Shaw.  I didn’t count, but well over 50% of your emails are being SPAM binned at Shaw.  Many other firms get caught, though, less frequently.

Unfortunately, I don’t have any real secrets to sell you on consistently getting deliverability into the Shaw Inbox.  We have tried a dozen different changes in how our client’s e-newsletter is delivered to Shaw, and the results have been somewhat positive, but definitely not 100% successful.  Even the much touted Sender Score Certification did not work.

In brief, since this post could go on for pages and pages:

  • Email users – I do not recommend ever using your ISP’s free email accounts.  They really don’t care as much as the firms that specialize in email.  I would not trust that commercial email that I need, such as an invoice or receipt, would get to my shaw.ca inbox.  I strongly recommend any of the big 3 webmail providers instead.
  • Email marketers – if BC and Alberta are important to you, watch your open rates by domain.  You might find that some email hosts do not like you very much.
  • Shaw – if you happen to stumble on this, could you please just outsource the whole email system to someone who cares?  Cut a deal with Google or Hotmail and split the advertising revenues and be done with it.  You know, and I know, that email isn’t a profit centre for you, so it will never be as good as the webmail specialists.

Note: I have written about Shaw here; however, I can tell from the email open rates, that Telus email SPAM filters are also quite finicky; however, I do not have a telus.net email address to  use for testing this theory.

 

FidoListens.ca? Who are you?

Friday, July 3rd, 2009

I care about email security and transparency of email content a lot.  I deal with it all the time as a contractor who produces a email newsletters for local retailers.  I’m also the guy who teaches end users (including family) to be extremely skeptical about all the email they receive because 90% of it is fake, SPAM, and scams.

So, I get peeved when larger firms do email communications wrong.

Today I received an email invite from a company claiming to do work for Fido.  I think it’s cringe-worthy.

My first step in my research was a quick glance at the Fido homepage – no mention of a new survey program, though, I didn’t really expect to find one.

Looking strictly at the email itself then, here are some tidbits:

Subject line:  Invitation to Join the Fido Listens Panel

OK so far.

From: Fido Listens Team <fidolistens@itracks.com>

Who is iTracks.com? I’ve certainly never heard of them.  Definitely a yellow caution flag.

The email copy talks about a survey and some prizes for participating in Fido’s latest customer feedback thing.

A lot of scams offer prizes or financial incentives.   Can you get two yellow caution flags?  Or maybe just upgrade to a larger one.

The survey link goes to  https://surveys.itracks.com/survey/RogersFido_4?ID=xxxxxxx.

Well,  iTracks.com hosts the survey.  Their homepage looks legitimate at least.  Funny, I was expecting iTracks.com to be an online MP3 store.

And a support email address of support@fidolistens.ca.

Wait, now what is fidolistens.ca? More on Fido Listens later on.

And a contact mail address of Ipsos Reid, a well respected research firm based in Vancouver.

Ah! I’ve heard of them. Actually, I know people who have worked there. Of course, anyone can write an email with someone else’s legitimate mail address.

So, let’s review. Yes, I am a Fido cellphone user.  But who is iTracks.com?  Do I really believe that they got my email address from Fido? Who is FidoListens.ca?  And is IPSOS really involved?

fidolistens.ca?  At least this was somewhat comforting.  The vanity domain of fidolistens.ca forwards to https://iaf.ipsos.ca…, i.e. a page belonging to IPSOS and transparently hosted by them on their own domain.

In the end, I feel comfortable doing a survey that is hosted by IPSOS.  But that’s only because I know that IPSOS Reid is a legitimate firm.  A little over a year ago I ranted about another Fido survey attempt in my blog post, How to Properly Use 3rd Party Web Services, I didn’t feel comfortable with the firm conducting that survey.

If you are using a 3rd party firm for surveys or anything that is customer related, please make it easy to verify that it’s legitimate.  At Papaya Polls, we offer to host our pages under your own subdomain.  It works great and it is very confidence inspiring.  I would have zero hesitation in doing a survey which had a web address of http://fidolistens.fido.ca or http://surveys.fido.ca.

Anyway, enough ranting.  Time to enjoy the sun.