Aunty Spam: How to Read Headers to Report Spam   - 2,736 Views, 5 Comments

—

Dear Kim,

You raise a number of interesting points and questions in your email. First, if you get spam which appears to be from someone at Hotmail, then pretty much the only thing which you can be certain of right off the bat is that it isn’t from Hotmail. So Hotmail was probably correct in returning the spam to you, even though you were trying to do the right thing.

In fact, if you receive spam of the real, true “Make Money Fast” variety, you can rest assured that 99.9% of the time the domain featured in the “From:” email address will belong to an ISP or other Internet site which has no connection to the spam whatsoever (Aunty is a lawyer so she gets to use big words like that). This is known as “domain spoofing”, and it is now illegal under CAN-SPAM. Of course, littering is illegal too, but that doesn’t seem to stop the litterbugs either.

You are to be commended for wanting to dive into the world of reading headers, and while on some levels it can be very complicated, there is a first level on which it is not difficult at all, and can still be very useful. The first thing you will need to do is to open up an email, and then switch to the ‘full header view’. This is called many things by many different email programs, but the most common terms are “full headers”, “all headers” and “raw view”. Aunty’s email program calls it “long headers”. Whatever your email program calls it, switch to that view.

Now you will note that in addition to seeing the traditional headers such as “From:”, “To:”, “Subject:”, and “Reply-To:”, you will also see lots of other lines, many containing IP addresses. The answer to the question “to whom do I report this spam” lies within these lines. These lines can tell you where the spam originated (or at least what the next closest link was), where it went from there, through which Internet locations it hopped, and generally the path it took to get to your front door. You only have to know how to read the information. If you want to delve even deeper, you can learn all sorts of things, such as where the spammer was geographically when they sent the offending message, what time they sent the spam, and what sorts of resources they abused in the process. But for our purposes we just want to know the path the spam took to get to you.

However, rather than tell you how to read those lines, Aunty is going to refer you to a couple of sites which will not only tell you how to read those headers, but will do so far better than could Aunty. The links are at the end of this missive.

Once you have determined the path which the email likely took, you will a) realize that indeed the email never came close to the domain which is featured in the “From:” address, and b) have a good sense of where its been (no, that doesn’t mean that you can put it in your mouth), so that you know to whom to report it.

Now, once you know the sites which were involved, how do you determine the email addresses to which you should send your complaints? Conventional wisdom holds that any responsibly administered mail server will maintain either or both of postmaster@domain and abuse@domain. These are known as role accounts, and while there can be many other role accounts (for example “root”, “webmaster” and “news”), these are the only two with which we need concern ourselves for this exercise. Of course, conventional wisdom is not always right - the recommended role accounts are not always set up, but that is not your problem. Aunty recommends that once you determine to which sites you want to send the reports, you send them to postmaster@domain and abuse@domain. So, for example, if you have figured out that one of the domains involved in transitting the spam is “jafljdjadjk.com”, you may want to send email to postmaster@jafljdjadjk.com and abuse@jafljdjadjk.com (note that this is a made up domain, so that if any spammer scrapes these addresses it won’t cause anybody real to get spammed).

When reporting spam, you should always assume that the site to which you are reporting the spam probably does not know that they have an embarrassing spam problem, and so should approach them with gentleness and respect (good advice for all initial encounters, online and off, thinks Aunty). You should also assume, particularly with an Internet site of substantial size, that their abuse staff is horribly understaffed and overworked, and so a delay in response of a few days may not be unreasonable (in fact some sites don’t respond to the person making the report at all).

Aunty promised you some links to sites which will teach you how to divine the information contained in the headers of your spam, and here they are:

PO Box Header Reading Tutorial
Stop Spam.org Header Reading Tutorial

If all of this seems rather daunting, and related to your MailWasher problems, you may want to consider using one of the services available now which lets you automatically report your spam to a central clearinghouse, where they collect the data and use it to help boost their spam filters, which in turn helps to ensure that you (and all of your fellow service users) don’t receive that same spam again. One program which Aunty can recommend is Cloudmark’s “SpamNet” for Outlook and Outlook Express. Cloudmark is currently running a free trial, so that you can try SpamNet with no obligation.

Whatever you do, don’t let the spammers get you down, and keep on reporting!

Kissy kissy,

Aunty Spam