1. 1 1 Best Practices for End Users Anti-Spam Research Group IETF 56 - San Francisco March 20, 2003 John Morris ftp://67.cdt.org/pub/ietf56-asrg-spamreport.ppt or MAYBE at http://www.ietf.org/proceedings/03mar/

2. 2 New Report on Spam issued Yesterday by CDT “Why Am I Getting All This Spam?” Reports on six months of research Generally aimed at end users Focused on different aspect of problem –How do spammers get my e-mail address? Available in HTML or PDF: –http:\\www.cdt.org\speech\spam\030319spamreport.shtml –http:\\www.cdt.org\speech\spam\030319spamreport.pdf

3. 3 Methodology Created hundreds of single purpose e-mail addresses Placed on Web sites, USENET, Web discussion boards, e-commerce transactions, domain registrations Disguised some addresses: –using words: “example at domain dot com” –using HTML characters: "example@dom&#09 7;in.com" Removed or opted-out some addresses after two weeks Tracked spam for 6 months Ignored spam stemming from dictionary attacks

4. 4 Key Finding: Vast Majority of Spam Scraped from Web Sites

5. 5 Key Finding: Disguising Addresses is VERY Effective Spam received at addresses only displayed using words: ZERO –“example at domain dot com” Spam received at addresses only displayed using HTML characters: ZERO –"exampl e@doma& #105;n.com"

6. 6 Key Finding: Removing Plain Text Addresses from Web Helps

7. 7 Key Finding: USENET was Second Biggest Source of Spam Vast majority of addresses scraped from USENET headers –99+% of USENET spam from headers –Very little spam from body of message Which newsgroup makes a difference –Postings to alt.sex.erotica > lots of spam –Postings to misc.industry.insurance > no spam

8. 8 Key Finding: Where Offered, Web Site Opt-Out Requests Work All tested sites (31 diverse sites) honored opt-out requests if made at e-mail address was first provided Most (but not all) sites promptlyhonored opt-out requests when made two weeks after e-mail address was first provided

9. 9 Key Finding: Web Discussion Forums are Fairly Spam Free Almost no spam to addresses posted in Web based discussion boards, job listing sites, or auction sites. Also, very little spam from WHOIS listing –But, none of the domains were approaching time for renewal

10. 10 Best Practices to Avoid Spam Disguise any e-mail addresses that are listed on web sites Don’t post to USENET using a live address in the header (but okay in body if disguised) Opt out at the time you give your address to a web business (and don’t do business with sites that don’t offer opt-out options) Use multiple or disposable e-mail addresses