Understanding email headers
Locating system administrators
Spoof headers
Insecure mail servers
Reverse phone number lookups
Who to contact and what to say

This page contains a lot of information. Tracing a spam to its real origin may take considerable detective work, and a number of tools may be necessary. Knowing who to notify with what you discover, or knowing to whom to send a spam for investigation and action is yet another issue, and not necessarily an altogether simple one. I do not investigate spam for other people. You will need to determine for yourself what is the appropriate action to take and whom to notify.

UNDERSTANDING HEADERS

TOP

A lot of the headers sent with spam mail are invalid, or "spoofed". Your task is to determine what the mail headers mean, which ones are valid and which ones are spoofed. To understand headers, it's necessary to understand how SMTP mail service works.

An authentication check is only possible if the calling machine allows it. If the calling machine is running Unix, it must be running a program called identd for an authentication check to succeed. Most Windows machines don't run any software which will identify the caller, and since a lot of email gets handled by Windows mail programs, the authentication check has to be optional. If the mail server had been unable to identify me personally, it would have settled for identifying the machine I'm using.

Note that the Recieved: header in the above message starts with "Received: from fmp.com". This is the name with which I said HELO, and I might have spoofed this name. Following this in parentheses, however, is the information which the server itself determined to be true - my username, my machine name and my IP address. This information is generally more trustworth than the former, and when they differ, it may be because of a spoof, or it may simply be that an IAP is using the mail facilities of a contract service whose true information appears in parentheses.

LOCATING SYSTEM ADMINISTRATORS

TOP

One of the best tools for reaching the appropriate system admins on systems involved in spam is the Network Abuse Clearinghouse. Use of their services to redirect your spam complaints requires registration and agreement to their very generous terms (you have to agree not to use their facilities to distribute spam) and once registered, you can send your spam notices and complaints to domain.name@abuse.net and the abuse.net system will try to remail your post to the correct administrators at domain.name. The Network Abuse Clearinghouse has developed a fairly sizable database, and using their facilities can save you time and misdirected email. You can also access their database without registration to locate spam complaint addresses using whois. Just specify the whois server as whois.abuse.net.

Remember that you're likely to find the most reliable address in parentheses in the topmost Recieved: header. All other headers should be viewed with some suspicion, although in some cases they will contain valuable information. Subsequent Received: headers may contain valid information, but you will need to investigate them carefully. Reply-to: headers are almost always spoofed - something which can be done even the simplest mail client.

If a Received: header contains an IP address but no domian name associated with it, you should first verify that the IP address is valid. You can use the traceroute utility on fmp to try to get test traffic to the address. If traceroute takes more than 30 seconds to return information, you probably have an invalid IP address. Remeber that a valid IP address always contains 4 sets of numbers separated by dots and these numbers will never be higher than 254. If it appears that an IP address is valid, you can address email to a user at that address by enclosing the numeric portion in square brackets, as in postmaster@[207.174.179.25].

SPOOF HEADERS

TOP

"INSECURE" MAIL SERVERS

TOP

Spammers absolutely love servers such as this, since sending email via such a server makes them completely invisible and hence immune to flame email from angry admins and users who have been inconvenienced or annoyed by their junk email. Every SMTP server on the Internet should be configured to adhere to the following guidelines:

1. A mail server should always place at least the IP address of the system requesting mail service in the Received: headers of email. If further information is available, such as the resolved machine and domain name or the results of an ident authentication request, this information should also be included. The client IP address is always available, so there's really no excuse for not including this information.

2. A mail server should accept email for handling only if it the client requesting service is in the servers domain or in a trusted domain, or if the recipient address is in the server's domain or a trusted domain.

Once you understand the issues here, you should be on the lookout for mail hosts and relays which don't authenticate, especially if you receive spam email through them. You should notify the postmasters of such systems of the potential for abuse and possible legal liability which they are inviting by essentially running an "anonymous remailer".

At some point I will be setting up a private registry for email servers which fail to authenticate, and the Spam Patrol will act as a clearing house for reports of such servers.

REVERSE PHONE NUMBER LOOKUPS

TOP

Since every spam is ostensibly a sales pitch, the spammer must provide some method for prospective customers to get in touch. The contact point may be an email address set up to filter out flames and only accept serious inquiries. It may be a mailing address - or it may be a phone number. If the spammer is incautious enough to give a listed phone number as a contact point, you have a good chance of blowing his or her cover. Both PC411 and SearchAmerica provide reverse phone number lookups. The latter charges a nominal fee of 25 to 35 cents for each successful search. I have used PC411 with good results, but have never used SearchAmerica and don't know if its database is more complete or current than that used by PC411. I would guess that both draw on fairly complete lists of published phone numbers and are probably nearly equivalent.

If you are able to positively identify a spam advertiser in this manner, the next step is to obtain as much information about the person as possible. Four11 (not to be confused with PC411) is a good source of general information on people on the Internet. Four11 will help you look up real email addresses for the advertiser, along with other phone numbers and possibly a physical address. You may wish to contact the advirtiser directly using these email addresses, or place a call and try to talk to the person responsible for the spams. By all means, when writing to postmasters and administrators of sites deduced from deciphering headers, include all the information you've gathered.

If a spammer is clever and provides an unlisted phone number, a shielded email account or some other means of getting back in touch, you can generally obtain more information by "taking the bait" and replying to the ad as if you were a prospective customer. If replying by email, don't include the original spam, be polite and indicate an interest in buying whatever the spam offers for sale. Contact accounts generally have a fairly severe filter to look for keywords and filter out flames. If the spammer replies back, generally the reply will contain a real email address or some other item of information which will allow you to dig deeper and uncover fairly complete information - enough to be of real help to others affected by the spam who are trying to locate the person.

WHO TO CONTACT AND WHAT TO SAY

TOP

The correct response to spam email is to notify the system administrators whose systems received and transferred each piece of spam you've received, as discussed above in the section on understanding headers. In order of importance, these will generally be:

• The postmaster of the system from which your mail server received the spam, as shown in the first Received: header.

• The postmasters of other valid systems listed in subsequent Received: headers. Use whois to determine whether or not the domain name shown in the header is real or spoofed.

• The administrative and technical contacts listed in the information returned from a whois lookup.

• The postmasters or DSN administrators of domains mentioned in the From:, To:, Sender: and other headers if you've found the domain names to be valid using whois. Keep in mind that these addresses are probably spoof addresses, and the system administrators responsible for them are probably a whole lot more upset about the spam than you are, so be specially polite and understanding when you write them. If you've gathered any personal information on the spammer, this information may be especially welcome to these folks.

Be polite and informative when writing to everyone, unless, of course, you've uncoverd a valid and unblocked email address for a spammer, in which case, flame away to your hearts content! This can be very emotionally satisfying. It's very important in forwarding spam to system administrators to include the full headers from the offending email since this is where investigative pay-dirt lies for both you and others trying to locate and stop a spammer. Set the subject line of your post to something like "Spam from your system" followed by the original subject of the spam, in quotes or parentheses (I use both). If the spam is quite long, you need not send all of it. Leave enough text to clearly demonstrate that the email is useless trash which no one in their right mind would want to receive. Be sure not to edit out any of the text containing URLs, phone numbers, addresses (email or postal) or any other information which might help in tracking down the spammer.