1084 lines
45 KiB
Plaintext
1084 lines
45 KiB
Plaintext
|
|
Archive-name: net-abuse-faq/spam-faq
|
|
Posting-Frequency: monthly
|
|
Last-modified: 960708
|
|
URL: http://digital.net/~gandalf/spamfaq.html
|
|
|
|
Greetings and Salutations:
|
|
|
|
The three sections to this eight portion FAQ (With apologies to
|
|
Douglas Adams :-)) :
|
|
|
|
o Introduction
|
|
o Tracing an e-mail message
|
|
o MAILING LIST messages
|
|
o Reporting Spam and tracing a posted message
|
|
o What is an IP address and converting an IP address
|
|
o WWW IP Lookup URL's
|
|
o Converting that IP to a name
|
|
o A list of provider complaint addresses
|
|
o Filtering E-Mail using procmail or News with Gnus
|
|
o Misc. (Because I can't spell miscellaneous :-)) stuff
|
|
I couldn't think to put anywhere else.
|
|
o Origins of Spam
|
|
o The MMF (Make Money Fast) Posts or any fraud on the
|
|
Internet
|
|
o Those annoying 1-900 & 1-800 Sex Phone Ads
|
|
o How To Respond to SPAM
|
|
o Revenge - What to do & not to do (mostly not)
|
|
o Telephoning someone
|
|
o Snail Mailing someone
|
|
|
|
Introduction
|
|
============================================
|
|
This is addition to the most excellent:
|
|
|
|
Net Abuse FAQ (posted to news.admin.net-abuse.misc, alt.current-
|
|
events.net-abuse etc...), brought to you by J.D. Falk
|
|
<jdfalk@cybernothing.org> :
|
|
http://www.cybernothing.org/faqs/net-abuse-faq.html
|
|
|
|
Or :
|
|
|
|
http://NCTUCCCA.Edu.Tw/ftp/documents/Internet/MaasInfo/Other/NetAbuse.
|
|
html
|
|
http://NCTUCCCA.Edu.Tw/ftp/documents/Internet/MaasInfo/Other/BadISPs.h
|
|
tml
|
|
http://NCTUCCCA.Edu.Tw/ftp/documents/Internet/MaasInfo/Other/EmailAbus
|
|
eLog.html
|
|
|
|
And Bill's WWW page "Everything You'd Rather Not Have To Know About
|
|
Net-Abuse" :
|
|
http://www.tezcat.com/~haz1/netabuse/netabuse.html
|
|
|
|
The latest & greatest version of this FAQ will be found at:
|
|
|
|
http://digital.net/~gandalf/spamfaq.html
|
|
|
|
Or the archive at:
|
|
ftp://rtfm.mit.edu/pub/usenet/alt.spam/
|
|
|
|
Or with other abuse FAQ's at:
|
|
ftp://rtfm.mit.edu/pub/usenet-by-hierarchy/news/admin/net-abuse/misc/
|
|
|
|
Or *nicely* HTML'ed at:
|
|
http://www.cs.ruu.nl/wais/html/na-dir/net-abuse-faq/spam-faq.html
|
|
|
|
PLEASE email follow-ups, additions / changes to gandalf@digital.net
|
|
|
|
My news source is OK, but I sometimes miss items.
|
|
|
|
There are places in this FAQ with ALL CAPS. This is where I need some
|
|
help or input. I accept all and any input. I consider myself to be
|
|
the manager of this FAQ for the good of everyone, not the absolute &
|
|
controlling Owner Of The FAQ. I do not always write in a completely
|
|
coherent manner. What makes sense to me may not make sense to others.
|
|
If the community wants something added or deleted, I will do so. I
|
|
removed any e-mail and last name references to someone making a
|
|
suggestion / addition. This is so that someone doesn't get upset at
|
|
this FAQ and do something stupid. If you don't mind having your e-
|
|
mail in this FAQ (or where it is required), please tell me and I will
|
|
add it back in.
|
|
|
|
First off, before trying to determine where the post or e-mail
|
|
originated from, you should realize that (just like the National
|
|
Inquirer, or a logical argument from C&S) the message will have *some*
|
|
amount of truth, but all or most of the information may be forged. Be
|
|
careful before accusing someone.
|
|
|
|
Commands used in this FAQ are UNIX & VMS commands. Sorry if they
|
|
don't work for you, you might wish to try looking around at your
|
|
commands to find an equivalent command (or I might be able to help out
|
|
some).
|
|
|
|
And no, I am not going to tell you how to post a fake message or fake
|
|
e-mail. It only took me about 2 days (a few hours a day) to figure it
|
|
out. It ain't difficult. RTFM (or more appropriately, Read The
|
|
@&%^@# RFC).
|
|
|
|
Every e-mail or post will have a point at which it was injected into
|
|
the information stream. E-mail will have a real computer from which
|
|
it was passed along. Likewise a post will have a news server that
|
|
started passing the post. You need to get cooperation of the
|
|
postmaster at the sites the message passed thru. Then you can get
|
|
information from the logs telling you what sites the message actually
|
|
passed thru, and where the message "looked" like it passed thru (but
|
|
actually didn't). Of course you do have to have the cooperation of
|
|
all the postmasters in a string of sites...
|
|
|
|
Tracing an e-mail message
|
|
============================================
|
|
|
|
Fight unsolicited e-mail and mailing list vendors :
|
|
http://host.ptbo.igs.net/~shawn/junkmail.html
|
|
|
|
First (and easiest) thing to forge is the e-mail return address. Most
|
|
personal computer posting software lets you type in just about any e-
|
|
mail address you want to (for example the software I am using to post
|
|
this message). Unless someone is a real idiot or they truly don't
|
|
know they will annoy tons of people, they will forge a fake e-mail
|
|
return or put in the e-mail of someone they don't like.
|
|
|
|
It seems that most machines will accept e-mail from any other machine,
|
|
so don't send e-mail to postmasters at "upstream" sites that are just
|
|
passing the message along.
|
|
|
|
You will need to take a look at the headers on the message (if you
|
|
can) In PINE (for example) hit "h" to get headers. Look for a line
|
|
like the following:
|
|
|
|
Message-ID: <Chameleon.951024110528.inetlis1@inetlis.wavenet.com>
|
|
|
|
You should look at the message ID first & see what site it appeared to
|
|
come from (the part after the "@" sign). If it is a bunch of numbers
|
|
(an IP address) then you should then do a "nslookup" (see further
|
|
below for a description of nslookup) to see what the site name is.
|
|
Furthermore all the message-ID lines should have a unique number. If
|
|
not then you have someone who is *very* familiar with the SMTP
|
|
protocol and is forging the e-mail to another site (like the Euphoria
|
|
Tape spammer). Sometimes this header will even tell you who the
|
|
message actually came from.
|
|
|
|
From the below, the only way we can tell the origin site is in the
|
|
Message-Id (which has an IP of 204.183.126.181) is to do a nslookup on
|
|
the IP address, and proceed from there.
|
|
|
|
>Received: from [199.3.242.38] (ppp007.free.org [199.3.242.38]) by
|
|
>sirocco.CC.McGill.CA (8.6.12/8.6.6) with SMTP id EAA16681; Sat, 11
|
|
Nov 1995
|
|
>04:50:30 -0500
|
|
>X-SMTP-Posting-Origin: [199.3.242.38] (ppp007.free.org
|
|
[199.3.242.38])
|
|
>X-Sender: yoshio@osak.ac.jp (Unverified)
|
|
>Message-Id: <v0153051facca0e1e11d6@[204.183.126.181]>
|
|
|
|
Sample fake e-mail message :
|
|
|
|
From A@b.c.d Sat Nov 11 13:16 EST 1995
|
|
Received: from wavenet.com (wavenet.com [198.147.118.131]) by
|
|
ddi.digital.net (8.6.11/8.6.9) with ESMTP id NAA04656 for
|
|
<gandalf@ddi.digital.net>; Sat, 11 Nov 1995 13:16:03 -0500
|
|
Received: from ddi.digital.net (ddi.digital.net [198.69.104.2]) by
|
|
wavenet.com (8.6.12/8.6.9) with SMTP id KAA27279 for
|
|
gandalf@ddi.digital.net; Sat, 11 Nov 1995 10:27:52 -0800
|
|
Received: from wavenet.com (wavenet.com [198.147.118.131]) by
|
|
ddi.digital.net (8.6.11/8.6.9) with ESMTP id OAA18017 for
|
|
<gandalf@ddi.digital.net>; Tue, 24 Oct 1995 14:09:46 -0400
|
|
Received: from inetlis.wavenet.com (port16.wavenet.com
|
|
[198.147.118.209]) by wavenet.com (8.6.12/8.6.9) with SMTP id LAA02685
|
|
for <gandalf@ddi.digital.net>; Tue, 24 Oct 1995 11:21:12 -0700
|
|
|
|
This is a mail message I sent to myself just to use as an example. I
|
|
have cut out a bit of the other header information so that I could
|
|
take a look at just the important parts.
|
|
|
|
Obvious faked piece is the "From" address. You read the headers from
|
|
the bottom to the top to trace which sites the message has gone thru.
|
|
|
|
Make sure that you do a nslookup on the IP address's (for example I
|
|
would verify 198.147.118.131 actually is wavenet.com). If the IP
|
|
doesn't jive with the name then you may have the IP address of the e-
|
|
mail faker. This message decodes to the following
|
|
|
|
port16.wavenet.com = 198.147.118.209
|
|
wavenet.com = 198.147.118.131
|
|
ddi.digital.net = 198.69.104.2
|
|
|
|
From site To site Date / Time (delta GMT)
|
|
Time in GMT hh:mm:ss
|
|
==============================================================
|
|
inetlis.wavenet.com wavenet.com Tue, 24 Oct 1995 11:21:12 -0700
|
|
18:21:12
|
|
wavenet.com ddi.digital.net Tue, 24 Oct 1995 14:09:46 -400
|
|
18:09:46
|
|
ddi.digital.net wavenet.com Sat, 11 Nov 1995 10:27:52 -800
|
|
18:27:52
|
|
wavenet.com ddi.digital.net Sat, 11 Nov 1995 13:16:03 -500
|
|
18:16:03
|
|
|
|
Wolfgang Schelongowski <ws@xivic.ruhr.de> reminds us :
|
|
The first is hh:mm.ss WULT (WULT == Widely Unknown Local Time :-))
|
|
with a delta from GMT, so you add in the delta to get a "zero" time.
|
|
The time is from the computer transmitting, so it is possible to have
|
|
the clocks several minutes apart.
|
|
GMT = Greenwich Mean Time. The "time" was kept at RGO (Royal
|
|
Greenwich Observatory?), Greenwich England at one time and is also
|
|
known as UTC (UTC = Coordinated Universal Time, or Universal
|
|
Coordinated Time) or "Zulu" or Zero time. It is kept by the UK
|
|
National Physical Laboratory, and is no longer at the RGO (Royal
|
|
Greenwich Observatory?).
|
|
|
|
I manually inserted the first two mail transfers myself (as you can
|
|
see from the date / times) to muddy the waters. It looks like this
|
|
message originated from inetlis.wavenet.com, when in reality it came
|
|
from ddi.digital.net. The date / time (in this case) tells you that
|
|
something is wrong, but sometimes a computer may be down along the way
|
|
which would hold up the mail.
|
|
|
|
You really need cooperation from other people & get multiple messages
|
|
to compare the headers. There will be a common "injection" point.
|
|
Whether it is the starting point or in the middle. Ask that
|
|
postmaster to look thru the logs & figure out who sent that e-mail.
|
|
Someone from the first common injection point "From" site spammed out
|
|
the e-mail.
|
|
|
|
It has been kindly pointed out to me that there is a "feature" (read
|
|
"bug") in the UNIX mail spool wherein the person e-mailing you a
|
|
message can append a "message" (with the headers) to the end of their
|
|
message. It makes the mail reader think you have 2 messages when the
|
|
joker that sent the original message only sent one message (with a
|
|
fake message appended). If the headers look *really* screwy, you
|
|
might look at the message before the screwy message and consider if it
|
|
may not be a "joke" message.
|
|
|
|
MAILING LIST messages
|
|
========================================
|
|
Stephanie kindly tells me :
|
|
|
|
A MAILING LIST is a type of email distribution in which email is sent
|
|
to a fixed site which holds a list of email recipients and mail is
|
|
distributed to those recipients automatically (or through a
|
|
moderator).
|
|
|
|
A LISTSERVER is a software program designed to manage one or more
|
|
mailing lists. One of the more popular packages is named "LISTSERV".
|
|
Besides Listserv, other popular packages include Listproc which is a
|
|
Unix Listserv clone (Listservs originated on BITNET), Majordomo and
|
|
Mailserve. Most importantly -- not all mailing lists run on
|
|
listservers, there are many mailing lists that are manually managed.
|
|
|
|
You may hear of mailing lists being referred to as many things, some
|
|
strange, some which on the surface make sense, like "email discussion
|
|
groups". But this isn't accurate either, since not all mailing lists
|
|
are set up for discussion.
|
|
|
|
Example Header appears below:
|
|
Received: from dir.bham.ac.uk (dir.bham.ac.uk [147.188.128.25]) by
|
|
gol1.gol.com (8.7.5/8.6.9) with SMTP id GAA27292 for <XXXX@gol.com>;
|
|
Sun, 5 May 1996 06:31:15 +0900 (JST)
|
|
Received: from bham.ac.uk by dir.bham.ac.uk with SMTP (PP) using DNS
|
|
id <26706-38@dir.bham.ac.uk>; Sat, 4 May 1996 20:56:49 +0100
|
|
Received: from emout09.mail.aol.com (actually emout09.mx.aol.com) by
|
|
bham.ac.uk with SMTP (PP); Sat, 4 May 1996 21:13:03 +0100
|
|
Received: by emout09.mail.aol.com (8.6.12/8.6.12) id PAA29156; Sat, 4
|
|
May 1996 15:35:53 -0400
|
|
Date: Sat, 4 May 1996 15:35:53 -0400
|
|
From: Jeanchev@aol.com
|
|
Message-ID: <960504153553_287142426@emout09.mail.aol.com>
|
|
Subject: CRaZy Complimentary Offer........
|
|
|
|
This is a post from Kevin Lipsitz for his "===>> FREE 1 yr. USA
|
|
Magazine Subscriptions". Reports are that he doesn't provide very
|
|
good service after the sale of the subscription (that is if you even
|
|
get a magazine). In relation to the Internet he makes a slimy used
|
|
car salesman look like a saint. We won't even start to discuss the
|
|
fact the he likes to use female names for his messages...
|
|
|
|
The latest information indicates that the state of New York has told
|
|
him he should stop abusing the Internet for a while ... lets hope it
|
|
is forever.
|
|
|
|
For more info about "Krazy Kevin" or the Magazine Spam , Tony tells us
|
|
the page "Stop Spam!" is available in html format at:
|
|
http://www.iac.co.jp/~issho/stop-spam.html
|
|
|
|
But as David reminds us, There are a million Kevin J. Lipsitz's out
|
|
there. All selling magazines, Amway, vitamins, phone service, etc.
|
|
All the losers who want to get rich quick, but can't start their own
|
|
business.
|
|
Like :
|
|
http://com.primenet.com/spamking/
|
|
|
|
That having been said, e-mail from a Listserve can usually be broken
|
|
down the same way as "normal" e-mail headers. There are just more
|
|
waypoints along the way. As you can see from the above, the e-mail
|
|
originated from :
|
|
|
|
emout09.mail.aol.com
|
|
|
|
You might with to also direct the listserve owner to look at & ask
|
|
questions in news.admin.net-abuse.misc about how to keep spam off the
|
|
listserve. It probably won't be all that difficult of a thing to do.
|
|
|
|
Reporting Spam and tracing a posted message
|
|
============================================
|
|
The first thing to do is to post the ENTIRE message (PLEASE put the
|
|
header in) to the newsgroup news.admin.net-abuse.misc with the
|
|
suggested subject of one of the following:
|
|
|
|
Subject: EMP <Subject from the Spam message>
|
|
Subject: ECP <Subject from the Spam message>
|
|
Subject: MMF <Subject from the Spam message>
|
|
|
|
Please include the original Subject: from the original Spam so that it
|
|
can easily be spotted. Thank you.
|
|
|
|
An Excessive Multiple Post may exceed the spam threshold and may be
|
|
canceled. An Excessive Cross Post may not be canceled because it
|
|
hasn't reached the threshold. A Make Money Fast message is
|
|
immediately cancelable.
|
|
|
|
Tracing a fake post is probably easier than a fake e-mail because of
|
|
some posting peculiarities. You just have to save and look at a few
|
|
"normal" posts to try to spot peculiarities. Most people are not
|
|
energetic to go to the lengths of the below, but you never know.
|
|
|
|
Dan reminds us that first you should gather the same post from
|
|
*several* different sites (get your friends to mail the posts to you)
|
|
and look at the "Path" line. Somewhere it should "branch". If there
|
|
is a portion that is common to all posts, then the "actual" posting
|
|
computer is (most likely) in that portion of the path. That should be
|
|
the starting postmaster to contact. Be sure to do this expeditiously
|
|
because the log files that help to trace these posts may be deleted
|
|
daily.
|
|
|
|
Once again, start by looking at the Message-ID, and ask yourself if
|
|
that site makes sense. Again, look at the number after the Message-ID
|
|
and see if it is identical for several *different* posts (i.e. posts
|
|
to different groups). Message-ID's are unique for each *different*
|
|
post. If the Message-ID is the same, then it is faked. If you
|
|
*really* want to see some fake posts, look in alt.test or in the
|
|
alt.binaries.wares.* groups.
|
|
|
|
A fake post:
|
|
|
|
Path:
|
|
..!news.sprintlink.net!in2.uu.net!news.net99.net!news!s46.phxslip4.in
|
|
direct.com!vac
|
|
From: XXX@indirect.com(Female User)
|
|
Subject: Femdom In Search of Naughty Boys
|
|
Message-ID: <DHLMvE.24H@goodnet.com>
|
|
Sender: XXX@indirect.com(Female User)
|
|
Nntp-Posting-Host: s46.phxslip4.indirect.com
|
|
Organization: Internet Direct, Inc.
|
|
X-Newsreader: Trumpet for Windows[Version 1.0 Rev B final beta #1]
|
|
Date: Mon, 6 Nov 1995 01:59:38 GMT
|
|
Approved: XXX@indirect.com
|
|
Lines: 13
|
|
|
|
This poor lady (Name deleted by suggestion) was abused by someone for
|
|
a couple of days in an epic spam. Many messages were gathered. The
|
|
message ID was different for several messages. But several anomalies
|
|
showed an inept poster.
|
|
|
|
The headers were screwed up, and when looking at a selection of
|
|
messages from several sites, the central site was news.net99.net,
|
|
where goodnet.com gets / injects news at. This lead to the conclusion
|
|
that either goodnet.com or news.net99.net should be contacted to see
|
|
who the original spammer was. I never heard the results of this, but
|
|
the spamming eventually stopped.
|
|
|
|
E-Mail return is probably the easiest to fake and is * always *
|
|
suspect. The NNTP-Posting-Host and / or Message-ID are harder to fake
|
|
(but not *much* harder...) and probably deserve a closer look at those
|
|
sites.
|
|
|
|
You can try looking at sites & see if they have that message by :
|
|
telnet s46.phxslip4.indirect.com 119
|
|
Connected to s46.phxslip4.indirect.com.
|
|
200 s46.phxslip4.indirect.com InterNetNews server INN 1.4 22-Dec-93
|
|
ready
|
|
head <DHLMvE.24H@goodnet.com>
|
|
430
|
|
|
|
Message was not found at that site, so it did not go thru that
|
|
computer, or the article has already expired or been deleted off of
|
|
that news reader.
|
|
|
|
If you wish to track a particular phrase, user-id (whatever) take a
|
|
look at the URL for getting all the posts pertaining to "X" :
|
|
|
|
http://www.reference.com/
|
|
|
|
What is an IP address and converting an IP address
|
|
============================================
|
|
When all you have is a number the looks like "204.183.126.181", and no
|
|
computer name, then you have to figure out what the name of that
|
|
computer is. Most likely if you complain to
|
|
"postmaster@204.183.126.181" it will go directly to the spammer
|
|
themselves (if it goes anywhere at all).
|
|
|
|
WWW IP Lookup URL's
|
|
=============================
|
|
A whole *host* of WWW IP utils is thoughtfully provided by Mike at :
|
|
http://sh1.ro.com/~mprevost/netutils/netutils.html
|
|
Or for a WWW Traceroute you can try the URL :
|
|
http://webware-inc.com/wtr.html
|
|
For a WWW version of Dig :
|
|
http://sh1.ro.com/~mprevost/netutils/dig.html )
|
|
WWW Nslookup : http://thor.clr.com/nslookup.html
|
|
SWITCH WHOIS Gateway:
|
|
http://www.switch.ch/switch/info/whois_form.html
|
|
TIG Internet Domain-Name Database :
|
|
http://home.tig.com/cgi-bin/genobject/domaindb
|
|
IP to Lat - Lon (For those times when only a Tactical Nuke will do ;-
|
|
)) :
|
|
http://cello.cs.uiuc.edu/cgi-bin/slamm/ip2ll/
|
|
http://www-pablo.cs.uiuc.edu/~slamm/ip2ll/links.html
|
|
Yet Another IP to name:
|
|
http://cello.cs.uiuc.edu/cgi-bin/slamm/ip2name
|
|
Yet another Domain Name lookup:
|
|
http://www.imperative.com/cgi-bin/genobject/index2 then click on the
|
|
domain database lookup
|
|
|
|
Converting that IP to a name
|
|
=============================
|
|
If the site is a IP address like "127.0.0.0", you can do a DNS lookup
|
|
to backtrack the site. A DNS lookup or a host command (see example
|
|
below) uses the info in a Domain Name Server database. This is the
|
|
same info that is used for packet routing. The UNIX command is :
|
|
|
|
nslookup 198.41.0.5
|
|
|
|
And you get :
|
|
Name: RS.INTERNIC.NET
|
|
Addresses: 198.41.0.5, 198.41.0.6
|
|
|
|
InterNIC is your friend. The InterNIC Registration Services Host
|
|
contains ONLY Internet Information (Networks, ASN's, Domains, and
|
|
POC's). Please use the whois server at nic.ddn.mil for MILNET
|
|
Information. Try :
|
|
|
|
telnet rs.internic.net
|
|
whois 198.41.0.5
|
|
|
|
If that doesn't provide anything, try chopping off the last digits and
|
|
you might get:
|
|
Whois: 204.162.179
|
|
BBN BARRNET, Inc. (NETBLK-NETBLK-BARRNET4) NETBLK-BARRNET4
|
|
204.160.0.0 - 204.163.255.0
|
|
Slip.Net (NETBLK-NETBLK-SLIP) NETBLK-SLIP 204.162.160.0 -
|
|
204.162.191.0
|
|
|
|
Success! BARRNet has the blocks of the IP's.
|
|
|
|
John tells us :
|
|
Um yes, but that particular sub-block belongs to slip.net... barrnet
|
|
is obviously slip.net's provider, the barrnet block looks like 4 class
|
|
B's (or 256 THOUSAND IP's..), while the slip.net block is a mere 32
|
|
class C's (or 8 thousand IP's)...
|
|
So a whois NETBLK-SLIP gives us (among other information) :
|
|
Slip.Net (NETBLK-NETBLK-SLIP)
|
|
Netname: NETBLK-SLIP
|
|
Netblock: 204.162.160.0 - 204.162.191.0
|
|
|
|
To see who the upstream provider is, try :
|
|
|
|
multinet traceroute ip30.abq-dialin.hollyberry.com
|
|
|
|
You might get :
|
|
traceroute to IP30.ABQ-DIALIN.HOLLYBERRY.COM (165.247.201.30), 30 hops
|
|
max, 38 byte packets
|
|
1 cpe2.Washington.mci.net (192.41.177.181) 190 ms 210 ms 120 ms
|
|
2 borderx1-hssi2-0.Washington.mci.net (204.70.74.101) 100 ms 100
|
|
ms 60 ms
|
|
3 core-fddi-0.Washington.mci.net (204.70.2.1) 180 ms 130 ms 70 ms
|
|
4 core1-hssi-4.LosAngeles.mci.net (204.70.1.177) 150 ms 140 ms
|
|
150 ms
|
|
5 core-hssi-4.Bloomington.mci.net (204.70.1.142) 180 ms 200 ms
|
|
180 ms
|
|
6 border1-fddi-0.Bloomington.mci.net (204.70.2.130) 170 ms 290 ms
|
|
240 ms
|
|
7 internet-direct.Bloomington.mci.net (204.70.48.30) 300 ms 210 ms
|
|
270 ms
|
|
8 165.247.70.1 (165.247.70.1) 180 ms 240 ms 180 ms
|
|
9 abq-phx-gw1.indirect.com (165.247.202.253) 290 ms 220 ms 230 ms
|
|
10 * * *
|
|
|
|
Humm..... Seems that after abq-phx-gw1.indirect.com we get no
|
|
response, so *that* is who I would complain to... or you can just send
|
|
a message to postmaster@indirect.com.
|
|
|
|
JamBreaker sez : Be sure to let the traceroute go until the traceroute
|
|
stops after 30 hops or so. A reply of "* * *" doesn't mean that
|
|
you've got the right destination; it just means that either the
|
|
gateways don't send ICMP "time exceeded" messages or that they send
|
|
them with a ttl (time-to-live) too small to reach you.
|
|
|
|
Try 'dig' (or one of its derivatives), it is used to search DNS
|
|
records :
|
|
(For the software : http://www.rediris.es/ftp/infoiris/red/ip/dns/dig-
|
|
2.0/
|
|
|
|
yourhost> dig -x 38.11.185.89
|
|
|
|
; <<>> dig 2.0 <<>> -x
|
|
;; ->>HEADER<<- opcode: QUERY , status: NOERROR, id: 6
|
|
;; flags: qr aa rd ra ; Ques: 1, Ans: 1, Auth: 3, Addit: 3
|
|
;; QUESTIONS:
|
|
;; 89.185.11.38.in-addr.arpa, type = ANY, class = IN
|
|
|
|
;; ANSWERS:
|
|
89.185.11.38.in-addr.arpa. 86400 PTR
|
|
ip89.albuquerque.nm.interramp.com.
|
|
|
|
;; AUTHORITY RECORDS:
|
|
11.38.in-addr.arpa. 86400 NS ns.psi.net.
|
|
11.38.in-addr.arpa. 86400 NS ns2.psi.net.
|
|
11.38.in-addr.arpa. 86400 NS ns5.psi.net.
|
|
|
|
;; ADDITIONAL RECORDS:
|
|
ns.psi.net. 86400 A 192.33.4.10
|
|
ns2.psi.net. 86400 A 38.8.50.2
|
|
ns5.psi.net. 86400 A 38.8.5.2
|
|
|
|
;; Sent 1 pkts, answer found in time: 64 msec
|
|
;; FROM: (yourhostname) to SERVER: default -- (yourDNSip)
|
|
;; WHEN: Thu Nov 16 23:30:42 1995
|
|
;; MSG SIZE sent: 43 rcvd: 216
|
|
|
|
|
|
A list of provider complaint addresses
|
|
============================================
|
|
O.K... So you have a common site that you can complain to. Good.
|
|
Post the FULL HEADERS (this is *very* important for tracing) to
|
|
news.admin.net-abuse.misc (see the section entitled Reporting Spam and
|
|
tracing a posted message) and send complaint with FULL HEADERS in e-
|
|
mail to any or all of the below :
|
|
|
|
postmaster@spammer.site.net
|
|
admin@spammer.site.net
|
|
abuse@spammer.site.net
|
|
|
|
Note : abuse@site.net and admin@site.net are not "standard" complaint
|
|
e-mail addresses, but I have seen those listed more and more
|
|
frequently.
|
|
|
|
If the spammer site has problems trying to figure out where the spam
|
|
came from, they can *always* get help from the denizens of
|
|
news.admin.net-abuse.misc, but have them take a look at their logs
|
|
first and see if they see something like (Thanks to help from
|
|
Michael):
|
|
|
|
My news logs (for INND) are:
|
|
$ cd /usr/log/news
|
|
$ ls
|
|
OLD expire.log news.err unwanted.log
|
|
errlog news news.notice
|
|
expire.list news.crit nntpsend.log
|
|
|
|
and here is my syslog.conf:
|
|
## news stuff
|
|
news.crit /usr/log/news/news.crit
|
|
news.err /usr/log/news/news.err
|
|
news.notice /usr/log/news/news.notice
|
|
news.info /usr/log/news/news
|
|
news.debug /usr/log/news/news.debug
|
|
|
|
but, what they need to remember, is they HAVE TO LOOK QUICK!. INND
|
|
expire puts all these logs in OLD, and recycles them, and expires them
|
|
at the 7th day (and gzips them), i.e., OLD/:
|
|
ls -l news.?.*
|
|
-r--r----- 1 news news 181098 May 23 06:26 news.1.gz
|
|
..
|
|
-r--r----- 1 news news 319343 May 17 06:29 news.7.gz
|
|
|
|
so... to grep an old log looking for sfa.ufl.edu:
|
|
(the {nn} is how many days ago, 1 is yesterday, 2 is 2 days ago, etc)
|
|
cd {log/OLD}
|
|
gunzip -c news.1.gz | grep sfa.ufl.edu | more
|
|
|
|
|
|
There is a list of admins to contact at (and a way to add to the
|
|
list):
|
|
http://www.gil.net/~infoline/abusebox.html
|
|
|
|
Chris tells us :
|
|
If you see MMFs or other gross abuses from AOL, MSN, MCI
|
|
(_not_internetmci), Primenet, Panix, please do not report them to
|
|
news.admin.net-abuse.misc. Just wastes bandwidth. Email your report
|
|
directly to the provider:
|
|
|
|
abuse@aol.com
|
|
postmaster@msn.com
|
|
postmaster@mci.com
|
|
postmaster@primenet.com
|
|
postmaster@panix.com
|
|
|
|
By "gross abuses", please try to ensure that it really is likely to be
|
|
spam. Not one article cross-posted lots, but lots of articles that
|
|
you see yourself. In AOL or MCI's case, the definition of abuse is
|
|
somewhat stricter (AOL bans commercial use. MCI's tolerance
|
|
thresholds is lower)
|
|
|
|
For the following providers the correct e-mail address is:
|
|
ABSnet - abs-admin@abs.net
|
|
AOL - abuse@aol.com. Emergency - send complete copies to
|
|
atropos@aol.net
|
|
AT&T Worldnet sources- wnettech@attmail.com
|
|
earthlink.net - abuse@earthlink.net
|
|
GNN.Com - For help regarding a problem with a GNN member -
|
|
GNNadvisor@gnn.com.
|
|
Hongkong's ISPs - send an email to hkinet@glink.net.hk with anything
|
|
in the subject/body. You'll get a most recent version of the list
|
|
contacts by email within minutes.
|
|
IBM Net - Postmaster@ibm.net - Also see
|
|
http://www.ibm.net/helpdesk.html
|
|
InterRamp.Com - abuse@interramp.com
|
|
interserve.com.hk - Mr. K H Lee - khlee@interserve.com.hk.
|
|
MCI Net - postmaster@internetMCI.COM . Per Joel ( Postmaster@mci.net
|
|
) 800-977-iNOC is staffed 24 hours a day. Complaints regarding
|
|
Internet abuse are taken seriously at MCI.
|
|
MCI spam alert to MCI.NET: spamcomplaints@mci.net
|
|
Note : If the Spam crosses MCI lines, Contact security@mci.com if
|
|
the headers in a Usenet or Email spam indicate that it had something
|
|
to do with MCI or its lines.
|
|
MCSNet - support@mcs.net
|
|
Netcom- abuse@netcom.com for standard SPAM junk. security@netcom.com
|
|
is for instances of forgery, cracking etc.
|
|
PSI Net - schoff@PSI.COM - From announce@support.psi.com PSI Net
|
|
policies - http://www.pipeline.com, http://www.usa.pipeline.com,
|
|
http://www.interramp.com
|
|
Slip Net - hellman@slip.net - Tech Support
|
|
Teleport System Administration - teleport.com - admin@teleport.com
|
|
UUNET Customer Liaison - help@uunet.uu.net
|
|
|
|
From : David Jackson (djackson@aol.net) (and this applies to *any*
|
|
abuse) :
|
|
To report an instance of USENET abuse send mail to postmaster@aol.com
|
|
- please remember to include a complete copy of the USENET article,
|
|
including all headers, to help us quickly quash the abuse.
|
|
|
|
Scott reminds us :
|
|
It might also be a good idea to remind people that sometimes the
|
|
postmaster _is_ the spammer. Joe Spam might have his own domain (since
|
|
they _used_ to be free) inside of which they are the postmaster. This
|
|
is terrifyingly common with net.twits (kooks, etc.) but seems rare for
|
|
spam. A quick note that if the spammer is the admin contact in whois,
|
|
notifying the postmaster will surely generate laughs on their end.
|
|
|
|
If you don't get a proper response from the postmaster, remember,
|
|
Whois - rs.internic.net is your friend. You can get information on /
|
|
about a site by:
|
|
|
|
telnet rs.internic.net
|
|
whois spammer.site.net
|
|
|
|
The InterNIC Registration Services Host contains ONLY Internet
|
|
Information (Networks, ASN's, Domains, and POC's). Please use the
|
|
whois server at nic.ddn.mil for MILNET Information.
|
|
|
|
This *should* get you a person to talk to & their personal e-mail
|
|
address. If you don't get any response from that postmaster, then you
|
|
should try the provider to that site. This gets a little trickier,
|
|
but a multinet traceroute should show you the upstream provider, and
|
|
from there you can try contacting the postmasters of *that* site.
|
|
|
|
Worst case, a site can be UDP (Usenet Death Penalty) out so that other
|
|
sites stop accepting news or even e-mail from that site. They are cut
|
|
off from the net. Decisions like this are discussed in the news group
|
|
news.admin.net-abuse.misc .
|
|
|
|
Thanx to Leslie, whom to contact about domains that have invalid
|
|
contact information :
|
|
Internic Registration Services should be contacted by phone:
|
|
703/742-4777
|
|
or email:
|
|
hostmaster@rs.internic.net
|
|
|
|
If you think you know a machine close to the spammer, you can change
|
|
your default DNS lookup server (and get *lots* more info ;-)) by :
|
|
$ nslookup
|
|
> server wb3ffv.abs.net
|
|
Default Server: wb3ffv.abs.net
|
|
Address: 206.42.80.130
|
|
> ls -d kjl.com
|
|
[wb3ffv.abs.net]
|
|
kjl.com. SOA kjl.com dns-admin.abs.net. (10
|
|
21600 3600604800 86400)
|
|
kjl.com. NS ns1.abs.net
|
|
kjl.com. NS ns2.abs.net
|
|
kjl.com. MX 10 abs.net
|
|
kjl.com. SOA kjl.com dns-admin.abs.net. (10
|
|
21600 3600604800 86400)
|
|
|
|
If you are quick enough, you can see if the spammer is still on by :
|
|
|
|
multinet RUSERS rust.nmt.edu
|
|
|
|
And you might get :
|
|
|
|
kuller ray timbers jweinman timbers john timbers rayzer
|
|
|
|
Assuming that the spammer is from ingress.com you can expand the
|
|
Spammers UserID (some sites have expn / vrfy turned off) by:
|
|
|
|
> telnet ingress.com smtp
|
|
Trying 199.171.57.2 ...
|
|
Connected to ingress.com.
|
|
Escape character is '^]'.
|
|
220 ingress.com Sendmail 4.1/SMI-4.1 ready at Sun, 22 Oct 95 15:13:39
|
|
EDT
|
|
expn krazykev
|
|
250 Lipsitz Kevin <krazykev@kjl.com>
|
|
|
|
We connect to port 25 (smtp) and issues an expn command. Looks like
|
|
krazykev@kjl.com is being used as a maildrop for this user. I'll
|
|
would send my complaint to postmaster@kjl.com as well (not that it
|
|
would do any good in Krazy Kevin's case... but the reply to your e-
|
|
mail might be amusing).
|
|
|
|
To find out the Mail Exchange records, do a nslookup for the MX
|
|
records only. You can then look up the expansion of the postmaster or
|
|
root to see who they really are. For example :
|
|
% nslookup
|
|
> set type=mx
|
|
> gnn.com
|
|
|
|
gnn.com preference = 20, mail exchanger = mail-e1a.gnn.com
|
|
gnn.com preference = 10, mail exchanger = mail-e1b.gnn.com
|
|
|
|
% telnet mail-e1a.gnn.com smtp
|
|
220 mail-e1a.gnn.com ESMTP Sendmail 8.7.1/8.6.9 ready at Thu, 11 Jan
|
|
1996 12:54:26 -0500 (EST)
|
|
expn postmaster
|
|
250-<wross@ans.net>
|
|
250 <gnnadvisor@mail-e1a.gnn.com>
|
|
expn root
|
|
250-<mitch@ans.net>
|
|
250 <gnn-monitor@ans.net>
|
|
|
|
You can use the 'host' command. It's really simple:
|
|
% host -t any domain.name
|
|
|
|
This will give you anything your name server can find out.
|
|
|
|
% host -t ns domain.name
|
|
|
|
This tells you the name servers. Not all systems have host, but it's a
|
|
small program which should be easy to compile (like whois).
|
|
|
|
The command "last" will tell where the spammer logged on from last,
|
|
but it has to be done by a user from that site. For example :
|
|
|
|
last imrket4u
|
|
|
|
Would produce :
|
|
|
|
imrket4u ttypf ip30.abq-dialin.hollyberry.com Fri Sep 15 00:27
|
|
- 00:34 (00:06)
|
|
imrket4u ttyq8 ip30.abq-dialin.hollyberry.com Fri Sep 15 00:19
|
|
- 00:20 (00:01)
|
|
imrket4u ttyqc abq-ts1 Thu Sep 14 20:42 - 22:21
|
|
(01:39)
|
|
imrket4u ttyqc rust.nmt.edu Thu Sep 14 18:39 - 18:41
|
|
(00:01)
|
|
imrket4u ttypb abq-ts1 Thu Sep 14 17:55 - 17:57
|
|
(00:02)
|
|
|
|
|
|
Filtering E-Mail using procmail or News with Gnus
|
|
==================================================
|
|
|
|
Get the procmail FAQ :
|
|
|
|
http://www.jazzie.com/ii/faqs/archive/mail/filtering-faq/
|
|
http://www.jazzie.com/ii/internet/mailbots.html
|
|
http://www.cis.ohio-state.edu/hypertext/faq/usenet/mail/filtering-
|
|
faq/faq.html
|
|
|
|
Or read about it when it is posted to :
|
|
Newsgroups: comp.mail.misc , comp.mail.elm , comp.mail.pine ,
|
|
comp.answers , news.answers
|
|
Subject: Filtering Mail FAQ
|
|
|
|
Brian has a Gnus scorefile from the Internet blacklist :
|
|
http://www.cs.ubc.ca/spider/edmonds/usenet/gnus/BLACKLIST
|
|
|
|
Or his example global scorefile :
|
|
http://www.cs.ubc.ca/spider/edmonds/usenet/gnus/SCORE
|
|
|
|
Many news readers have a "kill" file that will filter out the posts
|
|
from either a certain user-id, or posts with certain titles. Each
|
|
news reader is unique. You might wish to read the help file on the
|
|
subject of kill files.
|
|
|
|
Misc.
|
|
=================================
|
|
Origins of Spam
|
|
======================
|
|
The history of calling inappropriate postings in great numbers "Spam"
|
|
is from a Monty Python skit (yes, it is very silly...) where a couple
|
|
go into a restaurant, and try to get something other than Spam. In
|
|
the background are a bunch of Vikings that sing the praises of Spam.
|
|
Pretty soon the only thing you can hear in the skit is the word
|
|
"Spam". That same idea would happen to the Internet if large scale
|
|
inappropriate postings were allowed. You couldn't pick the real
|
|
postings out from the Spam.
|
|
|
|
Black listed Internet Advertisers :
|
|
http://math-www.uni-paderborn.de/~axel/BL/ (Europe)
|
|
or
|
|
http://www.cco.caltech.edu/~cbrown/BL/ (USA)
|
|
|
|
First off, the only CORRECT way to "Spam" the net :
|
|
Show SPAM Gifts http://wolf.co.net/spamgift/index.html
|
|
|
|
A collection of Spam links :
|
|
http://www.io.org/~spamily/Spam.html
|
|
http://wheel.dcn.davis.ca.us/~sean/spam/spam-faq.html
|
|
http://semantic.rsi.com/spam/
|
|
|
|
The Church of Spam :
|
|
http://www.goodnet.com/~swiggy/
|
|
|
|
Come visit Beiner's SPAM-O-RAMA at:
|
|
http://www.geocities.com/Hollywood/6274
|
|
|
|
|
|
The MMF (Make Money Fast) Posts or any fraud on the Internet
|
|
================================================================
|
|
Rolf has created a page dedicated to making fun of MMF losers :
|
|
http://www.clark.net/pub/rolf/mmf/home.html
|
|
|
|
There is a WWW site dedicated to *any* kind of fraud. It is :
|
|
A partnership of the National Association of Attorneys General, the
|
|
Federal Trade Commission and The National Consumers League
|
|
http://www.fraud.org/
|
|
|
|
Wolfgang Schelongowski <ws@xivic.ruhr.de> sez :IMHO MMF is associated
|
|
with "Hello, my name is Dave Rhodes. In 198...".
|
|
There was also a forged article purporting to tell how MMF is illegal
|
|
:
|
|
From: purvis@hoover.fbi.gov (Melvin Purvis)
|
|
^^^^^^^^^^^^^ he arrested / shot John
|
|
Dillinger.
|
|
Subject: 'Make Money Fast' Scam
|
|
|
|
Jon said : "Hermann" appears to have spammed at least 27 Bitnet
|
|
mailing lists, including TANGO-L, where I saw it, with a standard MMF.
|
|
I checked at the US Post Office web site and verified that chain
|
|
letters are federal crimes under Title 18, United State Code, Section
|
|
1302. This does apply to email as well as paper; quoting from URL
|
|
|
|
From http://www.usps.gov/websites/depart/inspect/chainlet.htm :
|
|
"Recently, high-tech chain letters have begun surfacing. They may be
|
|
disseminated over the Internet, or may require the copying and mailing
|
|
of computer disks rather than paper. Regardless of what technology is
|
|
used to advance the scheme, if the mail is used at any step along the
|
|
way, it is still illegal."
|
|
To find your nearest postal inspector in the USA, see URL
|
|
http://www.usps.gov/ncsc/locators/find-is.html
|
|
I believe that the applicable Canadian description can be found at :
|
|
http://www.rcmp-grc.gc.ca/html/commerc.htm
|
|
And from the Canadian Department of Justice server
|
|
(http://canada.justice.gc.ca/):
|
|
STATUTES OF CANADA, C, Competition - PART VI OFFENSES IN RELATION TO
|
|
COMPETITION - Definition of "scheme of pyramid selling" - Section 55.1
|
|
|
|
DOES ANYBODY HAVE POSTAL INSPECTOR ADDRESSES FOR OTHER COUNTRIES THAT
|
|
PONZI / MMF SCHEMES ARE ILLEGAL IN?
|
|
|
|
Those annoying 1-900 & 1-800 Sex Phone Ads
|
|
============================================
|
|
If the ad says "Procall", it is a large service bureau for 1-900
|
|
numbers in Arizona. When you call a pay-per-call number, there should
|
|
be a recorded intro that will give a customer service number. That
|
|
*should* connect with a live person.
|
|
|
|
I would like to thank Eileen at the FTC for kindly answering my
|
|
questions about 1-900 & 1-800 phone numbers.
|
|
|
|
Paraphrasing what she e-mailed me :
|
|
When a 1-900 number is advertised, the price must also be disclosed
|
|
(this may be found at 16 CFR Part 308).
|
|
|
|
When calling a 1-800 number that charges, there must be an existing
|
|
subscription agreement between the buyer and the seller
|
|
|
|
http://www.ftc.gov/ Federal Trade Commission Home Page
|
|
http://www.ftc.gov/bcp/telemark/rule.htm Telemarketing Sales Rule
|
|
http://www.ftc.gov/bcp/telemark/telesale.htm Telemarketing Sales Rule
|
|
http://www.ftc.gov/bcp/scams01.htm Online Scams
|
|
|
|
(from the "Online Scams page)
|
|
|
|
For More Information
|
|
If you have a question or complaint about a suspect online ad or
|
|
promotion, contact your commercial service provider. In addition, you
|
|
can file complaints with your state attorney general, consumer
|
|
protection office or with the Federal Trade Commission (write to:
|
|
Correspondence Branch, Federal Trade Commission, 6th St. &
|
|
Pennsylvania Ave., NW, Washington, DC 20580). Also, contact the
|
|
National Advertising Division of the Council of Better Business
|
|
Bureaus, 845 Third Avenue, New York, New York 10022.
|
|
|
|
Questions about whether or not an investment sales person is licensed,
|
|
or if an offered security is registered, should be directed to the
|
|
Office of Consumer Affairs, Securities and Exchange Commission, 202-
|
|
942-7040.
|
|
|
|
The National Fraud Information Center maintains a toll-free Consumer
|
|
Assistance Service, 1-800-876-7060, to provide consumers with answers
|
|
to questions about telephone or mail solicitations and online scams.
|
|
They also offer information about how and where to report fraud and
|
|
give help in filing complaints.
|
|
|
|
The Better Business Bureau has a web site at:
|
|
http://www.bbb.org
|
|
To give feedback, go directly to:
|
|
http://www.bbb.org/council/feedback/index.html
|
|
|
|
How To Respond to SPAM
|
|
===========================
|
|
|
|
Howard reminds us :
|
|
Note to all: NEVER followup to a spam. NEVER. Express your
|
|
indignation in mail to the poster and/or the
|
|
postmaster@offending.site, but NEVER in the newsgroups!
|
|
|
|
Karen asks:
|
|
But what about the newbies who look at a group, see lots of spam and
|
|
ads, see NO posts decrying them, and conclude that ads are therefore
|
|
OK?
|
|
|
|
Ran replies :
|
|
When it gets bad, you'll usually see some "What can we do about
|
|
this?" threads. That's a good place to attach a reply that tells
|
|
people why it's bad, and what they can, in fact, do.
|
|
|
|
Austin Suggests:
|
|
At the risk of attracting flames, let me suggest an exception to
|
|
Howard's law. A followup is allowed if the following 3 conditions
|
|
hold.
|
|
1) The offending article is clearly a SCAM (for instance, the
|
|
*Canada* calls with the Seychelles Islands phone # scam)
|
|
2) No one else has followed-up with a posting identifying it as a
|
|
scam (in other words, no 'Me too' warnings)
|
|
3) It is unlikely to be canceled soon, either because it seems to
|
|
be below the thresholds, or it is in a local hierarchy that doesn't
|
|
get cancels, or Chris Lewis is on vacation in the Seychelles Islands.
|
|
If all three conditions are met, a followup that X's out the contact
|
|
information , severely trims the contents and identifies the post as a
|
|
scam is exempt from Howard's law.
|
|
Comments?
|
|
Bill's and Wolfgang's addition :
|
|
4) Follow-ups should be cross posted to n.a.n-a.m _and_ the groups
|
|
of the spam, but Followup-To: *MUST* be set to n.a.n-a.m *ONLY*
|
|
_or_
|
|
post a follow-up and *SET* Followup-To: alt.dev.null.
|
|
In the first case change
|
|
Subject: Important FREE $$$
|
|
to
|
|
Subject: SPAM (was Re: Important FREE $$$)
|
|
and include the original Newsgroups and Message-ID line, so the
|
|
professional despammers will immediately find what you're talking
|
|
about. Do not post unless you're absolutely sure that you can do all
|
|
that properly. Also 1) - 3) do apply.
|
|
|
|
If you see the same article with different Message-IDs in several
|
|
groups, collect the _complete_ headers of each article and check
|
|
n.a.n-a.m if it's already been reported. If not, start a thread with
|
|
Subject: SPAM (was Re: <original Subject>) in n.a.n-a.m. Include all
|
|
of the headers and as much of the body of one article as you see fit.
|
|
|
|
|
|
Revenge - What to do & not to do
|
|
========================================
|
|
|
|
No matter how much we hate Spam and how much we dislike what the
|
|
spammers to our quiet little corner of the Universe known as the
|
|
Internet, Spam is not illegal (yet). If you try anything against the
|
|
spammers, please * do not * put yourself in risk of breaking the law.
|
|
It only makes them happy if you get in trouble because you were trying
|
|
to get back at them.
|
|
|
|
The reason why spammers use "throwaway" accounts is because they know
|
|
the e-mail account will be deleted. They usually provide either
|
|
another e-mail address or a name / phone number or postal address so
|
|
that prospective "customers" can be contacted. Be sure to complain to
|
|
the postmaster of all e-mail names provided to make sure that this
|
|
route is inhibited.
|
|
|
|
Telephoning someone
|
|
======================
|
|
|
|
Calling someone once is fine. If enough people are pissed at the
|
|
spammer and they all call the 1-800 number the spammer provides, the
|
|
spammer will get the idea (sooner or later) that it is costing them
|
|
more in irate people (and most especially loss of business) and it is
|
|
not worth it to spam.
|
|
|
|
Do not dial any phone numbers more than once from your home. Phone
|
|
harassment is * illegal * and you * can * be prosecuted in court for
|
|
this. Even tho' *67 prevents your number from being displayed on their
|
|
telephone at home if they have caller ID, *57 will give the phone
|
|
company the number. If it is a 1-800 number there are two problems.
|
|
First they can *always* get your phone number, and secondly it may
|
|
*not* be a toll free number. You may be charged for calling a 1-800
|
|
number.
|
|
|
|
Likewise, do not call collect using 1-800-COLLECT or 1-800-CALL-ATT
|
|
from home, once again this can be traced.
|
|
|
|
Austin comments : I would say that calling a listed non-800 number
|
|
*once* collect to voice a complaint is not harassment, but justified.
|
|
They sent you a postage due message, didn't they? If they don't want
|
|
to accept collect calls, they should say so - and if they do, you
|
|
should be a responsible person and not do it again.
|
|
|
|
AT&T Information for 1-800 numbers is 1-800-555-1212, but that only
|
|
helps if you know the company name you are trying to call. Also, you
|
|
can try searching for a 1-800 number (you do not have to know the
|
|
company name) at :
|
|
http://www.tollfree.att.net/dir800/
|
|
or
|
|
http://www.tollfree.att.net/cgi-bin/taos_mf.pl?unix (advanced search
|
|
options).
|
|
|
|
Snail Mailing someone
|
|
=======================
|
|
|
|
Likewise, one well thought out letter sent to the spammer might help
|
|
convince the spammer not to do this again. Especially if the spammer
|
|
was part of a corporation that didn't realize the detrimental effects
|
|
of spamming the Internet.
|
|
|
|
If you decide to deluge the spammers postal address by filling out one
|
|
or two "bingo" (popcorn) postage paid cards in the technical magazines
|
|
(by circling a few dozen "product info" requests per card & putting on
|
|
printed out self sticking labels with the spammers address), or by
|
|
putting preprinted labels on postage paid cards that come in the mail
|
|
in the little plastic packages, don't organize a public campaign (that
|
|
they can point to) against the spammer in the newsgroup.
|
|
|
|
Scott also reminds us :
|
|
Since this is the "Spam FAQ", I'd like to point this out: You're
|
|
basically Spamming the company offering information in a magazine. It
|
|
costs companies money, not the one you're spamming. They get a free
|
|
pile of junk which is easy to throw out. In other words, this may be
|
|
harming third parties more than the intended target. I'm not trying
|
|
to be Mr. Nice Guy, just trying to point out an important
|
|
technicality.
|
|
|
|
You should also read Title 47 of the United States Code, Section 227.
|
|
There is a FAQ at cornell.law.edu for the text of the law (gopher or
|
|
ftp or http://www.law.cornell.edu/uscode/47/227.html), and you can use
|
|
Dejanews to read the USC 47 thread on n.a.n-a.m. to make up your own
|
|
mind (it invariably comes up) or you can look at :
|
|
http://www.cybernothing.org/docs/code47.5.II.txt
|
|
|
|
Organizing a campaign against the spammer in a news group could lead
|
|
to the spammer trying to get a cease & desist police order against the
|
|
organizers. On the upside note, the spammer will have to try to
|
|
figure out where these "anonymous" cards were coming from (especially
|
|
hard to do in a big city).
|
|
|
|
Of course if someone (every once in a while) reminded the newsgroup of
|
|
the spammers address by posting a message (for informational purposes
|
|
only, and not to encourage mail bombing), I don't see how that could
|
|
be considered harassment ;-).
|
|
|
|
I am not a lawyer, and all of the above could be wrong. 80% of the
|
|
Internet is bull... Free advice is worth every penny you paid for it
|
|
:-).
|
|
|
|
------------------------------------------------------------------
|
|
Do not meddle in the affairs of wizards for they are easily angered.
|
|
E-Mail - gandalf@digital.net - Gandalf The White O- Ken Hollis
|
|
WWW Page - http://digital.net/~gandalf/
|
|
WWW Trace E-Mail forgery - http://digital.net/~gandalf/spamfaq.html
|
|
WWW Trolls crossposts - http://digital.net/~gandalf/trollfaq.html
|
|
|
|
|