“What do you know about this business?” the King said to Alice.
“Nothing,” said Alice.
“Nothing whatever?” persisted the King.
“Nothing whatever,” said Alice.
“That's very important,” the King said, turning to the jury. They were just beginning to write this down on their slates, when the White Rabbit interrupted: “Unimportant, your Majesty means, of course,” he said in a very respectful tone, but frowning and making faces at him as he spoke.
“Unimportant, of course, I meant,” the King hastily said, and went on to himself in an undertone, “important--unimportant-- unimportant--important--” as if he were trying which word sounded best.
Some of the jury wrote it down “important,” and some “unimportant.” Alice could see this, as she was near enough to look over their slates; “but it doesn't matter a bit,” she thought to herself.

         - Alice's Adventures in Wonderland by Lewis Carroll

 Spam Spade

his is where I tell you to ditch the hot cocoa and grab yourself a beer. We've got serious work a brew'n!

Some ISPs are very responsive and take spam seriously. Some don't. It's all the same to me. I dutifully report each and every one. Why? There are legendary tales of even the most hardened spamhaus going legitimate after years of complaints. But tracking down the source of the abuse is hard work. You need to become a spam detective. To be frank, while I wish to enlist more crusaders to the anti-spam movement, I have a little confession to make. I'm a lousy example of one myself. Yeah, and I have the nerve to run this web site to boot. Go figure

The problem is that spammers work hard at hiding their tracks. Trying to sort through all this mess isn't easy. Spammers highjack open relays and spoof their headers to fool you so you can't find out the source of the spam. If it takes 10 minutes per spam of investigations and you get 40 spams per day… well, you do the math!

So, first I'm going to show you the short cut. You can fully automate this process by registering with SpamCop. Filing a report takes less than a minute. I won't bore you with the details since their site does an excellent job of explaining their free service but I will mention one nice benefit. SpamCop gathers statistics on the spam reports. This information is used to put together filter lists used by large organizations to protect themselves from the flood of spam. It's a perfect win-win situation. You save a lot of time reporting spammers abusing your inbox as you help others protect their inboxes. I highly recommend using this valuable service.

Now for the hard way. Best roll up your sleaves for this exercise.

Spammeister would like to share with you a piece of spam some spamhaus was nice enough to send to him. Click here to peak at it, including the headers. I've added a generous dose of tooltip help to point out the hightlights. Simply run your mouse over the highlighted teal text. I'll be waiting here when you're done.

Finished? Good. So what did we learn? Let's recap:

• When reviewing a spam header start from the top and work your way down.
• Go through the "received" lines until you find the first one that's bogus then stop. You can go no further.
• A valid "received" line will be formatted like bright09.icomcast.net (bright09-qfe0.icomcast.net [172.20.4.71]). What's inside the parenthesis matches what's outside.
• A spoofed "received" line often will be formated like yahoo.com (snovosti-2.ukr.net [212.42.73.138]). What's outside the parenthesis, yahoo.com, doesn't match what's inside the parenthesis. We assume what's in the parenthesis is correct.
• Use a tool like Sam Spade software or the UXN Spam Combat web site to verify the IP address on the spoofed line. snovosti-2.ukr.net pans out. It's IP address is indeed 212.42.73.138. Yahoo's IP addresses, 66.218.71.112 and 66.218.71.112, don't match. The header is faked so it's spam.
• Do a WHOIS to find a contact at our last known valid domain, snovosti-2.ukr.net. A lot of contacts can be listed in a WHOIS result. I pick noc@ukr.net, the address for a "notify" contact. In my limited experience, noc's belong to folks who don't deal with spam complaints. So I will send my complaint to postmaster@ukr.net.
• Since this is confirmed spam do not send email to any of the email addresses provided in the header (reply-to's) or in the body (mailto's). At best, it is a bogus address and the email will bounce back to you. At worse, your email will confirm your address as valid to the spammer. He'll keep sending you spam and share his list with all his spammer buddies.
• Next look for web links in the body of the message. These are usually valid addresses. This is how the spammer earns his money, by suckering you into visiting his site.
• We do a WHOIS on the web link. Again, we'll send email to the postmaster. Often I'll send an email to abuse as well. For giggles I looked up the domain in SPEWS to read their squalid spamming history.
• I also hope you learned how much work this is. While this spam example is pretty typical, some can be tougher nuts to crack. There's no template for tracking spammers. As you get more experience you'll need to use tools I didn't even touch on like traceroute. But that's the challenge of being a spam sleuth.

Boy, did you earn that beer! Good job. Ready to move onto cobbling together a spam breastwork (no, I'm not talking about sex)? Click here.