What can you do about SPAM?

Unfortunately to combat SPAM you need to know some technical information about SMTP EMail headers and protocol.

Let's learn about headers. The headers of an EMail message or news post are there to describe information about the message and where it came from. Your EMail program or news reader does not show all the headers to cut down on visual clutter. It is important to checkout these headers in your search for the SPAMmer.

No matter what EMail or News reader you use, it has an option to view the headers. So select the option that makes the hidden headers visible. In Netscape select Options/Show all headers, in Eudora click on BLAH BLAH on the message window, in MSWIN Pegasus press ^H, in Pine press H, in VM press t and in NewsExpress select File/ Options/ Compose/ Include Headers. Other news/EMail readers have similar options.

Important headers are:

• From:
• Sender:
• X-Sender:
• Reply-To:
• Errors-To:
• Return-path:
• Message-id:
• Path:
• Received: Routing info

These are actual emails received from the net. I have hilighted varous areas for discussion and have remove some of my own domains.

This one came from a university.

Received: from Valid Relay Address Withheld (Valid Relay IP Withheld) by Your POP/SMTP Server's Address
 with ESMTP (Eudora Internet Mail Server 1.2); Fri, 13 Feb 1998 12:10:59 -0500
Received: from CSDAlpha2.sbu.ac.uk ([136.148.1.111])
          by Valid Relay Address Withheld (2.0 Build 2119 (Berkeley 8.8.4)/8.8.4) with ESMTP
	  id MAA20191 for <Valid EMail Address Withheld>; Fri, 13 Feb 1998 12:10:45 -0500

From: major@bulk.com
Received: from fire.sbu.ac.uk (fire.sbu.ac.uk [136.148.1.4])
	by CSDAlpha2.sbu.ac.uk (8.8.8/8.8.8) with SMTP id QAA22569;
	Fri, 13 Feb 1998 16:45:18 GMT
Received: from fire.sbu.ac.uk (157.atlanta-05.ga.dial-access.att.net) by
          fire.sbu.ac.uk (MX V4.2 AXP) with SMTP; Fri, 13 Feb 1998 16:37:36 GMT
Received: from major@emailserver.com by Joe Schmoe@schmo.com (8.8.5/8.6.5) with
          SMTP id GAA08857 for <mo@inky.com>; Fri, 13 Feb 1998 11:31:24 -0600
          (EST)
Date: Fri, 13 Feb 98 11:31:24 EST
To: mo@inky.com
Subject: Electricity Deregulation MLM, Reputable Company.
          Pre-launch!!
Message-ID: <ASFAS85858993..@>
Reply-To: major@emailserver.com
Comments: Authenticated sender is
          <major@emailserver.com>

Notice that the Received text before the "standard headers". This is very important because SPAMmers try to confuse you by generating bogus headers. You need to work back from the first one.

Notice, also, that the SPAMmer tried to make you believe that the SPAM came from att.net. It did not

Also, notice that in the bogus headers, there are no IP addresses. You need to spend no time looking at these.

Although the last (first displayed) header is usually correct, do not expect it. Always do a Trace Route.

Copy the IP, in this case 136.148.1.111, to your Trace Route program and verify. In this case it really is CSDAlpha2.sbu.ac.uk. Many times this last IP is a mail server from some unsuspecting ISP that the SPAMmer invaded to send the SPAM. Usually, they have nothing to do with it and even sending courtesy mail to a small ISP could bring them to their knees so treat this domain special. It also could be a relay if you have a lot or addresses .forwarded to single EMail address. This looks like it may be a SPAM ISP. So lets look at the Web. www.sbu.ac.uk is actually South Bank University London. Doesn't sound like a SPAMmer. Looking over all the headers, we can find no trace of a dial-in IP nor another relay. What this means is either the SPAMmer was a student with and account inside the university or he was very good at hiding his identity.

Either way it is time to turn over the hunt to South Bank University London. We find a contact EMail address for the university at the bottom of the page. It is sally@vax.sbu.ac.uk. Now that we have decoded the SPAM, we can take action.

1. We forward the original SPAM with all the headers displayed to abuse@sbu.ac.uk, sally@vax.sbu.ac.uk

This one came from a SPAM ISP but contained information to allow us to report the SPAMmer to his real ISP and to the FTC.

Received: from mailnowmail.com (206.222.113.147) by Your POP/SMTP Server's Address
 with ESMTP (Eudora Internet Mail Server 1.2); Sat, 14 Feb 1998 03:43:48 -0500
Received: by mailnowmail.com (8.8.8/8.8.5) with SMTP id VAA19554;
	Fri, 13 Feb 1998 21:00:16 -0500 (EST)
Date: Fri, 13 Feb 1998 21:00:16 -0500 (EST)
Message-Id: <199802140200.VAA19554@mailnowmail.com>
From: checkmate@mailnowmail.com
To: checkmate@mailnowmail.com
Subject: Is your checkbook safe?

This one was a little more difficult as it came from a smart bulk EMailer and used a SPAM ISP as a relay.

Lets us look at the header. mailnowmail.com is a SPAM IP. It matches 206.222.113.147 according to Trace Route and is handled by a router from e-sales.net. Doesn't sound good. Also, both www.mailnowmail.com and www.e-sales.net do not exist on the web.

This is a case of a SPAMmer using a dedicated mail server. Usually, the only thing you can do here is add mailnowmail.com and e-sales.net to your filter list so future SPAM from them will be routed directly to your mail program's trash. But, in this case, we can fight back.

Looking over the SPAM we look for contact information. In this case we find:

http://www.wimall.com/skyshop/checks.html

or e-mail me at:

Mikef@sbbsonline.com

However, www.sbbsonline.com is a legitemate ISP with an acceptable use policy. They list their contact person as sgordon@sbbs.net, so I have this address to complain to as well as abuse@sbbsonline.com.

Another thing about this SPAM is that the individual may be trying to commit fraud. The FTC has a special SPAM fraud squad and their EMail is uce@ftc.gov.

Now that we have decoded the SPAM, we can take action.

1. We enter mailnowmail.com and e-sales.net into our EMailer's filter-to-trash list.
2. We forward the original SPAM with all the headers displayed to abuse@sbbsonline.com, sgordon@sbbs.net, uce@ftc.gov

This one came from a SPAM ISP but contained information to allow us to report the SPAMmer to the ISP who is providing the SPAMmer with communications. This honest ISP will probably take action.

Received: from apollo.redcomet.net (208.10.252.105) by Your POP/SMTP Server's Address
 with ESMTP (Eudora Internet Mail Server 1.2); Fri, 13 Feb 1998 17:36:08 -0500
Received: by apollo.redcomet.net (8.8.7/8.8.4) with SMTP
	  id RAA26620; Fri, 13 Feb 1998 17:31:18 -0500
From: rnr@dollarmagic.com
Received: from dollarmagic.com by dollarmagic.com (8.8.5/8.6.5) with SMTP id GAA04433 for ; Fri, 13 Feb 1998 15:43:18 -0600 (EST)
Date: Fri, 13 Feb 98 15:43:18 EST
To: ZipTest@aol.com
Subject: I earned $200 my very first day -- FREE information tells how I did it.
Message-ID: <97081701345@dollarmagic.com>
Reply-To: rnr@fireyourboss.nu
X-UIDL: 98020731135799753246804268573475
Comments: Authenticated sender is 

Note that in this case the critical Received headers occur before the "From" header. The rest of the "Received" headers are bogus.

Here 208.10.252.105 is really apollo.redcomet.net and www.redcomet.net doesn't exist so its probably a SPAM ISP.

Doesn't look too good. However, looking at the output of Trace Route we see that apollo.redcomet.net is being routed through compu.net. Upon invesitgation of www.compu.net we find it is an ISP in Paris, TN. It has a contact address of blarson@compu.net.

Now that we have decoded the SPAM, we can take action.

1. We forward the original SPAM with all the headers displayed to abuse@compu.net, blarson@compu.net

This one came from a SPAM ISP but contained information to allow us to determine the major communications carrier, guess at the possible dialup address of the SPAMmer and identified tha SPAM as being something to send to the FTC.

Received: from Valid Relay Address Withheld (Valid Relay IP Withheld) by Your POP/SMTP Server's Address
 with ESMTP (Eudora Internet Mail Server 1.2); Fri, 13 Feb 1998 22:07:55 -0500
Received: from ns3.adult-host.net (mail.net-ops.net [208.235.97.12])
          by Valid Relay Address Withheld (2.0 Build 2119 (Berkeley 8.8.4)/8.8.4) with ESMTP
	  id WAA20836 for <Valid EMail Address Withheld>; Fri, 13 Feb 1998 22:08:04 -0500
From: carguys@mailcity.com
Received: from mail.net-ops.net (1Cust130.tnt13.atl2.da.uu.net [153.36.90.130])
	by ns3.adult-host.net (8.8.7/8.8.7) with SMTP id WAA05324;
	Fri, 13 Feb 1998 22:00:40 -0500
Date: Thu, 12 Feb 98 18:51:11 EST
To: carlovers@usa.com
Subject: UNIQUE AUTO OPPORTUNITY
Message-ID: <>

Checking more of the headers, it looks like the bulk EMailer has wrapped bogus routing, "ns3.adult-host.net (mail.net-ops.net [208.235.97.12])" information around the real routing, "mail.net-ops.net [208.235.97.12]". In this case there is a possibility that the SPAM originated from 153.36.90.130. This IP is 1Cust130.tnt13.atl2.da.uu.net which is an uu.net dialup line.

Additionally the SPAM looked like fraud, we should inform the FTC

Now that we have decoded the SPAM, we can take action.

1. We forward the original SPAM with all the headers displayed to abuse@uu.net,abuse@mci.net,uce@ftc.gov

This one looked really difficult but the SPAM actually came a Compuserve dialup account.

Received: from 199.174.200.173 by Your POP/SMTP Server's Address
 with SMTP (Eudora Internet Mail Server 1.2); Sat, 14 Feb 1998 18:20:31 -0500
From:     
To:       
Subject:  Breakthrough-Latest Bulk Email Software
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Date: Sat, 14 Feb 1998 18:20:31 -0500

What was really funny was that this SPAM was selling bulk EMailers for $495 with the comment: "We have not heard of any person losing a dial up account with this software." Guess again SPAMmer!

Now that we have decoded the SPAM, we can take action but since it is not fraud we do not forward it to the FTC.

1. We forward the original SPAM with all the headers displayed to abuse@compuserve.net

This one looks similar to Case 4 but is actuakky more definitive of SPAM coming from a ATT dialup account.

Received: from internet.roadrunner.com (198.59.109.7) by Your POP/SMTP Server's Address
 with ESMTP (Eudora Internet Mail Server 1.2); Sun, 15 Feb 1998 09:00:14 -0500
Received: from mail.roadrunner.com (201.san-francisco-15.ca.dial-access.att.net [12.64.162.201])
	by internet.roadrunner.com (8.8.5/8.8.5) with SMTP id HAA17927;
	Sun, 15 Feb 1998 07:00:18 -0700 (MST)
From: 88266348@msn.com
Received: from manny.joe.and.larry[(4448.5.33.21)] by 334444@msn.com (8.8.5/8.6.5) with SMTP id GAA05998 for <6663hl73@msn.com>; Sun, 15 Feb 1998 04:01:36 -0600 (EST)
Date: Sun, 15 Feb 98 04:01:36 EST
To: 6663hl73@msn.com
Subject: ALERT - Internet Fraud and Spying
Message-ID: 
Reply-To: 5725fg90@msn.com
X-UIDL: 55555544443856788833487619489034
Comments: Authenticated sender is 

Now that we have decoded the SPAM, we can take action but since it does not seem to be fraud we do not forward it to the FTC.

1. We forward the original SPAM with all the headers displayed to abuse@att.net

This one looks similar to Case 3 but is actually more definitive of SPAM coming from a ATT dialup account.

This one came from a SPAM ISP but contained information to allow us to report the SPAMmer to the ISP who is providing the SPAMmer with communications. This honest ISP will probably take action.

Received: from neztek.com (206.222.113.173) by Your POP/SMTP Server's Address
 with ESMTP (Eudora Internet Mail Server 1.2); Sun, 15 Feb 1998 08:28:41 -0500
Received: by neztek.com (8.8.8/8.8.5) with SMTP id AAA01744;
	Sun, 15 Feb 1998 00:21:40 -0500 (EST)
Date: Sun, 15 Feb 1998 00:21:40 -0500 (EST)
Message-Id: <199802150521.AAA01744@neztek.com>
From: Mak@neztek.com
To: Mak@neztek.com
Subject: PATENT YOUR INVENTIONS!!!

Here 206.222.113.173 is really neztek.com and it is the source of the SPAM. www.neztek.com looks like a typical SPAM ISP.

Doesn't look too good. However, looking at the output of Trace Route we see that neztek.com is being routed through emaildirect.net (another SPAM ISP), e-sales.net (another SPAM ISP) and finally acsi.net a communications provider. This is a case of a SPAMmer using a dedicated mail server. Usually, the only thing you can do here is add neztek.com, emaildirect.net and e-sales.net to your filter list so future SPAM from them will be routed directly to your mail program's trash. Upon invesitgation of acsi.net we find it has a "no SPAM" policy.

Now that we have decoded the SPAM, we can take action.

1. We enter neztek.com, emaildirect.net and e-sales.net into our EMailer's filter-to-trash list.
2. We forward the original SPAM with all the headers displayed to abuse@acsi.net,uce@ftc.gov

This one came from an ISP but does not contain enough information to allow us to report the SPAMmer. But there are thing that we can do.

Received: from md2.vsnl.net.in (202.54.6.20) by Your POP/SMTP Server's Address
 with SMTP (Eudora Internet Mail Server 1.2); Sat, 21 Feb 1998 03:44:04 -0500
Received: by md2.vsnl.net.in; id AA19962; Sat, 21 Feb 1998 14:18:37 +0530
Date: Sat, 21 Feb 1998 14:18:37 +0530
Message-Id: <9802210848.AA19962@md2.vsnl.net.in>
From: nitelifer@yahoo.com
To: nitelifer@yahoo.com
Subject: Cash In!

Here 206.222.113.173 is really neztek.com and it is the source of the SPAM. www.neztek.com looks like a typical SPAM ISP.

This is not the SPAMmer, just an ISP in India. We look further and can finde no other headers to investigate. Doesn't look too good. The SPAMmer broke into the ISP and took over his mail server to send his SPAM. Therefore we need to notify the ISP so he can either protect his site for the future or go through his logs to identify the SPAMmer. Look at the ISP's web site for contact info: elpdesk@giasbm01.vsnl.net.in,abuse@vsnl.net.in

Now what do we do? nitelifer@yahoo.com is probably bogus and since I reported it previously to Yahoo, I will not both this time. Looking down in the text we find a "removal" address of http://142.176.13.105. Performing a Trace Route we find this address' communications provider as canet.ca. Looking further we find http://www.webriches.com/ is the site that is being promoted and is probably the one paying for the SPAM. Again we us Trace Route and find that the communications provider is mci.net.

If we can't find the SPAMmer the we can go after the infrastructure. Most communications providers now have acceptable use policies (see MCI's Anti-SPAM Policy and their other Internet Policies) and will pull the communications pipe away from any site that is involved in SPAM.

Now that we have decoded the SPAM, we can take action and we also forward to the FTC as the SPAM looks like fraud.

1. We forward the original SPAM with all the headers displayed to helpdesk@giasbm01.vsnl.net.in,abuse@vsnl.net.in,abuse@canet.ca,abuse@mci.net,uce@ftc.gov

Received: from [1.1.1.1] by mail.somewherelse.com
 with ESMTP (ABC Mail Server 1.1.1); Mon, 13 Jan 1997 18:29:43 -0500
Message-Id: <v03010d11af0075aea550@[1.1.1.1]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Mon, 13 Jan 1997 18:29:34 -0500
To: you@yourplace.com
From: someone <someone@somewherelse.com>
Reply-To: someone@somewherelse.com
Subject: unwelcomed letter

unwelcomed letter.

someone

SOMEWHERELSE (SOMEWHERELSE-DOM)
   Some Street
   Some Town, Some State, Some Zip

   Domain Name: somewherelse.com

   Administrative Contact:
      One, Some  (SOXXXX) someone@somewherelse.com
      555-555-5555
   Billing Contact:
      One, Some  (SOXXXX) someone@somewherelse2.com
      555-555-5555
   Technical Contact, Zone Contact:
      One, Some  (SOXXXX) someone@somewherelse3.com
      555-555-5555