Tracing spam  

Let me start first by telling you how not to react to spam.

• Don't reply to the spammer in angry or offensive terms. Most of the time, the spammer is using a forged e-mail address, and your message will simply be returned to you as undeliverable. Therefore, you will be the only one to read your reply.
• Don't spam, nntp-flood, www-flood, syn-flood, etc. the domain of origin. This would turn the administrators against you: remember that you can't do anything against the spammer without their co-operation.
• Some spams carry a post-script saying "if you do not wish to receive further messages from us, send mail to this address with this and this header, or fill in this form on our www site". These "unsubscribe" messages often come back as undeliverable. Frequently, "unsubscribe" messages are logged as a source of confirmed-good e-mail addresses to be used for further spamming. In either case, opting-out takes time, and even if it works, for every list you opt-out of you are likely to be opted-in automatically to twenty others, now that they know that someone reads e-mail sent at your address.
• At present I recommend reporting spam that clearly proposes activities violating the law, and to filter automatically all other spam (see my recommendations).

Here is a brief guide on how to find out where an e-mail message comes from. This applies to all e-mail, not just spam. The following case is a little devious (most instances of spam are easier to track), but you can learn a lot from this example.

Below you can see the beginning of the message, as displayed by your mail program:

It does not say much about its origin, but we can be sure of one thing already: the address 81884948@aol.com is forged (do not try to send mail to this address). How can we tell? Because:

To learn more, tell your mail reader to show all headers. In Eudora, this is done by clicking the "Blah Blah Blah" button:

Now you have a little more information. Remember that you must send a complete copy of a spam message (including all headers) when you report spamming to the administrators of the domain of origin.

The last "Received:" header is usually the one that matters. Normally, it contains the source of the message and the first host mail server which received it. However, in this case the last "Received:" header contains more than two host names, and this means the header has been forged. A valid "Received:" header has the following format:

Received: from host1 (host2 [ww.xx.yy.zz]) by host3 (8.7.5/8.7.3) with SMTP id MAA04298; Thu, 18 Jul 1996 12:18:06 -0600.

Reading from back to front in the forged header, we see the host which added the "Received:" header (host3); the IP address of the incoming SMTP connection (ww.xx.yy.zz); the reverse-DNS lookup of that IP address (host2); and the name the sender used in the SMTP HELO command when it connected (host1).

In such a case, our best bet is the next-to-last "Received:" header. This indicates an IP address of origin within the net-block 208.136.0.0, which belongs to mci.net. We can learn this by doing:

With this information, we can forward our report to MCI. Remember to keep things simple, and do not address the administrator in less-than-polite terms. He is there to help you, and has nothing to do with the spammer. My favourite introduction is:

From the list of reporting addresses in http:\\www.abuse.com, we obtain the address spams@mci.net, and we send our report to this address.

In most cases, you will receive an automated reply saying that your complaint has been received. Sometimes, you will receive a follow-up with specific information about your report. You should neither ask nor expect to receive any personal information on the spammer - remember that your identity is being kept confidential as well. Instead, a follow-up may contain valuable technical information (this is how I collected the information presented in this page). Even if you do not receive any reply, in most cases your report has been read, and the administrator has tried to find the source of the spam and acted against it. Just keep reporting all instances of spam, and you can be sure that several spammers will lose access to their mail servers. Here are, for instance, two messages I received yesterday: