The spread of spam will continue to the extent that makes profit. If nobody buys from spammers or acts to their scams, spam will end. This is the most obvious and easiest way to fight spam. You can ignore and delete spam emails you receive. You can also take revenge from spammers complaint with the spammer's Internet Service Provider (ISP). The ISP) is their connection, and perhaps with a fine (depending on your ISP's Acceptable Use Policy. Attention Spammerssuch complaints and try to hide their messages. Therefore, the right ISP is not always easy.
See in a spam message. Every email message consists of two parts, the body and head. The body is the actual text message and attachments. The header is a way of managing the message. The header shows the address of the sender of the message, the address of the recipient of the message, the message subject and other information. E-mail programs generally show thatHeader fields
From: shows the sender's name and e-mail.
A: shows the recipient's name and e-mail.
Date: shows the date on which the message was sent.
Subject: shows the message subject.
From: field usually contains the sender of the e-mail. In this way you can know who sent the message and allows you to respond. Spammers, of course, I will not reply and do not want you to know who they are. Therefore,have made false e-mail addresses in the From: lines of their e-mail. Thus, the From: field does not help you determine if you where the mail is spam.
Just as a check point is going through a number of post offices, before the recipient of an email message is sent to be processed by several mail servers. Each mail server adds a row in the header of the message - a message received: the line - contains
- The server name and IP address of the computer, the server has received theMessage out and
- The name of the mail server itself.
Each line Received: headers at the top of the message added. If we take the message of the path from sender to receiver to play as, starting from the top Received: header and go down to the last, where the e-mail that has been created.
Just as the From: field the Received: lines may contain falsified information for those who want to track the crazy spammers. Since every mail server insertsReceived: line at the top of the header analysis starts from the top.
The Received: lines are usually forged by spammers seem normal fields Received:. You can hardly tell whether the Received: line is fake or not before, at first sight. We should all Received: lines chain to analyze to understand a fake Received: field.
As we have said, all the mail server keeps track of not only his name, but also the computer's IP address, has received the message. We must try to convenience, whichName of a server uses and what does the next server in the chain. If the server does not match, the first Received: line is forged.
The origin of the e-mail address is what the server immediately after the said forged Received: line, where he received the message.
Let's see how to determine the origin of spam e-mail works in real life. Here's the header of the spam message is that we received recently:
**************************************************
Return-Path: <umceqhzjmndfy@hawaiicity.com>
Delivered-To: press@mydomain.com
Received: from unknown (HELO 60.17.139.96) (221.200.13.158) by mail1.myserver.xx with
SMTP; November 7, 2006 10:54:16 -0000
Received: from 164,145,240,209 to 60.17.139.96; Tue, 07 Nov 2006 05:53:35 -0500
Date: Tue, 07 Nov 2006 12:48:35 +0200
From: Pharmacy <umceqhzjmndfy@hawaiicity.com>
Reply-To: umceqhzjmndfy <umceqhzjmndfy@hawaiicity.com>
X-Priority: 3(Normal)
Message-ID: <@ 15,216,897.20061108040652 hawaiicity.com>
A: press@mydomain.com
Subject: Cheap Med * s V! Many Agra Med_s QnNXpRy9
MIME-Version: 1.0
Content-Type: text / html; charset = us-ascii
Content-Transfer-Encoding: quoted-printable
**************************************************
At first, watching the tennis false:. The e-mail address in the From: and Reply-To: lines do not exist. So the spammer took careBounced messages over the line and all the outraged responses to a non-existent people can e-mail account.
Secondly, the line item. It contains the changes Meds "and" Viagra ", words that are known to be fulfilled in spam messages. Plus, it contains the subject of a series of random characters. It is obvious that the object is cleverly designed to deceive spam filters.
Finally, we analyze the Received: lines. We start with the oldest - Received: from164,145,240,209 of 60.17.139.96; Tue, 07 Nov 2006 05:53:35 -0500. There are two IP addresses in it: 60.17.139.96 says it received the news of 164,145,240,209.
We check whether the next (and last, in this case), the mail server in the chain confirms the state of the first Received line:. Received in the second field, we have: Received: from unknown (HELO 60.17.139.96) (221.200.13.158) by mail1.myserver.xx with SMTP; November 7, 2006 10:54:16 -0000.
mail1.myserver.xx is our server and wetrust. Received the news a "unknown" host, who says that is the IP address 60.17.139.96. Yes, confirmed that the front says Received:.
Now we want to know where our mail server is the message. To this end, we mail1.myserver.xx the IP address in brackets before the name of the server. Is 221.200.13.15. This is the IP address of the connection was made, and is not 60.17.139.96. The spam from 221.200.13.15.It is important to note that not necessarily mean that the spammers computer 221.200.13.15 and sending spam is sitting on the world. It allows the owner of the computer did not even imagine that spam. The computer can be replaced by a spam Trojan, the spread is not the owner of the machine is to know, are abducted.
We hope this information helps you, the spammer's ISP and they report on spam, so they can take appropriate action.
corporate team building seattle emtek doorknobs antler lighting