|
When I began to receive a multitude of e-mails touting male enhancement
and drugs without prescriptions, I began to study sources and content for
clues about the spammer’s modus operandi. I was surprised to find that
most of the offensive e-mails appeared to have been funneled through the
satx.rr.com domain by splitting the Roadrunner subscriber list alphabetically
so that only a few are sent in each batch (such as ten e-mail addresses
all beginning with the letter “K”). Often, these appeared to have been
forwarded by other satx.rr.com users.
I logged onto the Roadrunner website to find out how to report this
travesty. The Roadrunner site suggested setting up Microsoft Outlook to
place all incoming mail in a separate directory then moving the legitimate
mail to another sub-folder. Evidently, the spammers read this, too, since
this setup did not work very well.
The Roadrunner site also explained how to report a spammer to his/her
domain. Following instructions, I copied the entire message from the Properties/Message
Source box, pasted it into an e-mail and mailed it to abuse@domainname.com
(where domainname is the name of the service, such as hotmail or earthlink
or satx.rr.com.)
I also sent a more detailed response to Roadrunner outlining my suspicions
about the use of their subscriber list. Roadrunner did not respond. Roadrunner’s
customer service has always been second to none—one reason this lapse really
smells, especially after I received another spam, filtered through the
Roadrunner mailing list, advertising—what else? A spam blocker.
Because I had a whole passel of spam mails to report, I spent half an
hour to get my reports off. With about five reports to go, the Roadrunner
SMTP server timed out. I tried several times to send these reports, but
until I moved the remaining messages to a “drafts” folder (so that Outlook
would not try to send them) Outlook would hang up on me when I opened it.
I thought we were having a network or cable modem problem, but after several
unsuccessful attempts to send these messages, I concluded that the Roadrunner
SMTP server blocked them, possibly assuming them to be spam.
My spam reports to other domains weren’t any more encouraging.
I got an automatic response in less than fifteen minutes for almost every
report I sent (the domains created expressly for spamming didn’t respond.)
Earthlink was the first to reply. Here is their (abridged) response:
| Hello,
You are receiving this message in follow-up to a report received by the EarthLink Abuse Department. It would appear from an automated check of your message that the mail you are reporting did not originate from EarthLink or our associated networks. Junk e-mailers will often attempt to hide their true identities behind false e-mail addresses and other types of forgeries. In general, the numeric IP address within the reported mail's headers are a much better indication of the mail's true origins.
This report is being returned to you because there appear to be no numeric IP addresses in the headers of the reported mail that match IP addresses within our network. This means that the mail likely did not originate with us, and therefore we cannot enforce our policies on the junk e-mailer
If, upon review of your mail, you believe that your report should be personally reviewed by an Abuse staff member, please reply to this message. Include this entire text and your original message located below. When resubmitting reports, please include a brief explanation as to why resubmission was necessary. When we receive your resubmission with this message included, we'll investigate the matter and use it to further refine our filters.
Thanks for your report,
EarthLink Abuse Staff
|
I received remarkably similar e-mails (almost verbatim) from several
other domains to which I reported spam abuse. Interesting that Earthlink’s
e-mail contained a link hawking software that made it easy to spam other
people.
My response from Hotmail contained the following paragraphs. I have
removed much of the content for the sake of brevity. An interesting aside
is that the instructions given for copying the header record from the Outlook
Express program were incorrect.
| This is an auto-generated response designed to answer your question as quickly as possible. Please note that you will not receive a reply if you respond directly to this message.
Unfortunately, we cannot take action on the mail you sent us because it does not reference a Hotmail account. Please send us another message that contains the full Hotmail e-mail address and the full e-mail message to:
abuse@hotmail.com
All Hotmail customers have agreed to MSN Website Terms of Use and Notices (TOU) that forbid e-mail abuse. At the bottom of any page in Hotmail, click "Terms of Use" to view the Terms of Use document in its entirety.
Thank you for helping us enforce our TOU.
|
Spammers, I am told, use bogus return e-mail addresses to mask their
real presence, one reason it is so hard to track them down. I plan to purchase
a spam filter (things you pay for up front have fewer strings attached.)
But I wanted to gain an understanding of how spam behaves before relying
on software to do the work. The logical first step was to modify Outlook
Express to design my own spam filters.
I started with the Blocked Senders list. A couple of years ago, I subscribed
to a Yahoo group that purported to link tech writers with prospective employers.
This membership netted me hundreds of ads for jobs in India and recognition
as an out-of-work person by the resume service spammers. For over a year,
I received weekly mails on “how to get a job.”
Whenever such a message showed up, I clicked to select the message and
selected “Block Sender” from the “Message” menu. The mail was deleted and
the sender added to my “Blocked Senders” list. “Block Sender” alone is
not much use, because spammers change their return addresses as often as
we change underwear, but it did help me identify suspicious domains. I
viewed my Blocked Senders list by selecting “Message Rules” from the Tools
menu and selecting “Blocked Senders List”. When my Blocked Senders list
grew to about thirty senders, I detected a pattern in the return addresses.
Almost all the “I can help you get a job if you send money” spams came
from a domain called execs-direct.com. Instead of several individual e-mail
addresses within execs-direct.com, I set up the execs-direct.com domain
as a blocked sender.
A quick way to block a domain is to block the spam sender, open the
Blocked Senders list, modify the most recent entry and remove all text
but the domain name. For example, the blocked sender TheDregs@spambomber.com
can be modified to read spambomber.com, ensuring that you’ll never read
another e-mail from this domain. I do this for any domains that are not
immediately recognizable.
I couldn’t do this with earthlink.com or hotmail.com because I have
friends who use those domains. This is where Message Rules come in. From
the Tools menu, I select “Message Rules” and choose “Mail” from the drop-down
list. On the screen I click “New.” I click the third checkbox that reads
“Where the Message Body Contains Specific Words”. In the “Rule Description”
box at the bottom, my “specific words” rule appears. I clicked the hyper
linked text (“specific words”) to display another screen where I can define
the words or phrases. In the box I type “Viagra” and click “Add”. Then
I continue, typing such words and phrases as “Male Enhancement” and “Prescription
Drugs” and “Meds” “Xanax” and “resume” or double exclamation marks.
When finished adding words, I click “OK”.
I create another identical rule using the checkbox “Where the subject
line contains specific words”. If a spam gets past these filters, I look
for words in the subject line and body that could be added to these rules.
Before I complete this rule, I create a “Spam” folder by right-clicking
“Inbox,” selecting “New Folder” and typing “SPAM.” Now I locate the Message
Rule again, select my new rule and click “Modify.” I modify the rule by
checking the box that says “Move it to the specified folder”. At the bottom
where the words “specified folder” are hyperlinked, I click the link and
select the “SPAM” folder. Now I have a “blacklist” folder. I can
glance over this folder to make sure a friend didn’t get in there by accident,
then either delete the whole bunch or check message properties and sources
to find further domains to block.
In the same manner, I created a folder called “Real Mail” for my “whitelist”
folder. It contains the e-mail addresses of all the people I correspond
with regularly, with one exception: those who are constantly forwarding
“cute” messages. I created a “bulk mail friends” directory for that. I
also have a “Legit Ads” folder for the businesses with whom I have a legitimate
business relationship.
It has been about two months now since I began to deal seriously with my spam. The good news is that some days I get no spam at all. Spam I do receive is usually filed in a folder where I can delete all of it handily. Im tentatively optimistic. Next month, Ill cover some of the remedies suggested for more global control of spam. In the mean time, good sites to visit for down-to-earth info on spam include:
These three sites recently received the best endorsement possible. All three received denial of service virus attacks from spammers.
|