Fights Spam
on the Internet
You are Visitor #
Nobody likes junk mail, well almost nobody!
It is a responsibility all of us must accept and devote some time to. At the
Blue Moon we try to protect our customers from receiving scads of UCE. SPAM
Mail is becoming big business and SPAM vendors are using ever more
sophisticated methods of jamming that unwanted mail into your mailbox. In order
to be able to surf the net relatively unmolested by this increasing
nuisance, you, the customer, need to be armed with the knowledge necessary to
discourage the purveyors of SPAM from dropping further unwanted junk mail into
your E-Mail box.
We go to great lengths and spend many hours per week working on our spam filters
so that mail you want gets to you and the mail you don't want disappears silently.
Our spam filtering is very sophisticated and we have been developing it in-house
for over 5 years.
You can check a list of known contact addresses for many domains
Here which
can be useful for reporting abuses to the correct place without playing email
tag :)
Check Here for
information on viewing the full headers of email sent to you.
Most SPAM has a forged "From:" address. This means you CANNOT reply to that
address, the mail just bounces right back to your box markes as "Undeliverable."
Many times a novice spammer will still leave clues as to where their unwanted
message originated from. Many mail clients have an option to display a "full
header" or "rich header" which shows the mail server relay path the mail has
taken to reach your mailbox. I use "pine" to read mail from the shell account
rather than use a PPP connection with a POP client. Pine has an "h" command
to turn full header display on. In Netscape you can view the "source" to the
current message from the "View" menu. This will sometimes display more
information from the header. Many EMail clients have a "full header" or "rich
header" option to display more about the origin of the mail, contact the
EMail client's support staff if you can't find it in yours. If that feature
isn't available in the client you use now we recommend changing EMail programs.
Our mail server (net.bluemoon.net) will leave its mail signature in the header
of the mail as we are final relay before it lands in your box. One of the ways
spammers try to hide their identity is by relaying mail through several servers,
most of which they have no right to use. Some call this "hijacking" mail servers
to do their dirty work. A more recent tactic of the spammers is to use viruses
(no, viri and virii are not the plural of virus) to infect as many people's
computers as possible and then hijack them to send out spam. It is my belief
that most of the new viruses are specifically designed for sending spam.
When I receive SPAM I examine the header to see what servers the mail came from.
I then forward the spam mail to "abuse@" and "postmaster@" whatever domain sent
or relayed the email. The topmost "Received: from" header will show the
last IP address and hostname of the computer which sent the mail to our
mail server, that's the offender we are interested in and not the visible
"From:" line of the email as that was almost surely a forgery.
If I receive no reply from either address or the mail bounces back to me as
undeliverable I will add the relay domain or ip address to one of the SPAM
filters, whichever one is most appropriate, which should deny any further mail
of that type or from the offending network. If something smells fishy to me I
will do host lookups on the entire class C (/24) address block of the offending
server and if it turns out to be a "Spamhaus" operation I will block all
the domain names listed and the IP address block from sending us email. I have
found literally tens of thousands of spam domains and address blocks this
way and usually find 100 to 1000 new ones every week.
This can be sticky business. You don't want to cut large groups
of people off from being able to correspond with their friends. That would
defeat the purpose of the internet! Obviously filtering all mail from aol.com
is not practical (and that's one of the reasons many spammers forge the
"From:" line as being from some_spammer@aol.com) and would prevent a huge
number of people from corresponding with each other. I can't cut them off, BUT,
I can bounce copies of that mail to postmaster@aol.com and abuse@aol.com. Of
course AOL is notorious for ignoring spam complaints, but that is another
subject.
If they only relayed the mail through AOL's mail servers then AOL has a
responsibility to do everything reasonable to prevent the spammers from
hijacking their mail servers for spamming. If someone manages to relay spam
through our mail server I sure want to know about it and you can bet I'll
beat my brains out until I find a way to prevent that method from being used
again. If someone from our domain spams people on the net you can bet they
won't have access to our network ever again. We have terminated both personal
account and business account holders for spamming and I'm sure we'll be forced
to do that again.
Back to what you can do.
Send a copy of the spam to postmaster@ and abuse@ the domains you received it
from. If you don't get a reply that the problem will be looked into (many
sites have auto-responders for abuse@ and postmaster@) after 24 hours or so then
consider using the Spam Reporting feature at
http://www.spamcop.net/ which is also a great place to learn more about
fighting spam. If it appears to be some chronic spammer then by all means
drop some mail to SpamReport -AT- bluemoon.net with a copy of the spam
mail including the FULL headers. We'll look into it and if the domain is a
spam factory we'll block it as many ways as we can. I believe it is the duty
of each of our network's clients to notify every admin of every domain and
backbone network used to convey that unwanted spam mail to our mailboxes.
Please do not send SPAM mail directly to our staff without first trying to
resolve the issue yourself. We just don't have the time to chase down every
spammer there's too much spam to fight!
We also cannot do anything about
spam mail forwarded to us which does not include all of the header information
showing which servers forwarded it to us. Any email program worth its salt has
the option to "show full headers" or "show all headers" which provides the
nesessary information for tracking. Due to the volume of junk mail out there
we are not able to reply to forwarded spam which does not originate on our
network, but if the full header is included we will look into it.
Check Here for
information on viewing the full headers of email sent to you.
Two powerful tools you can use to trace the path of responsibility are
"whois"
and
"traceroute" which is called "tracert" on win95/98 machines. The whois service
will report the contact email addresses and domain servers used for the
domain in question. Traceroute will show each connection used to reach a host
on the internet. Another neat trick is using telnet to open a session to
a mail host for a domain on port 25 which is the SMTP mail port and using the
VRFY command to attempt to verify a valid email request. Many servers won't let
you do that anymore, we don't allow it on our mail server and went to some
trouble to hack the server code to block it. If "VRFY username" doesn't
work, just close the connection or type QUIT to have their server close the
connection. This isn't illegal, don't worry, it's just talking directly to a
mail server in the language of SMTP.
Here is the raw header of some spam mail I received recently: