Text 153, 37 rader
Skriven 2004-12-25 13:15:08 av mark lewis (1:3634/12)
    Kommentar till text 149 av Frank Vest (1:124/6308.1)
Ärende: Fighting Spam
=====================
 GM>> Now, in regards to where the "proper place" is...
 GM>> (someone please correct me if my presumptions are
 GM>> wrong) In the header of every email, is the address
 GM>> of every ISP that "handled" (routed) the email before
 GM>> it reaches you.  There is software available that
 GM>> will parse the header and reveal the originating ISP
 GM>> from where the spammer initiated his/her junk. (this
 GM>> doesn't always work because some of the "smarter"
 GM>> ones are quite ingenious in their methodology.)

 FV> You've stated the problem. "this doesn't always work....". :(

that is actually not truely correct... you can always find the last injection
point... shutting down the spammers isn't always enough... you also need to
shut down the open proxies and relay points... its been shown that the huge
numbers of worms out there are parts of the spammer's army of attack modes...
the goal being to compromise a system so that it can be used for other
purposes... one such purpose being to relay email... getting the ISPs to
shutdown those compromised systems on their networks can be tricky but seems to
work in most cases /if/ the ISP isn't blackhat and if their network is set up
in such a way that they can track who is on what IP number at any time...

in looking at the headers of the message(s), one needs to follow the Received:
lines from the top down until the next one fails to match the previous... the
spammers can fake all the Received: lines /except/ for the top one... that top
one is put there by the ISP's mail software... it should tell what machine
connected to the ISP and dropped off the mail... it is quite a simple path to
trace... one should also be aware of the practise of "misnaming" the spamming
machines to try to throw folk off the trail... i regularly see spam arriving
here with a name that looks like an IP address in my ISP's range...

i'm hoping that we may be able to post some samples and explain how to trace
them back...

)\/(ark

 * Origin: (1:3634/12)