Blue Security anti-spam community target of large-scale spam attack

Tuesday, May 2, 2006

Beginning Monday morning, many BlueFrog and Blue Security users began receiving an email warning them that if they did not remove their email addresses from the Blue Security registry, they would begin to receive huge amounts of unsolicited email. As quickly as four hours after the initial warning message, some users began to receive an unprecedented amount of spam. Most of the messages were simply useless text. Users reported that Blue Security’s website was unavailable or extremely slow in responding.

Blue Security is an online community dedicated to fighting spam. As they became more popular, their member list increased substantially. The members’ email address is encrypted and added to a list of e-mail addresses that wish to stop receiving spam. Blue Security maintains the encrypted list, which uses an encrypted hash function. Spammers are encouraged to remove all addressed from their email list that are also in Blue Security’s Do Not Intrude Registry by using free compliance tools available at Blue Security’s web site.

According to Blue Security’s web site, “A major spammer had started spamming our members with discouraging messages in an attempt to demoralize our community. This spammer is using mailing lists he already owns that may contain addresses of some community members.” Reportedly, Blue Security has received complaints from users about spam allegedly sent from Blue Security promoting their anti-spam solution and web site.

Blue Security states they are “an anti-spam company determined to fight spam and as such never has and never will send unsolicited email.” There are also reports of non-users of BlueSecurity/BlueFrog receiving the warning emails, which now seems is also being sent to email addresses of people who have never added their email address to Blue Security’s Do Not Intrude Registry.