Spamikaze is an automated spam block system. Unlike some other spam block systems, Spamikaze does no tests for open proxy or open relay vulnerabilities. Spamikaze is passive and completely driven by mail coming into a system's spamtrap addresses.
Spamikaze is based on the following premises, which appear to be true on the sites where the authors are running Spamikaze:
* Almost all mail received at spamtrap addresses is spam.
* Almost all spam is sent from IP addresses that are not mail servers, so no legitimate email is lost by blocking those.
* Open relays and easy to detect open proxies are being abandoned by spammers (due to the traditional blocklists), in favor of virus infected Windows machines with hard to detect spam trojans.
* The chance of somebody else receiving a spam before you is very high, since you're only one of over a million recipients.
* If users (or mail servers) warn each other from which IP addresses
spam is flowing, spam can be blocked before it is delivered to most
recipients.
* Spammers have to send out millions of emails to make a profit;
spammers cannot be profitable without sending out bulk email.
* Since spammers have millions of addresses on their lists, it's
going to be economically impossible for them to find out which addresses
belong to real users and which belong to spamtraps.
* If implemented properly, an anti-spam solution should be able to
use the numbers against spammers, turning the tables against those
who send unsollicited bulk email.
Currently, Spamikaze works roughly as follows:
* A spamtrap receives an email (most probably spam).
* The passivetrap script figures out which IP address delivered the
email to the spamtrap's email server.
* The IP address gets added to the local Spamikaze blocklist, unless the IP address is whitelisted (eg. a known mail server).
* Spamikaze notifies other Spamikaze systems of the spamtrap event
(future functionality, not currently implemented).
* The local mail server will reject mail from the IP address that
sent mail into the spam trap.
* After a configurable number of days the IP address is automatically
dropped from the blocklist.
* Alternatively, somebody removes the IP address from the list using
the web interface. This happens in the rare cases where the spam comes
from an actual mail server that also wants to send legitimate mail
to a mail server protected by the local Spamikaze list.
* If a new spamtrap hit happens from the same IP address, the timeout
is extended, or the IP address is listed again.
The end effect should be that IP addresses that only send you
spam stay on the list for long times (blocking all spam), while
IP addresses from which legitimate mail comes only get blocked
for short periods (so spam is blocked, but you don't miss out
on the legitimate email).
