@Annalivia, no I had to prove it can be done, and it is being done, because it is a different approach. Furthermore where did I ever mention that ISP's are doing nothing? I specifically stated the "anti-spam" vendors, NOT ISP's or even ESP's are doing very little to "SPAMMERS", not spam, because you have people behind one and digital electrons in a certain encoding format in another. . BIG DIFFERENCE between people and electrons, right. Let's be honest, read the latest "ISP's EAT YOUR SPAM POST" . It confirms everything to my point. In the future please read the post, and don't put out of context words into my mouth as you wouldn't want me to do that to you. I've worked for two ISP/ESP's and consulted with 4 more in the 500-1 million user range, so I know the environment pretty well.

@Been there done that, *sarcasm coming* yes it isn't technologically easy to mine through billions of e-mails, blacklist all the URLs, use those URLs to track botnets or spam supporting networks, attribute the URL and thousands of others to the same person, host , redirect, click-through target, then capture all of that data and attribute the bots being used to the URL's being sent and who they belong to (business intelligence and data mining with some simple whois and data caputre, even when forged). Nope totally impossible to do that…I mean who'd ever think up such a thing.

All of this is in a forensic database which FBI/DoJ can easily log into and use the spam sample, forensic testimony, screen-shots of the sites with context matched to the malicious message and then a subpoena of course to search the credit card owners premises, their financial records, and who they've been paying for botnet time and spam sale commissions.

I WORKED IN A SPAM RING, THAT'S EXACTLY HOW IT WORKS, even when multiple parties are doing the spamming, botnet harvesting, domain registration, hosting, and laundering the payment methods through another shell company to even make it look legit.

So if you have the data, system to easily match it, and attribute it to a person seamlessly plus your Deputy Assistant Director in IC at FBI can convince Congress to fund going after these people then YES, it can all be done and will be done. However if you ruin the spammers, no one in the industry will want to support you because they thrive on more spam being sent, it's how they're making money. What would happen to police if all crime dropped by 80 percent?

Tracking spammers, IDing botnets, IDing command and control, linking real world IDs with bot herders… that's some fairly specialized work. In some cases it requires international law enforcement involvement. The ISPs can't do this because it's often out of their jurisdiction and the costs are extensive. Law enforcement can't always do it for the same reason.

Look, many of the botnets, while infecting US computers, are actually run by criminal gangs in foreign countries responsible for botnets. It's neither easy nor cheap to track them down. It's also not always easy to make them stop just by suing them or arresting them. Look at Al Ralsky, he's lost court cases, he's been convicted of fraud previously, and yet he was still able to spam with impunity for almost 10 years. Same thing with Sanford Wallace. He was one of the first spammers sued by an ISP (ELN, back in the late 90's), and just lost a court case a couple months ago brought by Facebook.

Identifying and suing spammers isn't as effective as you make it sound like it is.

Where you get the idea that ISPs are doing nothing about spam, and that they’re doing it because they want to spend money (what money??) on new toys is a puzzlement. It certainly doesn’t jibe with my experience in the industry.

If directed towards me, it was a comment and question in regards to high spam levels, lack of focus on spammers causing high spam levels, and I mentioned it wasn't a product pitch or solicitation in the second sentence but can be performed (proving a point then asking why it isn't the focus to solving the problem Mick pointed out).

FYI, I just found this blog/resource, it's great for anti-spammers, e-forensics, and of course marketing consultants, who should also be protected.

I hope that clears up any shameless plug accusations?

Thanks Al/Readers,

Tom