HOME Calendar Join / Renew PC Alamode About Us HELP Sponsors
Reviews Columns Features Theme Issues   Archives Other  

 WhatsUp.Doc

Digging My Way
Out of Spam Purgatory
January 2004


K. Joyce McDonald

Joyce is a senior technical writer for a local software company.

See her web page

I'm getting a lot of response from readers now, the content of which is quite good. If you write, be sure to let me know if I can use the content in an article and if you want me to use your name and/or e-mail address.

When I began to receive a multitude of e-mails touting male enhancement and drugs without prescriptions, I began to study sources and content for clues about the spammer’s modus operandi. I was surprised to find that most of the offensive e-mails appeared to have been funneled through the satx.rr.com domain by splitting the Roadrunner subscriber list alphabetically so that only a few are sent in each batch (such as ten e-mail addresses all beginning with the letter “K”). Often, these appeared to have been forwarded by other satx.rr.com users.

I logged onto the Roadrunner website to find out how to report this travesty. The Roadrunner site suggested setting up Microsoft Outlook to place all incoming mail in a separate directory then moving the legitimate mail to another sub-folder. Evidently, the spammers read this, too, since this setup did not work very well.

The Roadrunner site also explained how to report a spammer to his/her domain. Following instructions, I copied the entire message from the Properties/Message Source box, pasted it into an e-mail and mailed it to abuse@domainname.com (where domainname is the name of the service, such as hotmail or earthlink or satx.rr.com.)

I also sent a more detailed response to Roadrunner outlining my suspicions about the use of their subscriber list. Roadrunner did not respond. Roadrunner’s customer service has always been second to none—one reason this lapse really smells, especially after I received another spam, filtered through the Roadrunner mailing list, advertising—what else? A spam blocker.

Because I had a whole passel of spam mails to report, I spent half an hour to get my reports off. With about five reports to go, the Roadrunner SMTP server timed out. I tried several times to send these reports, but until I moved the remaining messages to a “drafts” folder (so that Outlook would not try to send them) Outlook would hang up on me when I opened it. I thought we were having a network or cable modem problem, but after several unsuccessful attempts to send these messages, I concluded that the Roadrunner SMTP server blocked them, possibly assuming them to be spam.

My spam reports to other domains weren’t any more encouraging.  I got an automatic response in less than fifteen minutes for almost every report I sent (the domains created expressly for spamming didn’t respond.) Earthlink was the first to reply. Here is their (abridged) response:

Hello,

You are receiving this message in follow-up to a report received by the EarthLink Abuse Department. It would appear from an automated check of your message that the mail you are reporting did not originate from EarthLink or our associated networks.  Junk e-mailers will often attempt to hide their true identities behind false e-mail addresses and other types of forgeries.  In general, the numeric IP address within the reported mail's headers are a much better indication of the mail's true origins.

This report is being returned to you because there appear to be no numeric IP addresses in the headers of the reported mail that match IP addresses within our network.  This means that the mail likely did not originate with us, and therefore we cannot enforce our policies on the junk e-mailer…

If, upon review of your mail, you believe that your report should be personally reviewed by an Abuse staff member, please reply to this message. Include this entire text and your original message located below.  When resubmitting reports, please include a brief explanation as to why resubmission was necessary.  When we receive your resubmission with this message included, we'll investigate the matter and use it to further refine our filters.

Thanks for your report,
EarthLink Abuse Staff

I received remarkably similar e-mails (almost verbatim) from several other domains to which I reported spam abuse. Interesting that Earthlink’s e-mail contained a link hawking software that made it easy to spam other people.

My response from Hotmail contained the following paragraphs. I have removed much of the content for the sake of brevity. An interesting aside is that the instructions given for copying the header record from the Outlook Express program were incorrect.

This is an auto-generated response designed to answer your question as quickly as possible. Please note that you will not receive a reply if you respond directly to this message.

Unfortunately, we cannot take action on the mail you sent us because it does not reference a Hotmail account. Please send us another message that contains the full Hotmail e-mail address and the full e-mail message to:
 abuse@hotmail.com …

All Hotmail customers have agreed to MSN Website Terms of Use and Notices (TOU) that forbid e-mail abuse. At the bottom of any page in Hotmail, click "Terms of Use" to view the Terms of Use document in its entirety.

Thank you for helping us enforce our TOU.

Spammers, I am told, use bogus return e-mail addresses to mask their real presence, one reason it is so hard to track them down. I plan to purchase a spam filter (things you pay for up front have fewer strings attached.) But I wanted to gain an understanding of how spam behaves before relying on software to do the work. The logical first step was to modify Outlook Express to design my own spam filters.

I started with the Blocked Senders list. A couple of years ago, I subscribed to a Yahoo group that purported to link tech writers with prospective employers. This membership netted me hundreds of ads for jobs in India and recognition as an out-of-work person by the resume service spammers. For over a year, I received weekly mails on “how to get a job.”

Whenever such a message showed up, I clicked to select the message and selected “Block Sender” from the “Message” menu. The mail was deleted and the sender added to my “Blocked Senders” list. “Block Sender” alone is not much use, because spammers change their return addresses as often as we change underwear, but it did help me identify suspicious domains. I viewed my Blocked Senders list by selecting “Message Rules” from the Tools menu and selecting “Blocked Senders List”. When my Blocked Senders list grew to about thirty senders, I detected a pattern in the return addresses. Almost all the “I can help you get a job if you send money” spams came from a domain called execs-direct.com. Instead of several individual e-mail addresses within execs-direct.com, I set up the execs-direct.com domain as a blocked sender.

A quick way to block a domain is to block the spam sender, open the Blocked Senders list, modify the most recent entry and remove all text but the domain name. For example, the blocked sender TheDregs@spambomber.com can be modified to read spambomber.com, ensuring that you’ll never read another e-mail from this domain. I do this for any domains that are not immediately recognizable.

I couldn’t do this with earthlink.com or hotmail.com because I have friends who use those domains. This is where Message Rules come in. From the Tools menu, I select “Message Rules” and choose “Mail” from the drop-down list. On the screen I click “New.” I click the third checkbox that reads “Where the Message Body Contains Specific Words”. In the “Rule Description” box at the bottom, my “specific words” rule appears. I clicked the hyper linked text (“specific words”) to display another screen where I can define the words or phrases. In the box I type “Viagra” and click “Add”. Then I continue, typing such words and phrases as “Male Enhancement” and “Prescription Drugs” and “Meds” “Xanax” and “resume” or double exclamation marks.  When finished adding words, I click “OK”.

I create another identical rule using the checkbox “Where the subject line contains specific words”. If a spam gets past these filters, I look for words in the subject line and body that could be added to these rules.

Before I complete this rule, I create a “Spam” folder by right-clicking “Inbox,” selecting “New Folder” and typing “SPAM.” Now I locate the Message Rule again, select my new rule and click “Modify.” I modify the rule by checking the box that says “Move it to the specified folder”. At the bottom where the words “specified folder” are hyperlinked, I click the link and select the “SPAM” folder.  Now I have a “blacklist” folder. I can glance over this folder to make sure a friend didn’t get in there by accident, then either delete the whole bunch or check message properties and sources to find further domains to block.

In the same manner, I created a folder called “Real Mail” for my “whitelist” folder. It contains the e-mail addresses of all the people I correspond with regularly, with one exception: those who are constantly forwarding “cute” messages. I created a “bulk mail friends” directory for that. I also have a “Legit Ads” folder for the businesses with whom I have a legitimate business relationship.

It has been about two months now since I began to deal seriously with my spam. The good news is that some days I get no spam at all. Spam I do receive is usually filed in a folder where I can delete all of it handily. I’m tentatively optimistic.  Next month, I’ll cover some of the remedies suggested for more global control of spam. In the mean time, good sites to visit for down-to-earth info on spam include:

These three sites recently received the best endorsement possible. All three received denial of service virus attacks from spammers.
 


Copyright© 1996-2008
Alamo PC Organization, Inc.
San Antonio, TX USA