A query based on IP has the same problems everyone else has with IP address; it would immediately remove everyone using the same proxy, or who happened to get the same IP from a point of presence, or from a load balancer...
It might just be that a merchant trying to advertise this way and getting a large number of fake charges would start to look like a fraudster and start getting queried by some folks worried about money laundering or fraud. (Why so many orders from <favorite locale that is heavy into illegal drugs>?) Best not to flood the phisher with extra replies lest he be able to recognize that, but if everyone did their best to create plausible orders with phony and suspicious-sounding sources it might make that form of advertising about as popular with merchants as the proverbial cake with lye frosting. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Cardoso Sent: Wednesday, June 14, 2006 3:31 PM To: full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure] Phishing and Spammers A simple SQL query can delete all records from the same IP/machine, if the counter is above 2. Presto, database cleaned. Also the phiser will now that at that address there's someone who knows better. Remove the address from the database and add a newbie clueless address instead. Best-case scenario? Solve our problem and let others deal with it. On Wed, 14 Jun 2006 15:23:05 -0400 "Geo." <[EMAIL PROTECTED]> wrote: G> I would appreciate hearing a little feedback on this idea. G> G> It strikes me that phishers and spammers have a vulnerability that we have G> not yet exploited. They collect information, granted the returns are small G> but since email is cheap they send out tons and those tons net them a G> profitable return. G> G> Why not encourage everyone to reply to phishers and spammers with fake G> information? Get a spam, order it using a fake name and credit information. G> Get a phishing mail, go login to change your ebay/paypal password with G> credentials. G> G> GIGO, you know? I mean if they are getting a 1% or 2% return then if the G> same ratio were to respond with bad information it would make a lot of work G> for the folks profitting from these activities. G> G> Geo. G> G> _______________________________________________ G> Full-Disclosure - We believe in it. G> Charter: http://lists.grok.org.uk/full-disclosure-charter.html G> Hosted and sponsored by Secunia - http://secunia.com/ G> Allgemeinen Anschulterlaubnis Cardoso <[EMAIL PROTECTED]> - SkypeIn: (11) 3711-2466 / (41) 3941-5299 vida digital: http://www.contraditorium.com site pessoal e blog: http://www.carloscardoso.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ********************************************************************** This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you ********************************************************************** _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/