There must be a way to block this spammer ..
.. but it looks like they've invested so much effort in getting through the filters that I'm having to resort to low level source code analysis to find anything I can hook a rule onto. It's literally become almost like trying to develop an HIV vaccine.
Nothing about these emails is constant. They've figured out a way to generate dynamic DNS for the IP their SMTP server is on, and the IP and the named address both rotate rapidly, like every week or even more frequently. They're also generating several paragraphs of filter poison in a text block that's hidden in the HTML, and all the actual ad content is contained in remotely served images (which among other things gives them loggable ad presentations they can then bill the client for, so if you're unlucky enough to be reading email on a client that doesn't let you turn off remote image loading, you're generating micropayments for them if you so much as view the message, and a side benefit is that you can't filter by message content because the only text the filter sees is the filter poison). And they even rotate the company name (and possibly the mailing address) in their identification/opt-out link so they stay below the radar with people who try and web search them as spammers.
I'd have to post the entire raw source of one of these monstrosities with comments to show just how well they've covered their tracks. They are absolutely bloody serious about getting into your inbox no matter what measures you've taken to block them -- you can block them for a little while, but they start getting through again as soon as they rotate their named address and server IP. As far as I can tell, literally the only thing you can do is click the opt-out link -- which confirms your email address and maybe these messages stop, but you're then playing whack-a-mole with the secondary spammers who just got your address as a confirmed live one.
As far as technical measures go, it's looking like some form of efficient image OCR is going to be the only real recourse. Stopping this type of spam would require whole new levels of scripting, with image OCR to decode the actual payload content and some means of dynamic blackhole listing of the dynamic DNS and IP of the sender, with a response time in the range of a few minutes on widely distributed honeypot machines. It's almost but not quite to the level of something requiring genuine AI.
It's hard to explain why I find this whole thing so profoundly offensive. To me, it's the equivalent of someone parking a truck with a thousand-watt PA system in front of my house and playing nonstop advertisements at paint-peeling volume until I agree to give them my name and phone number to get them to stop, knowing that the moment I do so, the phone will start ringing off the hook with telemarketing cold calls. These people are truly that kind of slime, and there is no appealing to them on any kind of ethical or social grounds. They break in wherever they think they can get away with it, rules be damned, etiquette be damned, and their only response to technical measures set up to stop them is to batter them down or circumvent them, and they have the sheer unmitigated gall to pretend that you really want to hear or see their useless noise because their desire to get into your head and try to make you want whatever they're selling trumps any desire you might have to be left alone to make your own choices.
For reasons I don't have particularly good words to explain, the sheer thoughtlessness and, yes, sociopathy of that mentality almost literally nauseates me. This is the aspect of my species that disgusts me beyond all others. And this is only one example of it, and I dread the next generation of invasive marketing -- imagine smart AI's that befriend you online and engage you in conversation, and then drop hints here and there about brand names and products, and possibly stalk you once they fail the Turing test. I don't doubt for a second that that will happen the moment it's technically feasible. Nor do I doubt for a moment that direct brain-computer interfaces, if they ever become feasible, will almost immediately be hacked with attempts to trigger strong emotional attractions to certain brand names or products. I was really wanting that tech when I was younger, but realizing how invasive and pervasive this behavior is, I don't want it anymore. Yes, spam and other forms of invasive marketing may well make a Luddite of me.
But back to the problem of how to kill this particular one .. :/
Nothing about these emails is constant. They've figured out a way to generate dynamic DNS for the IP their SMTP server is on, and the IP and the named address both rotate rapidly, like every week or even more frequently. They're also generating several paragraphs of filter poison in a text block that's hidden in the HTML, and all the actual ad content is contained in remotely served images (which among other things gives them loggable ad presentations they can then bill the client for, so if you're unlucky enough to be reading email on a client that doesn't let you turn off remote image loading, you're generating micropayments for them if you so much as view the message, and a side benefit is that you can't filter by message content because the only text the filter sees is the filter poison). And they even rotate the company name (and possibly the mailing address) in their identification/opt-out link so they stay below the radar with people who try and web search them as spammers.
I'd have to post the entire raw source of one of these monstrosities with comments to show just how well they've covered their tracks. They are absolutely bloody serious about getting into your inbox no matter what measures you've taken to block them -- you can block them for a little while, but they start getting through again as soon as they rotate their named address and server IP. As far as I can tell, literally the only thing you can do is click the opt-out link -- which confirms your email address and maybe these messages stop, but you're then playing whack-a-mole with the secondary spammers who just got your address as a confirmed live one.
As far as technical measures go, it's looking like some form of efficient image OCR is going to be the only real recourse. Stopping this type of spam would require whole new levels of scripting, with image OCR to decode the actual payload content and some means of dynamic blackhole listing of the dynamic DNS and IP of the sender, with a response time in the range of a few minutes on widely distributed honeypot machines. It's almost but not quite to the level of something requiring genuine AI.
It's hard to explain why I find this whole thing so profoundly offensive. To me, it's the equivalent of someone parking a truck with a thousand-watt PA system in front of my house and playing nonstop advertisements at paint-peeling volume until I agree to give them my name and phone number to get them to stop, knowing that the moment I do so, the phone will start ringing off the hook with telemarketing cold calls. These people are truly that kind of slime, and there is no appealing to them on any kind of ethical or social grounds. They break in wherever they think they can get away with it, rules be damned, etiquette be damned, and their only response to technical measures set up to stop them is to batter them down or circumvent them, and they have the sheer unmitigated gall to pretend that you really want to hear or see their useless noise because their desire to get into your head and try to make you want whatever they're selling trumps any desire you might have to be left alone to make your own choices.
For reasons I don't have particularly good words to explain, the sheer thoughtlessness and, yes, sociopathy of that mentality almost literally nauseates me. This is the aspect of my species that disgusts me beyond all others. And this is only one example of it, and I dread the next generation of invasive marketing -- imagine smart AI's that befriend you online and engage you in conversation, and then drop hints here and there about brand names and products, and possibly stalk you once they fail the Turing test. I don't doubt for a second that that will happen the moment it's technically feasible. Nor do I doubt for a moment that direct brain-computer interfaces, if they ever become feasible, will almost immediately be hacked with attempts to trigger strong emotional attractions to certain brand names or products. I was really wanting that tech when I was younger, but realizing how invasive and pervasive this behavior is, I don't want it anymore. Yes, spam and other forms of invasive marketing may well make a Luddite of me.
But back to the problem of how to kill this particular one .. :/