Spam Prevention Early Warning System - Process

Process

The precise process by which SPEWS gathered data about spam sources is unknown to the public, and it is likely that its operators used multiple techniques.

SPEWS seemed to collect some information from honeypots—mail servers or single email addresses to which no legitimate mail is received. These may be dummy addresses which have never sent any email (and therefore could not have requested to be subscribed to any legitimate mailing list). They may also be placed as bait in the header of a Usenet post or on a Web page, where a spammer might discover them and choose to spam them.

The SPEWS Web site makes clear that when spam was received, the operators filed a complaint with the ISP or other site responsible for the spam source. Only if the spam continued after this complaint was the source listed. However, SPEWS is anonymous—when these complaints were sent, they are not marked as being from SPEWS, and the site was not told that ignoring the complaint would result in a listing. This had the effect of determining the ISP's response to a normal user's spam complaint, and also discouraged listwashing—continuing to spam, but with the complaining address removed from the target list.

If the spam did not stop over time, SPEWS increased the size of the address range listed through a process referred to as "escalation". This process was repeated, conceivably until the entire netblock owned by the offending service provider was listed or the block is large enough that the service provider is encouraged to take action by the complaints of its paying customers.