![]() StartingPoints Referenced by
|
Spank A Spammer
Tamsin: I am sure that all of my friends here have experienced the profound irritation that is spam. Therefore, for the general good, I have created this page for sharing tips on dealing with spammers and other netpests, so that we can have more time for the good stuff, such as Sensei's Library. Hu: The following sites are useful:
Tamsin: Thanks for these, but I would like to point out that some of these organisations, apparently, are bogus - I have read warnings about CAUCE (www.cauce.org), for instance. Therefore, caveat utor. For now, I am just beginning to acquire some useful spam-fighting tesuji. Here are some of my recent discoveries and ideas: 1) Disguise your e-mail address when posting to SL and rec.games.go. Use forms such as yourname <at> domain.com rather than yourname@domain.com to thwart "spambots" (programs that harvest e-mail addresses from sites such as this one)[1]. 2) Never reply to spam mail. 3) Never click on "unsubscribe me" buttons. They merely confirm you received the message and invite more spam. 4) Get a spamfiltering program such as K9 to vet your mail before it arrives. K9 uses "Bayesian filtering", which means that it deals with overall content rather than specific keywords (spammers simply keep tweaking their language to get around ordinary filters). K9 starts off stupid but learns quickly what you consider to be "bad" and "good" mail, and deals with it as you wish. 5) Learn to trace the scoundrels. Only yesterday I traced spam mail claiming to be from Europe to a name, address and telephone number in the People's Republic of China. I did not lodge a complaint only because I fear there that the punishment for such behaviour may be rather more severe than it deserves. Anyway, on with the motley: to trace, find out how to display full headers in you e-mail client. Although addresses can be faked, it is impossible to hide the originating IP address. For instance, here is what I found by clicking on "properties" and "details" for a certain "Angela Darby" who sent me a mail offering me a university diploma (silly girl, I have plenty of real university degrees already!): Received: from c66.188.174.222.stc.mn.charter.com (66.188.174.222) by tantalum with smtp (Exim 3.22 #23) id 19dRLy-00030b-00; Fri, 18 Jul 2003 10:16:38 +0100 Received: from 24.124.233.16 by c66.188.174.222.stc.mn.charter.com; Fri, 18 Jul 2003 03:13:55 -0700 Now, the bit that's interesting is the IP number, which appears after the supposed domain name, which is in this case 66.188.174.222. Next you go to ARIN WHOIS on the WWW, and trace it from there. It turns out to originate from Charter Communications in St Louis, USA. If I am feeling mean later, I will be writing a little message to abuse@charter.net detailing all of "Angela Darby's" degree-milling and spamming activities, which I am sure they will be interested to read. Good luck and please share your information here! [1] Lutin: unfortunately, spambots are now far more clever and regognize those patterns (as well as NOSPAM, SPAM, etc.) The solution is rather to craft something on your own (like adding $ in the email and specify at the end to remove them. For instance: myname$@domain.com (remove $ from email). HolIgor: I'd like to say something that you, guys, won't like very much. I never reply to the e-mails with wrong return address. Sometimes when reading the newsgroups I know the answer to the question, I want to help, I type my answer, I press send button and in a second I get the answer. The address is not correct. Immediately my enthusiasm is gone. I don't bother to repeat. I feel very bad, I feel cheated. If you ask for help, please, don't create such situations. They are humiliating. They reek of mistrust. I don't like spam, so I have an hotmail address where all the spam goes. I give my real e-mail only to the people I know or to the organizations I trust. IGS, for example, sends me the records of my games regularly. And I don't have much spam in my mail box. One or two per day. This is not the problem. My hotmail box receives about 20 per day. I don't bother very much. Form time to time I look through it to find out if there were some real e-mails there. unkx80: I agree with HolIgor here, those with wrong return addresses make it real inconvenient, especially for IE users. I have a personal webpage, where I list my official email account on every page in the footer. What I did is almost the same as what is done on SL: I converted all the characters in both the displayed text and the href text into Unicode. Although my personal webpage is listed on Google, I never received any junk emails for a period of time. And people using common browsers can send me legitimate emails by simply clicking on the email link and send me the emails directly. That was all good until someone decided to list my official email in plain text on a separate webpage. Icepick Spam in general, and like the example given above, is usually sent via an open relay. That masks the sender's real address, and pushes the blame on someone else. China/Korea/Far East are the current hot spots for low security computers cracked and used by spammers in the US/Europe. "Angela Darby" is probably some everyday person using a cable modem that has unwittenly opened themselves up to abuse via a trojan. Complaining will fix their problem, and eliminate that relay, but it won't shut down the spammer by any means. Blake: On disguising your email: instead of jrandom<at>user<dot>com, it's best to disguise it with a simple cypher which most people know: ROT13. As far as I know, there are no spambots which decipher this system, and most newsreaders have a function to decode it. It works like this: the letters are shifted forward by 13, looping. ABCDEFGHIJKLMNOPQRSTUVWXYZ NOPQRSTUVWXYZABCDEFGHIJKLM
The address above (jrandom@user.com) would thus be translated wenaqbz@hfre.pbz. If you don't think this is sufficiently transparent, you can note it with ROT13 at the beginning of the address (ROT13wenaqbz@hfre.pbz). This page has further information and links to converters: mgoetze: Since Tamsin asked, I'll at least say what I do myself, which is really extremely simple... I just use SpamAssassin (called from procmail) with pretty much the default values... As for tracing the identities of spammers, don't bother. It's entirely too much effort for an individual, especially when using clumsy tools such as a web-based whois (this is a normal commandline tool on unix boxes), and there are entire organizations devoted to this purpose. Let's just say that the name, address and telephone number you find in the whois information will generally either have nothing whatsoever to do with the spammer or be only loosely connected (e.g. the ISP of the spammer's shell provider, both of whom probably have privacy policies in place which are to the spammer's liking...) Lutin: personnally, I have 3 email addresses: one legitimate that I only give to people I personnally know. One that I subscribe to mailing-lists, and another one I use on Internet (news, web forms, etc.) By doing that way, I can read my personal mail only on holidays and don't bother with mailing-lists, and everything else drop in a quite-spam mail-box that I can check less often. If someone is trying to correspond with me using the "spam" email, I instruct him to use the other legitimate mail instead (or I can create a rule to transfer his email to my normal mail box). Icepick: I have my own domain, so I effectively have infinite addresses, all directed to one e-mail box. Everytime I need to register for something that may eventually spam me, it gets a unique address. IE, if I register at Yahoo, it's yahoo@netfamin.com. If any particular address starts getting too spamy, it gets directed to the trash.
Everything else goes through
Timzog: I heartily recommend
HelcioAlexandre I hope this is not off topic here. There are a new kind of virus that will infect your computer and make it act like a Spammer so that you will became an spammer yourself. The two that I know is SoBigF and AVF but many other will come. More information can be found in this Tamsin: Does anybody know how to make a message rule from message headers? I am being plagued with junk mails from a person called "astatine" which is his handle according to the headers). I need to know how to instruct Outlook Express not to download any messages with the name "astatine" from the server. I can easily filter them out, but it still takes time to download the messages. This is a copy of the living page "Spank A Spammer" at Sensei's Library. ![]() |