Some Personal Spam Trivia

I run my own mail server for my domain. Volumes are low enough that
running a greylist (blocking all the drive-by spammers) gets rid of
90% of the crap.

As for the rest, I had set up lists of blocked senders and recipients
(addresses I have declared invalid on my domain) in Postfix. Then, a
few months ago, I decided I would like to collect statistics on how
often these list entries are hit, and I couldn’t be bothered to scan
logfiles to do it.

So a few months ago I implemented a “socketmap server”
<https://www.postfix.org/socketmap_table.5.html> which responds to
lookup requests from Postfix for those lists, gets the information
from back-end database tables in MariaDB, and also logs entries in
other database tables to record the requests.

This makes it easy for me to add/remove entries in those blocklists,
without having to restart Postfix (or my socketmap server). And I can
pull back statistics on database lookups at any time.

The first thing I’ve noticed so far, the most commonly-used rejection
entry in the blocked-sender table is the one that refuses mail from
the entire “.shop” TLD. I have never done any business with any site
with such a domain; has anybody else done so? My feeling is, no
reputable business has such a site.

As for blocked recipients, I am fond of giving out different recipient
addresses to different online forums and businesses and anybody else
who needs to contact me. This way, I can spot immediately if an
address I gave to one entity starts being used for mail coming from an
entirely different entity.

One or two online sites were too trusting in their early days about
letting web scrapers glean email addresses from their user pages. I
did later go in and enter new addresses on these sites, and invalidate
the old ones, and they haven’t repeated the same mistake. But one of
those old addresses keeps popping up, in some interestingly-corrupted
forms.

The address I originally entered took the form “from-«forum»@«domain”.
I still get attempts to send mail to that (now invalid) address, but
also to “u003cfrom-«forum»@«domain”. And more recently also to
“cfrom-«forum»@«domain” -- addresses which I have never used anywhere.

That “u003c” looks like a corruption of “U+003C”, which would be how
you would write the Unicode code point for the “<” character (which is
of course commonly used to delimit email addresses and URLs and such).
I suspect the “cfrom” version is a further corruption of the
“u003cfrom” one.

I also get email sent to an address I haven’t used since my Apple
Macintosh days, which would have been over a quarter century ago.

I guess this goes to show that the spammers’ address lists can only
grow over time, they can never remove any address as the lists are
passed on, just in case it is still valid, because by the nature of
their business they can never pay any attention to bounces that are
supposed to indicate invalid addresses.

And that passing on of lists introduces its own corruptions, as well.

I wonder how big the spammers’ email lists are these days? I have this
feeling the number of entries in typical lists might have exceeded the
entire population of the Earth by now ...