Re: Junk mail/ phone calls [was: Re: QUEST ONLINE]

From: graham@DELETETHISaffordable-leather.co.uk

Date: Fri, 06 Oct 2000 00:00:00 +0000

Hi There,

On 5 Oct 2000 23:09:08 GMT, lindahl@pbm.com (Greg Lindahl) wrote:

>> I'm with all of the above and the amount of junk mail  I've got since
>> doing so has dropped to virtually nil and junk phone calls have ceased
>> completely!
>
>Um, what about junk Email? That's what was the problem...

If you had read a bit more carefully you'd have noticed that the
message I was responding to said:

<Quote>

>What I DON'T like is unsolicited mail from credit card firms, banks
><snip> or British Telecom phoning me to try to sell me services
>That's what I call real unethical business practices,

Which is why I posted what I did.

However, for your information....

* * * * *

Firstly, always use a spamblock when posting to a newsgroup, for
instance when I post in a newsgroup my address is
graham@DELETETHISaffordable-leather.co.uk. Any spam program that
sniffs it out doesn't know to delete the irrelevant part, so it works
in 99% of cases.

Next look to see if  your mail server have a "block sender" option.
Some allow you to set up filters which means that messages from a
specified source name (eg spammer@spam.com) will automatically be sent
straight to the trash file or not even downloaded.

Alternatively, here's a document which gives information on how to
find out where a spam came from. It was from an ISP called Netcom, but
it applies more or less across the board.

Your mail reader has a feature "show all headers" or something similar
which will give you the information you need about the actual details
for the spammer, then complain to the originating ISP and the one next
"up the line", since if the originator doesn't care about it, the one
it goes out via almost certainly *does* object to being used to
transport this rubbish and will stop it going through their system!

Generally what I do is write an e-mail, including *all* the header
information and text from the original (just cut and paste the entire
thing into a new message) and send a copy to "abuse@ispname.com" which
works in most cases.

The file below shows how to identify the correct info from the
misleading stuff that some spammers include to try to hide their
traces.

* * * * *

We have looked at the headers of the message you have forwarded to us,
and determined that it didn't originate from a user here at NETCOM.

While there may be a NETCOM account name listed somewhere in the
message, those accounts are forged and don't exist.

Please do not try to email the accounts mentioned in the email, as
they probably do not exist.

Also, please keep in mind, that in the headers, DFW-IX*.IX.NETCOM.COM
is our mail-relay server. These servers cannot originate mail, they
can in some instances relay mail. However, the received-by or
received-from line below the DFW line must be the originator, no
matter how forged it appears to be.

We do have software installed on our servers to prevent mail relaying,
however, very small quantities of relay spam do slip through
sometimes. Literally thousands of attempted relays are blocked every
day.  To see a daily log of these attemps visit the newsgroup:

news.admin.net-abuse.bulletins.

** Please note the following.

Spammers on the internet will guess at your email address. If it's
easy to guess at, ie "sam@domain.com" you will get 'probe' emails.
They usually state "Reply with REMOVE in the subject line to get off
this list." If you follow their instructions, YOU WILL NOT BE REMOVED.
Usually instead they take your now VERIFIED email address and sell it
off to a premium mailing list, making money. At that point the spam in
your mailbox usually will increase by a large amount. We highly
recommend not replying to any spam you receive, and we also recommend
that your email address be something unique, not being found in a
dictionary helps.

Please also realize the importance of contacting the original domain
when you receive spam. It's impossible for them to know it's happening
until someone forwards them a complaint. If everyone were to ignore
spam, the originating domain would never know it's happening.

The only time you should contact NETCOM in regards to spam is if you
determine it originated from NETCOM. If you determine it originated
elsewhere, it's important you contact that domain.

-> Here is the web site you can lookup various IP's at, to get the
contact information for the domain your searching for.

http://whois.arin.net/whois/arinwhois.html

Simply enter the first three quadrents of the IP. For example, instead
of 255.0.93.1, you would enter 255.0.93 without an ending period.

How do you find the originating IP? Here is a tutorial we have
included below.

This is an example of spam originating from Netcom, even though it
does not have the word 'netcom' anywhere in the headers.  This is
intended as an instruction to people who do not already know how to
read headers.

**     If you know how to read headers, please disregard the rest of
this  **        message.

This is an EXAMPLE of junk mail headers. Please do not send to any of
the domains referenced. The IP numbers have been changed except the
ones referencing Netcom.

** These are not the headers to the spam you sent us in your
complaint.

Beginning of header.

Received: from server1.fake (server1.fake [266.0.93.1])
        by server2.fake (8.8.5/8.8.5) with ESMTP id VAA13218
        for <>; Thu, 1 Nov 1961 21:11:53 -0600 (CST)
Received: from internet.abc (server.internet.abc [266.32.0.4]) by
        server1.fake (8.8.7) with ESMTP id VAA06062 for <>;
        Thu, 1 Nov 1961 21:11:53 -0600 (CST)
Received: from 432BRxr9q ([205.184.139.163])
        by internet.abc (8.8.7/8.8.6) with SMTP id VAA16385;
        Thu, 1 Nov 1961 21:54:25 -0500 (EST)
From: Nowhere@Nothere
Received: from login_0246.whynot.spam (mx.whynot.spam[206.0.231.0]) by
        whynot.spam (8.8.5/8.7.3) with SMTP id XAA02135 for <>;
          Sat, 13 January 1961 01:51:22 -0700 (EDT)
Date: 05 Nov 10 10:07:12 PM
Message-ID: <anything>
To: friends@mine
Subject: Generic junk mail example
Content-Type: text

End of header.

Let's start reading this from the top. Your mail server sits somewhere
in the server2.fake domain. Let's see where your mail server received
it from.

Received: from server1.fake (server1.fake [266.0.93.1])
        by server2.fake (8.8.5/8.8.5) with ESMTP id VAA13218
        for <>; Thu, 1 Nov 1961 21:11:53 -0600 (CST)

You received it from server1 [266.0.93.1]. Always go by the IP number
in brackets or parenthesis. Where did server1 receive it from?

Received: from internet.abc (server.internet.abc [266.32.0.4]) by
        server1.fake (8.8.7) with ESMTP id VAA06062 for <>;
        Thu, 1 Nov 1961 21:11:53 -0600 (CST)

This means that server1 received it from [266.32.0.4], there are tools
on the web that will help you verify the name associated with the IP
number.

http://whois.arin.net/whois/arinwhois.html ; Enter in the first three
numbers of the IP. For example, enter 266.32.0 (If that doesn't bring
anything up, try 266.32).

Let's keep going down and see if this IP was the originator or
if it was relayed through them.

Received: from 432BRxr9q ([205.184.139.163])
        by internet.abc (8.8.7/8.8.6) with SMTP id VAA16385;
        Thu, 6 Nov 1997 21:54:25 -0500 (EST)

This means that it was relayed through internet.abc! It came from
205.184.139.163.

Now we go to one of our tools to find the name associated
to that IP number.

I use arins web site on 205.184.139.163, but I take out the 163 at the
end. It tells me that it originated from NETCOM.

Let's go down one more time to see if this is the originator, or if it
was relayed through netcom also.

Received: from login_0246.whynot.spam (mx.whynot.spam[206.0.231.0]) by
        whynot.spam (8.8.5/8.7.3) with SMTP id XAA02135 for <>;
          Sat, 01 January 1914 01:51:22 -0700 (EDT)

If this was a valid Received line, it would show received by
netcom.com. Since it doesn't this is a FORGED header.

In this example above (NOT in your complaint): It originated at
[205.184.139.163] which is from NETCOM. It was relayed through
[266.32.0.4] which was internet.abc.

Remember, always go by the IP addresses in brackets or parenthesis.
Never go by the From line, Reply-To line, Authenticated Sender line,
or the name of the domain in the parenthesis.

* * * * *
Cheers,
Graham.

References

Junk mail/ phone calls [was: Re: QUEST ONLINE]
graham@DELETETHISaffordable-leather.co.uk
Thu, 05 Oct 2000 00:00:00 +0000
Re: Junk mail/ phone calls [was: Re: QUEST ONLINE]
lindahl@pbm.com (Greg Lindahl)
Thu, 05 Oct 2000 00:00:00 +0000

Referenced By

Junk mail/ phone calls [was: Re: QUEST ONLINE]
graham@DELETETHISaffordable-leather.co.uk
Thu, 05 Oct 2000 00:00:00 +0000
Re: Junk mail/ phone calls [was: Re: QUEST ONLINE]
lindahl@pbm.com (Greg Lindahl)
Thu, 05 Oct 2000 00:00:00 +0000