Spam Fighting by Cipher

Courtesy of Cipher (Spam Fighting God)

The following was dl'd from the NG that Cipher looks over. There are a lot of URL's and e-mail address's to assist in reporting e-mail Spam and net abuse.

As Brian Moore (Net God) would say, "Kill a spammer for Jesus"

Happy Hunting,

Nail

I love the smell of Spam domains burning in the morning... It smells of

VICTORY !!!

I have seen a return mail percentage from ISP's of about 70% using the methods below. Some say they are issuing warnings, some will tell you the spammers account has been canceled. Resist the urge to post anything to the spammer's thread, they never read their Spam, they just mass post looking for suckers, uhh.. customers. Attaching articles just wastes bandwidth, and clutters up YOUR newsgroup!!

The best way to stop spammers is to contact their ISP and ask politely if they would please stop the spammer. Vulgar language may get YOU reported!! If the spammer has posted a real e-mail address,I write them and copy their ISP using this form :

postmaster@ISP.com or root@isp.com

Or more and more common these days :

abuse@ISP.com

Some spammers will try to hide their ISP from you, generally you can determine who they use from the last part of the path in the header. For example, in this simulated real header portion :

Path:nntp0.mindspring.com!news.mindspring.com! newspump.sol.net! news.inc.net! news.moneng.mei.com! uwm.edu!news-res.gsl.net! news.gsl.net! hunter.remier.net !newsfeed.internetmci.com!nntp.earthlink.net From: User@earthlink.net (Real Name) Newsgroups:alt.bible.prophecy,alt.christnet,alt.christnet.theology,alt.religion.christian,alt.christnet.bible,alt.christnet.philosophy,a.bsu.reliion,alt.athei sm,talk.atheism,talk.origins Subject: Something Date: 22 Jul 1996 20:17:20 GMT Organization: Earthlink Network, Inc.

The 1st ISP in the path is mindspring, my ISP. That's the server I read from. The last ISP listed is earthlink. If the From line was altered to say "JoeBlow@Guesswhere" you would send to postmaster@earthlink. ALWAYS send the complete message, headers and all, it helps the pros find the spammer.

Get a friend at another location, with a different ISP if you can, to send you complete copies to you. Somewhere in the path header you will see something in common. This is probably where the post was inserted and would be the ISP to notify.

Also, if it is a "Make Money Fast" Spam/scam, these are illegal no matter what the spammer claims, refer them to :

www.usps.gov/websites/depart/inspect/chainlet

and send a copy to :

rrbroadnax@uspis.gov

This is their enforcement division.

Also cc these groups : Bureau of Consumer Protection bbroder@ftc.gov Fraud Dept. of IRS net-abuse@nocs.insp.irs.gov National Fraud Information Center www.nfic.inter.net/epoform.htm

send any copy of any 'stock offer' etc to : enforcement@sec.gov

Specific folks you can notify include : Netcom : abuse@netcom.com (for forgery etc. : security@netcom.com) AOL : abuse@aol.com (emergency : atropos@aol.com ) Compuserve : ecgintern@csi.compuserve.com

For serious tracing, go to the definitive FAQ on stopping Spam :

digital.net/~gandalf/spamfaq.html
help.mindspring.com/technotes/97Mar/headers_show.htm
com.primenet.com/spamking/
www.cnet.com/Content/Features/Howto/Spam/
spam.abuse.net

Today the term Spam means "anything I don't like", i.e. off-topic, make money fast, sex ads, etc.

It technically means any article posted to 20 plus newsgroups. Spam has nothing to do with content. A perfectly acceptable article posted here is not Spam. If I post to 20 other groups, it is Spam. Regardless of content.

You don't see as much true Spam these days because people cross-post one article to a gazillion newsgroups at one time. It's easier that way for them to propagate their nonsense. This is called Excessive Cross Posting, ECP.

Another thing called Spam is Unsolicited Commercial E-mail, UCE.

The definitive FAQ on stopping Spam can be found at :

digital.net/~gandalf/spamfaq.html

Also you want to check out this WWW page :

www.cybernothing.org/faqs/net-abuse-faq.html

The origin of the word Spam omes from an old Monty Python sketch in which some Vikings shouting SPAM drown out all other conversation in a restaurant. A restaurant serving such delicacies as Spam and Eggs and Spam and Spam.....

Hope this helps,

Cipher

POINTS TO PONDER :

Point 1. Spammers NEVER read the attachments to their threads!!! They don't make money reading posts!! They just move on to more News Groups (NGs) and make more posts!!

Point 2. One attribute of a virus is "something that consumes disk space in increasing amounts."

Take a look at any RE: post in a news group responding to Spam. Nobody but the posters are ever going to read it, yet this thread is GROWING and CONSUMING more disk space on a server somewhere. (some NGs have smaller threads, I've seen it run to 50% of a NGs contents....) Don't feed and spread this "Virus."

Replying to Spam posts is counterproductive!!

BTW, resist the temptation to respond to the "USA is better than" or the racist and religion posts. You will NEVER change anyone's mind, they only make the initial post to suck people into a flame war.

Also, ignore the "I'm a sick child" posts. They are either hoaxes, or attempts to get people to e-mail bomb another person.

They are "Trolling" , they occasionally open your NG to see how large the thread is that they started and have a good laugh, DON'T bite the hook. It just wastes bandwidth and clutters YOUR newsgroup. Some trolls are very subtle, it ALMOST seems appropriate for the NG, and they appear to be an ignorant but highly opinionated person, making an inflammatory remark. If you don't see a good e-mail address, suspect something. If you feel strongly about the issue, and the NG could live without your post, e-mail the person with your comments. Better the 50+ replies end up in someone's mailbox than cluttering your NG.

Cipher/Member news.newusers.questions Moderation Board Visit my Mac help site at /SiliconValley/Lakes/4404/ PGP Public Key available at my website