About spam and Tracing Spam
by Enrico Savazzi
http://esavazzi.pal.uu.se/

www.abuse.net has a lot of information, and a large list of spam-reporting addresses.

spam.abuse.net also has a lot of information, this is their index.

You can read here my introduction on how you can trace spam and report it. 

On this site, [http://esavazzi.pal.uu.se/] I have a collection of false e-mail addresses (at present one and a half million) generated by a little program written by a friend. All addresses are fake (although most of them look undistinguishable from real ones, because this is what the program is designed for). There are many individuals and organisations that use robots to comb the Web and collect e-mail addresses to sell to spammers, or to use for spamming. Adding my fake addresses to their lists pollutes them and makes them much less valuable (they call fake addresses web poison, but a more appropriate name is spammer bait). About 95% of the traffic on my web server consists of robots downloading my address lists on a daily basis. And the lists on my server are refreshed automatically every day with a million and a half new addresses…

Are you curious to know how I generated these e-mail addresses? Do you want to have similar address lists on your site? Here is a readme file about the program, or download the program itself (it runs on Windows 95/98/NT), complete with source code.

Part II Tracing Spam

Where does this spam come from?

How do I report it?

What next?

Let me start first by telling you how not to react to spam.

• Don't reply to the spammer in angry or offensive terms. Most of the time, the spammer is using a forged e-mail address, and your message will simply be returned to you as undeliverable. Therefore, you will be the only one to read your reply.
• Don't spam, nntp-flood, www-flood, syn-flood, etc. the domain of origin. This would turn the administrators against you: remember that you can't do anything against the spammer without their co-operation.
• Some spams carry a post-script saying "if you do not wish to receive further messages from us, send mail to this address with this and this header, or fill in this form on our www site". Too late. By sending you a spam they have already violated netiquette. I never send "unsubscribe" messages and the like. I report all spammers to their ISP's instead. Besides, "unsubscribe" messages most of the time come back as undeliverable. Often, "unsubscribe" messages are logged as a source of confirmed-good e-mail addresses to be used for further spamming.

Here is a brief guide on how to find out where an e-mail message comes from. This applies to all e-mail, not just spam. The following case is a little devious (most instances of spam are easier to track), but you can learn a lot from this example.

Below you can see the beginning of the message, as displayed by your mail program:

It does not say much about its origin, but we can be sure of one thing already: the address 81884948@aol.com is forged (do not try to send mail to this address). How can we tell? Because:

To learn more, tell your mail reader to show all headers. In Eudora, this is done by clicking the "Blah Blah Blah" button:

Now you have a little more information. Remember that you must send a complete copy of a spam message (including all headers) when you report spamming to the administrators of the domain of origin.

The last "Received:" header is usually the one that matters. Normally, it contains the source of the message and the first host mail server which received it. However, in this case the last "Received:" header contains more than two host names, and this means the header has been forged. A valid "Received:" header has the following format:

Received: from host1 (host2 [ww.xx.yy.zz]) by host3 (8.7.5/8.7.3) with SMTP id MAA04298; Thu, 18 Jul 1996 12:18:06 -0600.

Reading from back to front in the forged header, we see the host which added the "Received:" header (host3); the IP address of the incoming SMTP connection (ww.xx.yy.zz); the reverse-DNS lookup of that IP address (host2); and the name the sender used in the SMTP HELO command when it connected (host1).

In such a case, our best bet is the next-to-last "Received:" header. This indicates an IP address of origin within the net-block 208.136.0.0, which belongs to mci.net. We can learn this by doing:

With this information, we can forward our report to MCI. Remember to keep things simple, and do not address the administrator in less-than-polite terms. He is there to help you, and has nothing to do with the spammer. My favourite introduction is:

From the list of reporting addresses in http:\\www.abuse.com, we obtain the address spams@mci.net, and we send our report to this address.

In most cases, you will receive an automated reply saying that your complaint has been received. Sometimes, you will receive a follow-up with specific information about your report. You should neither ask nor expect to receive any personal information on the spammer - remember that your identity is being kept confidential as well. Instead, a follow-up may contain valuable technical information (this is how I collected the information presented in this page). Even if you do not receive any reply, in most cases your report has been read, and the administrator has tried to find the source of the spam and acted against it. Just keep reporting all instances of spam, and you can be sure that several spammers will lose access to their mail servers. Here are, for instance, two messages I received yesterday:

A (very) few ISP's (Internet Service Providers) do not co-operate with users in trying to limit spam. One major ISP, for instance, is knowingly and openly hosting a number of large-volume commercial spammers. If you run into one of these, take the next step in fighting spam: install a filter in your e-mail program to automatically trash all messages which come from their domain. Tell your computer administrator to ban the IP addresses of the offender ISP from the servers of your company/university/ISP. The most effective way to hurt irresponsible ISP's is by denying them access to large portions of the Internet. As soon as customers will realise that their ISP's are banned from reaching a good slice of the Internet, they will bring their user accounts - and money - elsewhere.

This page was last updated November 5, 1997.

(Courtesy of Enrico Savazzi http://esavazzi.pal.uu.se/)