I'm not sure why anybody reasons that BlueFrog acted similar to a DDos attack against spammers and that they somehow deserved to have an actual DDos attack. The BlueFrog client allowed users to submit a message to BlueSecurity's review team. It was reviewed to verify it was spam, then "opt-out" instructions were sent back to the client. If you send out unsolicited mail to hundreds of thousands of users and tens of thousands of them take you up on the message with a request to opt out, that's your problem. The spammers had full control over the amount of opt-out requests they were getting at all times by limiting how much spam they sent out to users who didn't want it. BlueSecurity even went so far as to offer an easy and free way for spammers to filter users who didn't want their messages off their distribution lists.

Wake up spammers - you might have the resources and act like a mob. It's a shame BlueSecurity didn't have the resources to meet you, but somebody will.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11392/33833#33833