Reporting Spam
   
(Sent Saturday, 06 December 2003)
 

        I don't know if any one bothers to report spammers--I do sporadically, especially those who insult my intelligence with Subject: lines implying that they're replying to a message from me or the like.

        A tool that I've found helpful in knowing who to complain to is the database at whois.abuse.net.  I'm sure they also have a web site but I find the CLI whois client more convenient.  Try http://www.abuse.net or some variant of it.  The more of us who take the time, even intermittently, to report spam, the better in my oppinion.

        I assume that y'all know that the From and From: lines are useless because they've likely been forged.  The real info is to be found in the Received: lines which are visible if you ask your mailer to display full headers.  My ISP has been including only a few Received: lines lately--sometimes only one (plus the one that my system adds when it fetchs mail from the server).

        From that received line you'll find information in parentheses that is what you want to look at.  Within those parentheses you'll also find an IP number in square brackets.  I like to use "dig -x <IP_Number>" to verify that the domain in the parens is correct.

        Then I use "whois -h whois.abuse.net <domain>" to see if there's a good abuse address available and complain to that.  If there's no good abuse address available (as evidenced by the tag "(default, no info)" after the suggested e-mail address), then I usually use the bw whois client (software written by Bill Weinman) to see who owns the domain.  That may require trimming off the early parts of the host.domain to get useful information.  If any of y'all are interested, see http://whois.bw.org/ for more information.

        If I'm really pi$$ed, I'll also sometimes to a traceroute on the domain or the IP number to get the domain of one or more upstream sites through which it passed and complain to them as well using abuse.net to get the abuse address of that upstream provider.

        I frequently do that with some of the hard-core spammers who are better at hiding their identity in the headers than I am at digging it out or with some of the spam-haven ISPs out there.

        As I said, I do this only sporadically--it's very time consuming-- but figure that every little bit helps.  And, yes, I know that spammers just get a new account somewhere else.  But just think if enough of use reported spammers what may happen...

        Well sorry to blather on.  I hate spam and wish more people would take the time and trouble to report at least some of them.


        Back to Index Page