Using the WunderCounter to Stop SPAM

What is SPAM?

SPAM is, loosely defined, unwanted AND unsolicited email. It's just like those silly flyers you find in your mailbox - a waste of your time and usually completely irrelevant. The Internet has become a real hotbed for SPAMMERS (people who send SPAM) and it's up to the average user to make some noise about it. SPAM hogs valuable Internet resources and wastes time. It's often offensive. What would you do if your young child was constantly SPAMMED with graphic images of hardcore pornography? It does happen and there's something you can do about it -- complain.

Complaining may sound useless to you, but you have to remember that you'll be complaining to a business and not a government bureaucrat. You'd be surprised at how effective your complaints can be.

What is *NOT* SPAM?

Before we go on I think it's wise to define what SPAM is *not*. SPAM is not just any mail which you didn't want. An angry letter from a sibling or ex-partner is not SPAM. An email bill, receipt or newsletter from a service for which you have personally enrolled is not SPAM. For example, when you signed up for the WunderCounter you provided me with your email address. Like it or not, I sometimes need to be in touch with users to remind them of updates or special features. When I send these emails to you they cannot be considered SPAM. However, if I were so callous as to send you all an email about avoiding male pattern baldness, that *would* be SPAM. It would be really annoying too. It won't happen. :-)

Tracking Down Where SPAM Originates

Email bounces over a lot of different servers before it gets to you in most cases. That's why you need to find out where its sending off point was. To do this, open up the offending email and have a look at the headers. You may need to consult your email software "help" to view the headers. In Outlook Express on my Mac, I just go to "View" and "Source". Using Netscape I go to "View", "Headers" and "All". You'll see some confusing junk that may look something like this annoying mail which I recently was subjected to:

Return-Path:
Received: from caramail.com (uu194-7-158-130.unknown.uunet.be [194.7.158.130])
by vilerichard.com (8.10.2/8.10.2) with SMTP id g2B0QHY17931
for ; Sun, 10 Mar 2002 18:26:18 -0600
Date: Sun, 10 Mar 2002 18:26:18 -0600
Reply-To:
Message-ID: <006c06c65eda$7364d4c4$0cc08dc7@rllmrm>
From:
To: Mail.Recipient
Subject: Custom Websites for $399 Complete! (or yours re-designed)
(5716pJBT5-469nFxR1818kCuO4-27@27)
MiME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4133.2400
Importance: Normal

This may look like a lot of garbage to you, but you should be able to recognize a few things. First of all, near the top, you'll see the email address of mine which was so horribly abused in the sending of this mail: olaf@vilerichard.com Next, you'll see the line with the word "from". This is a very important line. Look for the IP number -- it's between the square brackets. The offending number here is 200.27.164.51 Take this number and plug it into the WunderCounter's WHOIS page. (You can find a link to this page under the "More Stats" menu on your main stats page). Try it now, by clicking on this link: 194.7.158.130

You'll notice that, among other information, you'll see some email addresses on this page. It won't always be this easy, but this particular company has done the right thing and has listed email addresses to be used for SPAM complaints. (If you're not sure which email to complain to, just complain to all of them -- the message will hopefully get to the right person). In this case I sent my SPAM complaint to the company and they thanked me for the info and said they would resolve the situation. You won't always hear back about your complaints -- yours may have been one of many. However, when companies do take the time to reply I think it speaks volumes for their respect for the rest of us.

Is There Anyone Else to Go After?

You can try following the links in the email, if they haven't just given you some phone numbers or something inane like that. Get the domain names in the links. You can perform a WHOIS lookup on a URL in a SPAM, send a complaint to the email addresses you find and get the web site shut down. Trust me -- it's that easy. Just make sure you send the right info (see below). If you really have a lot of time on your hands, send the spam complaint to the web counters, banner services and any other sites you find on the offending page. If I get a legitimate spam complaint about a WunderCounter user that account gets frozen ASAP.

Can't I Just Reply to the Email?

After you've tried this once or twice you'll see why it won't work. Often the email in the From: line is forged. If it *is* a genuine email address and you send a message it will likely bounce back to you. A large percentage of the spammers messages will have bounced back to him and his inbox is likely to be full of these messages. There won't be room for yours. At any rate, complaining to the spammer won't always do much good. You have to be silly to think it's okay to send that kind of mail to people. I mean, really...

Why Don't I Just Follow the Remove Link?

Many spammers aren't sure if you read their mail. If you click on a link in the email they'll *know* that you read it. Your more likely to end up on a few more lists than you are to be removed from this particular list. I mean, we're not talking about people with moral fibre here. It's more like the warts on the rear end of our society. But that's another matter entirely. If you do try to follow these links, you'll often get a message telling you that your address will be removed with 48 hours. How is this possible? Anyone who can mastermind the annoyance of millions can surely remove your email in real time? Well, it probably means your email address has been sold to a few others and you can be expecting mail from those sorry individuals very soon. Sigh. What has this world come to?

What do I Include in a Complaint?

First off, don't be nasty. I can't stress this enough. In most cases, the companies that own the servers don't even know that they have been used for SPAM. Sometimes it is sent through CGI scripts that have big security holes (like older versions of formail.cgi). You'll always get the best results if you're polite. The best way to go is to put the word "spam" in the subject line of your email. Begin the body of your message with something like: "The following message was unsolicited and unwanted:". Then, include the *entire* message *including* the mail headers. The headers are the most important part of the message. They'll allow the company involved to get as much information as possible. That's where the detective work is done.

What if the IP Number Doesn't Yield Any Email Addresses?

If you're having no luck with the IP number, there may be other domains that show up in the WHOIS lookup. You can try doing a WHOIS on those names and try to get contact info that way. If that fails, use the domain name that appears beside the IP number. Why not just start with the domain name? The problem is that domain names are easy to forge. IP numbers are more difficult to fake. However, there's a good chance your spammer isn't the sharpest pencil in the box, so go ahead and try the domain name.

Are There Easier Ways to Go About It?

I've never personally used this service, but SpamCop is a well respected method of dealing with spammers. In fact, I once worked for a company that almost had its servers shut down because of 40 SpamCop complaints from an email campaign of millions of messages. Companies that provide hosting hate spam. The company in question had to make some serious efforts to make sure that people weren't getting unsolicited mail in order to keep their servers online. That sort of customer service is satisfying to see in action!

There is much more information on SPAM and how to prevent it from reaching your mailbox in the first place at ScamBusters.org. You may find it interesting reading.

What do you think of this tutorial? Are there concepts which could have been explained more clearly? Was something left out? Are you still confused about anything? Please contact me and let me know of anything that could be improved here.

Thanks,

Olaf.

Main Tutorial page

Back to my stats page