🚀 go-pugleaf

In article <19971225005716483328@svr08-p02.ppp.umb.edu>,
revilak@umbsky.cc.umb.edu (Steve Revilak) wrote:

> Shamona and Lara (Swami's Assistants) <swami@australia.net.au> wrote:
> 
> > Phew! I was getting sick of spam, and a few people suggested Spam Blaster,
> > so I downloaded it. I tried to install it, and it said I needed Open
> > Transport...................
> 
> I deal with it the old fashioned way....
> 
>         You can forge a return path--but you can't forge the 'paper
> trail' contained within the header.
> 
>         * Don't reply.  You've just confirmed that fact that your
> address is vaild, and that there is a living, breathing human being on
> the receiving end.
> 
>         * Have your mail program display the full header.  Look for
> lines near the top which read 'received by'.  Your domain will be in the
> first one.
> 
>         * Go to the bottom "received by" field. Therein lies the domain
> name of the originating host.

No.  _Never_ start from the chronologically first (bottom) "Received by"
header.  It's probably forged.  It probably doesn't contain the domain
name of the originating host.  Even worse, it probably contains the domain
name of a host owned by someone the spammer dislikes...

Instead:

Go to the first (chronologically most recent) "Received by" header.  If it
shows your mail host (or your ISP's), you can probably trust it.  Make
note of the system that sent the mail to your or your provider's system.

Then go to the next "Received by" header (the second most recent one,
second-down from the top).  Does it match the info in the previous
header?  If not, it could be a forgery.  Does it show full IP address info
for the system that gave it the message?  If not, it indicates this system
is misconfigured, and subject to abuse as the injection point or relay.

Repeat with each subsequent "Received by" header, working backwards along
the path the message took, stopping when you find an inconsistency or a
lack of information for verifying subsequent headers.  The last good
"Received by" header should show the actual insertion point (or
misconfigured relay) of the spam.  Use traceroute to discover the upstream
providers of the insertion point, and send your complaints to them. 
Complain also to the postmaster or domain contacts at the insertion point,
if it looks like the insertion point was a victim of relay-rape.

All headers below the inconsistency are likely forged.  The only reason
the forged headers (such as "Received by", "From:", "Reply-To:", etc.) are
included is to cause complaints to shower down upon people and domains the
spammer dislikes, instead of the spammer's domain and upstream provider.

In summary, start from the most recent "Received by" header, work your way
back in time until you find the beginning of the forgery, and stop there. 
Don't bother to complain to the victims the spammer is trying to cause you
to complain to.  Complain instead to the upstream of the injection point,
and perhaps the inection point itself if you think they might listen.  Get
the spammer.


>         Also, look through the body, to see if the spammer requests an
> e-mail reply to some other address.  Mail a copy of said spam to 'abuse,
> postmaster, and support' at the domain he/she is attempting to use as a
> 'drop-box'.
> 

Complain as well to the admins of systems providing web sites advertised
via spam.

If you receive a response from the owners/admins of the system being used
as a drop-box that says "our customer didn't spam from our domain, so we
can't cut them off", politely inform them that their policies are
lacking.  Providing spam support services is as bad as providing spam. 
Spammers don't spam unless they have a safe back-channel for suckers to
reach them on.  Sites that provide such drop-boxes/back-channels are
subject to the same IDP sorts of penalties that spam origination sites
suffer.

If you find such a site, mention it in a post to
news.admin.net-abuse.email.  That way others will be aprised of the
possible rogue status of the spam support service provider.

Followups redirected to a more appropriate newsgroup.


Richard

-- 
To reply via email, make sure you don't enter the whirlpool on river left.