OK, I've got a couple, here. The first is a header of a Pyramid spam that
I got a while back. After the step by step I'll let you know what
happened with it.
The "short" header
-----Original Message-----
From: Larissa Jane <larissajane@hotmail.com>
To: Don***@[XXX].com <Don***@[XXX].com>
Date: Monday, June 29, 1998 1:25 PM
Subject: Dear friend,
Yeah, Well, this doesn't tell you a whole lot. If you sent this to Hotmail,
They'd tell you (via auto-responder) that the account has been closed.
We're done, right? Wrong. We need to pull the FULL header off of this bad boy
To see who really sent it.
(Now I'm using Outlook Express as my POP3 mail program. I'll try Netscape,
But don't blame me if it isn't entirely correct.)
Netscape:
Go to 'options', then 'Show headers', then highlight 'all'. Simple.
All your mail should now show the full header when opened. As far as
Copying the header to your forward? Good luck. (I'm sure SOMEONE
will let me know how)
Outlook Express:
Let's start by going to your inbox, Where the offensive piece of spam is.
R-click on the message, and L-click on 'properties'. You should have a
window with the properties of that message. L-click on the 'Details'
tab, and you should have a window with the header in it. Click and drag
to highlight the header, R-click and choose 'copy', and 'paste' it to your
forward.
AOL's "mailserver":
The header should be a part of the message you've recieved
(tacked on to the bottom). Make sure you copy it to your forward
before you send it.
(NOTE:When you do this for a while you see small differences in
the format of the E-mail sent. This can help you finger out who
sent it)
The header:
OK, our sample header looks something like this:
Received: #############(this is where it came to me.)##########
id NW51S6W1; Mon, 29 Jun 1998 16:25:43 -0400
Received: from netlink.com.au ([203.16.172.1])
by bftoemail2.[XXX].COM ([XXX] [XXX] Mail v1.0
with message handle 980629_160603_1_bftoemail2_smtp;
Mon, 29 Jun 1998 16:06:03 -0500
for don***@[XXX].com
Received: from reubsnt (slmlb7p43.ozemail.com.au [203.108.182.235])
by netlink.com.au (8.8.5/8.8.5) with SMTP id GAA04309
for <Don***@[XXX].com>; Tue, 30 Jun 1998 06:11:55 +1000
Date: Tue, 30 Jun 1998 06:11:55 +1000
From: Larissa Jane <larissajane@hotmail.com>
To: <Don***@[XXX].com>
Message-Id: <18161.235976.25190596 Don***@[XXX].com>
Subject: Dear friend,
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
WOW! A lot different than the "short" version in the forward, huh?
Now let's look at it:
every time there is a 'Recieved:' it is either another leg of the
electronic journey, or a forgery. The first leg:
Received: from reubsnt (slmlb7p43.ozemail.com.au [203.108.182.235])
by netlink.com.au (8.8.5/8.8.5) with SMTP id GAA04309
for <Don***@[XXX].com>; Tue, 30 Jun 1998 06:11:55 +1000
OK, we go to our DOS prompt and do a trace:
(We join the trace, already in progress)
6 172 ms 168 ms 170 ms core3-hssi3-0.Atlanta.MCI.net [206.157.77.113]
7 230 ms 232 ms 233 ms bordercore4.SanFrancisco.MCI.net [166.48.18.1]
8 440 ms 437 ms 466 ms telstra.SanFrancisco.MCI.net [166.48.19.250]
9 453 ms 456 ms 452 ms Fddi0-0.pad10.Sydney.telstra.net [139.130.249.231]
10 446 ms 446 ms 443 ms ozemail.lnk.telstra.net [139.130.32.18]
11 439 ms 448 ms 442 ms ciscosyd1fe11-0-0.gw.ozemail.COM.AU [203.108.0.49]
12 666 ms 675 ms 663 ms mel1s3-1.gw.ozemail.COM.AU [203.7.191.158]
13 mel1s3-1.gw.ozemail.COM.AU [203.7.191.158] reports: Destination host unrea
chable.
Trace complete.
In this case, "...reports: Destination host unreachable." was due to
the fact that the user has been shut down. Look at the last traced destination;
mel1s3-1.gw.ozemail.COM.AU [203.7.191.158]
We'll go to our 'NETDEMON' and do a Whois on "ozemail.com":
Registrant:
OzEmail Ltd. (OZEMAIL@-DOM)
Level 1, MDIS House, 39 Herbert St
St. Leonards, NSW 2065
AU
Domain Name: OZEMAIL.COM
Administrative Contact:
Kent, Andrew (AK!-AU) andrewk@ozemail.com.au
+61 2 437 5500 FAX +61 2 437 5888
(Etc. etc. etc.)
OK, so let's see what (or who) we're dealing with. Go to your browser and
punch in the address: 'www.ozemail.com.au'
Cool, "Australia's LARGEST Internet Service Provider". Bet they don't want
any bad press. Lets see if they have an anti-spam policy (usually under
'User Policies'):
"3.3 Disruption of the network is not allowed
You may not use the service to interfere with or disrupt other network
users, services or equipment. In particular, for example, you must not:
-distribute messages to inappropriate or unrelated forums,
newsgroups or mailing lists (`spamming');
-send unsolicited commercial messages;
-propagate computer worms, viruses and other types of malicious
programs;
-make transmissions of any type or quantity which adversely affect
our operation or jeopardise the use of our service, or its performance
for other subscribers;
-and harass or impersonate OzEmail or other users."
Good. Now we can look for some addresses to send copies of this thing to.
First go to:Complaint addresses
'postmaster@ozemail.com.au' and I go for 'abuse@ozemail.com.au' too just
to make it official. Most large ISP's have abuse addresses.
Now, since it was a pyramid scam, we can send a copy to the ACCC. It's the
Australia's Consumer Affairs. (Australian Competition and Consumer Commission)
They have an addresss to report internet abuse: 'sweep.day@accc.gov.au'.
I bet they'de LOVE to here about a skam in their own backyard.
And don't forget Hotmail: 'abuse@hotmail.com'. Even though the message didn't
Originate from there, we still should send a copy there so if the person is using
the account for replies, people that don't know any better won't be victimized.
(NOTE: Also something I did not do on this particular E-mail,
is notify the postal inspector (your local phone book has the appropriate
phone numbers). They also have a website: here)
The outcome:
This is a copy of the E-mail I sent out to those addresses:
"Please take action in regards to this UCE. I have traced it's probable
origin to:
"14 711 ms 693 ms 679 ms slmlb7p43.ozemail.COM.AU [203.108.182.235]".
***To postmaster/abuse @ ozEmail:
I have read your policy and feel that this a violation of section 3.3:
(3.3 Disruption of the network is not allowed
"You may not use the service to interfere with or disrupt other network
users, services or equipment. In particular, for example, you must not:
*distribute messages to inappropriate or unrelated forums, newsgroups or
mailing lists ('spamming')
*send unsolicited commercial messages;
*propagate computer worms, viruses and other types of malicious programs;
*make transmissions of any type or quantity which adversely affect our
operation or;
*jeopardise the use of our service, or its performance for
other subscribers; and
*harass or impersonate OzEmail or other users.)
If this was not originated at [203.108.182.235] please note that your
services were used against your policy, and forward this to it's proper
origin.
***Fraud info and Government organizations:
Since this UCE is asking that I send $5 dollars cash, and admits to be a MLM
"scheme", I thought you should be aware.
***Hotmail abuse:
I realize that the message was not sent from you, however it does make use
of one of your accounts as a return address. I know of your strong anti-spam
stance and greatly appreciate your help in the past. Please look into this.
***TO ALL:
Please respond to me with the action taken in this matter. I am aware of the
workload that you all must have, but it is good to hear when/if something is
being done about internet abuse. Thank you for the time that you take in
this matter,
Don."
(With the FULL header attached to the FULL E-mail message)
The responses:
From: Systems Administration <abuse@ozemail.com.au>
To: Don <Don***@[XXX].com>
Date: Friday, July 03, 1998 12:58 AM
Subject: Re: Fw: Dear friend, A-9***28-0**
Hello,
The account responsible has been closed.
...This issue will be tracked by the reference number in the subject
of the email. In all future correspondance regarding this issue,
please quote this reference. Please email all abuse issues to
abuse@ozemail.com.au.
And, Of course, Hotmails auto-responder sent a message EXACTLY like
the one in the 'response page'.
These are the only two that matter. And it was another "kill" in the
war on spam.
Let's look at a different one:
A friend in Cali got this one:
In a message dated 98-07-12 04:52:45 EDT, bareitall@ameritech.net writes:
<HTML><PRE><BODY BGCOLOR="#e7e7cd">
Did You Know That July 6 - 12, 1998 Is The Last Week To Enter
Adult Services On AOL? They Will Now Be Censoring After That,
So If You Are Interested In Accessing XXX Hardcore Entertainment,
Now Is The Time! Here Is My Personal Favorite Adult Site. If You'd
<A HREF="http://206.217.29.###/~[blah,blah,blah].html">Click Here</A>, You
Can Get In Free All Week. Enjoy It Before It
Ends!</PRE></HTML>
And the corresponding header:
----------------------- Headers --------------------------------
Return-Path: <bareitall@ameritech.net>
Received: from relay##.mx.aol.com (relay##.mail.aol.com [###.###.###.###])
by
air12.mail.aol.com (v45.18) with SMTP; Sun, 12 Jul 1998 04:52:45 -0400
Received: from UPIMSRGSMTP04 (upimsrgsmtp04.msn.com [207.68.152.48])
by relay19.mx.aol.com (8.8.8/8.8.5/AOL-4.0.0)
with ESMTP id EAA07290;
Sun, 12 Jul 1998 04:52:19 -0400 (EDT)
From: bareitall@ameritech.net
Received: from 2-5 - 206.141.213.91 by msn.com with Microsoft SMTPSVC;
Sun, 12 Jul 1998 01:52:12 -0700
To: bareitall@sprynet.com
Subject: Let`s get to know eachother better
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
Message-ID: <0a77c1252080c78UPIMSRGSMTP04@msn.com>
Date: 12 Jul 1998 01:52:14 -0700
This ones a little tricky, because the message ID reads:
Message-ID: <0a77c1252080c78UPIMSRGSMTP04@msn.com>
Came from MSN right? I don't think so. Look at the first 'Received' blocks:
Received: from 2-5 - 206.141.213.91 by msn.com with Microsoft SMTPSVC;
So let's look at the IP of origin via 'NETDEMON's IP lookup:
dyn1-tnt8-91.detroit.mi.AMERITECH.net (206.141.213.91)
Ameritech. Not at all MSN. Just to be sure you're on the right track,
Read over the E-mail and See what kind of content it has:
<A HREF="http://206.141.29.###/~[blah,blah,blah].html">
Same DNS. Let's look at the Whois entry (NETDEMON) for Ameritech.net:
Ameritech Interactive Media Services, Inc. (AIM2-ORG) hostmaster@AMERTIECH.NET
(Blah, blah, blah)
Domain servers listed in order:
NS1.AMERITECH.NET 206.141.251.2
Everything is pointing to Ameritech. MSN is looking like a victim, their server
has been used to send this (raped), and Ameritech is hoping that you'll complain to
MSN, and in turn, clog up MSN's resources, instead of theirs.
(So if spamming isn't so bad, why are these creeps sending through
someone else's server?)
When I respond to these people, based on the pornographic content,
I send something that looks a little like this:
"I am sorry to have to be writing you this, but I think harvesting my
address from a newsgroup, that regularly has people under the age of
eighteen/twenty-one posting on it, is NOT good business. I received this UCE
from someone there, and do not appreciate it's content. I don't want to make
it seem like I am against such sites, and you are more than welcome to post
this message on a RELEVANT newsgroup (i.e. alt.binaries.pictures.sex) I/we
are not happy to receive spam of an off-topic nature. I also don't think
that I should have to reply to remove my name from a mailing list that I did
NOTHING to get on. Please see that this incident is taken care of, and If
the parties involved are worried about further responses of this nature,
then I suggest they do not harvest E-mail addresses from ANY newsgroups, in
the future. Thank you for your time,
Don
(Stop the inSPAMity!)
(OK, so it's a groaner, you can blame Dave here)
Now, not all of them are easy, But with a little bit of
detective work, you can find the culprits behind this. Keep trying, the
more you do it, the better you get. And it's a good feeling, knowing that
you, uh, "Helped take a bite outta' spam".
(I couldn't resist!)
|
