Fred looks at DirectMail


This came from a page promoting a mass mailer program called "DirectMail." This is a typical "SPAMware" program that people use to send out SPAM. There were enough falsehoods and general mis-information in it, that I felt the need to correct it. The people who write and publish SPAMware like to re- assure their users that using their products won't cause their ISP to nuke their accounts. Well that isn't exactly the case, but SPAMmers tend to be a stupid and gullible, so they probably take such exhortations at face value.


Right To The Point!

Once you've created your email message in your mind, your going to need a professional emailing product to compose and deliver it. We know your looking for a bullet-proof solution to deliver your commercial email message to the world. We know you certainly don't want to waste time reading manuals and learning multiple configuration settings. That's why the Earthonline development team created DirectMail. Quite simply, it is the easiest to use direct email product to fit your needs.

Try It Out - Risk Free!

Here at Earthonline, we want you to be happy with your investment! So we provide a fully functional evaluation version within the downloaded full version of DirectMail. Try it for ten days. Once your satisfied that our product performs to your liking, call us up to place your order - or register online with the 30Second Registration wizard. DirectMail is a streamlined solution to your direct emailing needs.

Benefits

Virtually No Undeliverables in your InBox!

Since you are "Delivering" (not sending) each and every message, DirectMail knows immediately if a message is "Undeliverable". It then adds the undeliverable email to the FAILED text file. However, because some ISP's do not shut down email accounts immediately after users have moved to a new service, you will occasionally get a few undeliverables, but 95 percent are taken care of before they are even sent!


Verifies each email as it sends.

As DirectMail is mailing out, it verifies each email sent using several methods. Testing has shown that this can guarantee up to 99% of the email addresses in your SUCCESS.TXT file as valid addresses.


Does Not Use Your ISP's EMail Server

This is the most common way you are tracked when sending out Commercial Email.

DirectMail does not use your ISP's Server. It acts as its own Mail Server! DirectMail sends email messages directly to your recipients Mail Server, thus circumventing any traces in your ISP's Mail Server Log.

DirectMail is one the newer types of SPAMware that doesn't require an SMTP server to relay through, (either the ISP's own server or one the SPAMmer attacked elsewhere on the net) so they are correct in stating that a mass mail attack won't be reflected their ISP's own server logs. But DirectMail can do little to hide the identity of the originating ISP.


Your ISP Cannot Cancel Your Messages.

With other commercial email software on the market, you simply send all of your targeted messages to your ISP's Mail Server at one time. It then takes days for that mail to be processed, queued, and finally delivered. It is in this time frame that your ISP can simply disable your account and delete most of your email!

Direct Mail is setup to run differently. The software Delivers each and every message right before your eyes direct to the recipient, with no queues, and no deleting.

You are not "Abusing" your ISP's services

The simple truth is that you ARE abusing your ISP's services, massmail attacks consume bandwidth which all ISP's have in limited quantity. The abuse comes in form of denying bandwidth to legitimate clients on the ISP's network.

One of the main reasons ISP's will disconnect or refuse you service is that you are sending such an abundance of email through "their" server. Mass commercial email puts a strain on their system and can affect other users when sending or receiving email.

Again, DirectMail Does Not use your ISP's Mail Server. You are simply sending the messages yourself direct to the recipient. What about "bandwidth usage abuse", you ask? Not an issue. DirectMail uses about as much bandwidth as your Web browser while surfing the Internet.

Massmail attacks DO consume bandwidth which hurts legitimate users even if the ISP's own servers aren't involved.


Anti-Blocking Technology

DirectMail has incorporated Anti-Blocking technology. This feature makes it extremely difficult for ISP's or Online Services such as AOL to block you from sending messages.

Interesting in that they don't tell you how their "anti-blocking" technology works. Most SPAMware allows the user to forge domain names in the header of their SPAMs. So many SPAMmers forge legitimate domain names in their headers to get around domain filtering that is widely used on the net. Domain filtering isn't very useful these days because SPAMmers just forge them. But many sites use IP filtering and SPAMmers can't forge those. If a mail server refuses to talk to certain IP's, the SPAMmer can do little about it. A SPAMmer can't assume any IP because it won't route, so the SPAMmer is only limited to IP's that his/her ISP can route and if those networks are blackholed by a mail server, the SPAM won't get through. Let's say there is a SPAM friendly ISP that cares little about what their clients do. That ISP will have one or more network blocks assigned, let's say 16 class C blocks such as 202.124.138.0/15. So to stop the SPAM coming from there, we filter all class C networks 0/15 from 202.124.138 land. That eliminates the SPAM from that ISP, but it also prevents legitimate email exchanges as well. When legitimate clients of that ISP start complaining that their email is blocked, they'll get with the program and start nuking SPAMmers to get other sites to stop blackholing them.


No Mail Server!

There is no place for you to enter your Mail Server from your ISP. DirectMail acts as its own Mail Server. It will look up each address in your list, find its mail server, then contact that mail server, and send the message. It's that easy.


Extremely Difficult to Trace

Normally, when someone wishes to complain to your ISP about your commercial message they simply look in the header of the message to find your SMTP server. How do they find your SMTP server? They look for a line in the headers that look like: dialup0111.netcom.com [204.144.127.103]. Once they find this, they simply write to abuse@netcom.com and complain.

DirectMail makes this much more difficult for any ISP to track, here's how: Your ISP uses Dynamic IP addresses that change each time you dial up. That is the number in brackets above. There are few people that can find out who your ISP is when given only this number. Most people need more information such as the dialup string preceding the number - that is why DirectMail deletes it. We cannot delete the Dynamic IP address because this is added to the header by the recipient's server. Be aware that about 5% of the Internet's Mail Servers do what is called a "Reverse Lookup" at the time they accept your mail to find out "who is calling" and this information will not be deleted, but 1 out of 20 isn't bad! Please also note that this IS NOT program specific, and NO OTHER PROGRAM OUT THERE will make these "traces" disappear.

Actually DirectMail and it's cousins like RapidFire make tracking the SPAMmer down EASIER. When you look at the header of a SPAM, the first IP address shown in the header indicates the IP of the machine that your ISP's mail server actually exchanged with. If the SPAMmer is using DirectMail or a similar program, it will usually be a dial-up port of the SPAMmers ISP. Most ISP's have their dial-ups DNS bound, so the SPAMmer will forge the header to either delete the bound hostname of the dial-up they are using or forge a bogus hostname to fool the recipient into thinking the SPAM originated elsewhere. But they can't forge the IP address and an IP address is ALL you need to track the SPAMmer down. So using the example above, a SPAMmer using the Netcom dial-up dialup0111.netcom.com [204.144.127.103] will forge the header so it reads mail.tweety-bird.net [204.144.127.103] thinking that anybody who complains about the SPAM will fire off a complaint to the sysadmins at tweety-bird.net. (if such a domain even exists, many of forged hostnames are totally bogus) The publishers of DirectMail would have you believe that it takes a rocket scientist to track down a SPAMmer based on an IP address alone. A simple DNS lookup on the offending IP will usually show the true bound hostname of that IP. If the IP is unbound and many are, it's still no big deal. You can use a tool like Sam Spade and sweep that the entire network block (204.144.127.0/255) for bound hostnames or do a WHOIS lookup for the network block 204.144.127.0 and see who the block belongs to. All active IP blocks are mapped to someone because DNS requires the name of the authoritative name server for each network block. A WHOIS lookup may not show the actual party using those network blocks, but it will show who is upstream of it. A certain party might choose their upstream provider for DNS, so the IP's will be mapped to them rather than the offending party. So if tweety-bird.net uses MCI as their provider and uses MCI for DNS, the IP's will be mapped to MCI. But MCI will know what IP's they have given tweety-bird to use, so if MCI gets SPAM complaints about SPAMs originating from certain IP's and these IP's were given to tweety-bird, they put the heat on tweety-bird to shut the SPAMmers down.

DirectMail makes identifying the sender a hassle for the ISP - The first thing your ISP is going to do when he receives a complaint is look in his Mail Server logs for traces of your email messages. Because DirectMail delivers it's own mail, there will be no TRACE of you or your email. Most Internet Service Providers will cease their search there. Barring any true dedication and determination to stop your solicitations the ISP will halt any further investigation into the alleged commercial mailing. ;)

Totally wrong!! If an ISP get SPAM complaints where the ISP was forwarded copies of the SPAM with complete header info, it doesn't take the proverbial rocket scientist to tell if the ISP's OWN mailserver was involved in the massmail attack. Most ISP's are fully aware that massmail attacks originating from their network will NOT involve their own SMTP server.

NOTE: Dialup Log. This server application is used to log the time, date and IP address of everyone that called in. This was widely used back in the days of the BBS. Dialup Log is not used much anymore do to the massive space requirements of the log file. Only a small number of ISP's use this anymore, and they are usually the smaller ISP's. However, unless they have the exact time and date that you were logged on to trace you, finding you and your message is virtually impossible.

Wrong again!! Nearly ALL ISP's do log their PPP sessions, the space requirements are actually fairly modest and besides mass storage is pretty cheap these days. ISP's may purge their PPP sessions logs after 90 days, but most keep them long enough to sucessfully identify any party that might have used a PPP session to mount a SPAM attack. No ISP wants to play host to a SPAMmer, to do so only means the ISP runs the chance of being blackholed on the net and left unable to provide full net services to legitimate clients. Consequently most ISP's will nuke any account that is complained over. So SPAMmers have resorted to "throwaway" accounts, they'll set up an account using an alias, SPAM like hell from it and when it gets shut down, they'll start a new throwaway account using a different alias.




Portions © 1998 Earthonline Corporation
All Rights Reserved by Fred Findling 1998 as provided for
under the "fair use" doctrine by current Copyright law.
Fred Findling has no relationship with Earthonline Corporation,
but is only offering commentary on said company's products and/or
services.

Return to Innovative's SPAM page