🚀 go-pugleaf

In article <19971225005716483328@svr08-p02.ppp.umb.edu>,
revilak@umbsky.cc.umb.edu (Steve Revilak) wrote:

> Shamona and Lara (Swami's Assistants) <swami@australia.net.au> wrote:
> 
> > Phew! I was getting sick of spam, and a few people suggested Spam Blaster,
> > so I downloaded it. I tried to install it, and it said I needed Open
> > Transport...................
> 
> I deal with it the old fashioned way....
> 
>         You can forge a return path--but you can't forge the 'paper
> trail' contained within the header.
> 
>         * Don't reply.  You've just confirmed that fact that your
> address is vaild, and that there is a living, breathing human being on
> the receiving end.
> 
>         * Have your mail program display the full header.  Look for
> lines near the top which read 'received by'.  Your domain will be in the
> first one.
> 
>         * Go to the bottom "received by" field. Therein lies the domain
> name of the originating host.

No.  _Never_ start from the chronologically first (bottom) "Received by"
header.  It's probably forged.  It probably doesn't contain the domain
name of the originating host.  Even worse, it probably contains the domain
name of a host owned by someone the spammer dislikes...

Instead:

Go to the first (chronologically most recent) "Received by" header.  If it
shows your mail host (or your ISP's), you can probably trust it.  Make
note of the system that sent the mail to your or your provider's system.

Then go to the next "Received by" header (the second most recent one,
second-down from the top).  Does it match the info in the previous
header?  If not, it could be a forgery.  Does it show full IP address info
for the system that gave it the message?  If not, it indicates this system
is misconfigured, and subject to abuse as the injection point or relay.

Repeat with each subsequent "Received by" header, working backwards along
the path the message took, stopping when you find an inconsistency or a
lack of information for verifying subsequent headers.  The last good
"Received by" header should show the actual insertion point (or
misconfigured relay) of the spam.  Use traceroute to discover the upstream
providers of the insertion point, and send your complaints to them. 
Complain also to the postmaster or domain contacts at the insertion point,
if it looks like the insertion point was a victim of relay-rape.

All headers below the inconsistency are likely forged.  The only reason
the forged headers (such as "Received by", "From:", "Reply-To:", etc.) are
included is to cause complaints to shower down upon people and domains the
spammer dislikes, instead of the spammer's domain and upstream provider.

In summary, start from the most recent "Received by" header, work your way
back in time until you find the beginning of the forgery, and stop there. 
Don't bother to complain to the victims the spammer is trying to cause you
to complain to.  Complain instead to the upstream of the injection point,
and perhaps the inection point itself if you think they might listen.  Get
the spammer.


>         Also, look through the body, to see if the spammer requests an
> e-mail reply to some other address.  Mail a copy of said spam to 'abuse,
> postmaster, and support' at the domain he/she is attempting to use as a
> 'drop-box'.
> 

Complain as well to the admins of systems providing web sites advertised
via spam.

If you receive a response from the owners/admins of the system being used
as a drop-box that says "our customer didn't spam from our domain, so we
can't cut them off", politely inform them that their policies are
lacking.  Providing spam support services is as bad as providing spam. 
Spammers don't spam unless they have a safe back-channel for suckers to
reach them on.  Sites that provide such drop-boxes/back-channels are
subject to the same IDP sorts of penalties that spam origination sites
suffer.

If you find such a site, mention it in a post to
news.admin.net-abuse.email.  That way others will be aprised of the
possible rogue status of the spam support service provider.

Followups redirected to a more appropriate newsgroup.


Richard

-- 
To reply via email, make sure you don't enter the whirlpool on river left.

In article <swami-2512971246010001@ip158.ans.com.au>,
swami@australia.net.au (Shamona and Lara (Swami's Assistants)) wrote:

|Phew! I was getting sick of spam, and a few people suggested Spam Blaster,
|so I downloaded it. I tried to install it, and it said I needed Open
|Transport. So I downloaded Open Transport and it says I need to upgrade my
|system (from 7.5) to System 7.5.5, so I downloaded that and it says I've
|got to upgrade to system 7.5.3 first. And I can't find the upgrade from
|7.5 to 7.5.3! Argh! Is there an easier way to do this? (I'd still like to
|upgrade my system to 7.5.5, even if I can't use Spam Blaster).

First off, don't try to use _Spam Blaster_. I was initially a beta-tester
and _SB_ had many problems that were never resolved. More importantly,
_Goo Software_, makers of _Spam Blaster_, has closed its doors due to
supposed legal action over their use of the name _Blaster_. So, at least
for the time being, _Spam Blaster_ is an "orphan".

The good news is that the upgrade from O/S 7.5->7.5.3->7.5.5 is FREE! What
you need are the updaters from the Apple Support Site. As I recall you
must first go to 7.5.3 and then to 7.5.5. If you need further help please
conytact me "straight away". 


g'day

-- 
To reach us by email remove one "c" from "ccruzio.com". Our Web URL is: http://www2.cruzio.com/~sbken

In article <sbken-2812971257390001@mbay109.cruzio.com>, sbken@ccruzio.com
(Ken and Jen) wrote:

> First off, don't try to use _Spam Blaster_. I was initially a beta-tester
> and _SB_ had many problems that were never resolved. More importantly,
> _Goo Software_, makers of _Spam Blaster_, has closed its doors due to
> supposed legal action over their use of the name _Blaster_. So, at least
> for the time being, _Spam Blaster_ is an "orphan".

I cannot figure this one out - the people at Goo sent me a press release
for spam-news whining about the closure ... did it never occur to them to
merely CHANGE THE NAME OF THE SOFTWARE???? Totally bizarre situation, IMHO.

-- 
SPAM@MAIL-ME.COM | SPAMmer Kills: 70
Web: <http://www-fofa.concordia.ca/spam>
Concordia U. Anti-SPAM resources (procmail, sendmail, etc.):
<http://alcor.concordia.ca/nonalcor/email/concordia_antispam.html>
NEWS ALERTS: Send "subscribe spam-news" in the body to: majordomo@concordia.ca
ARCHIVES:
<http://www.reference.com/cgi-bin/pn/listarch?list=spam-news@concordia.ca>
PGP PUBLIC KEY BLOCK <http://www-fofa.concordia.ca/spam/keys.html#anchor439243>

In article <spam-ya02408000R0301981458400001@newsflash.concordia.ca>,
spam@mail-me.com (SPAM) wrote:

> In article <sbken-2812971257390001@mbay109.cruzio.com>, sbken@ccruzio.com
> (Ken and Jen) wrote:
> 
> > First off, don't try to use _Spam Blaster_. I was initially a beta-tester
> > and _SB_ had many problems that were never resolved. More importantly,
> > _Goo Software_, makers of _Spam Blaster_, has closed its doors due to
> > supposed legal action over their use of the name _Blaster_. So, at least
> > for the time being, _Spam Blaster_ is an "orphan".
> 
> I cannot figure this one out - the people at Goo sent me a press release
> for spam-news whining about the closure ... did it never occur to them to
> merely CHANGE THE NAME OF THE SOFTWARE???? Totally bizarre situation, IMHO.
> 


It costs money to change a product name.  It seems that Goo was on thin
enough of a shoestring that they couldn't make that work.

Fighting the (IMHO totally unwarranted) trademark-barratry initiated by
Creative Labs, of course, would almost certainly have taken even more
money.


Richard

-- 
To reply via email, make sure you don't enter the whirlpool on river left.