Find out where junk mail is coming from
Spam will end when it is no longer profitable.
This is the easiest way to fight spam, and certainly one of the best.
Since spammers know and fear such reports, they have a go at hide.
Tim Robberts / Stone / Getty Images
That’s why finding the right ISP isn’t always easy.
However, there are tools likeSpamCopthat simplify reporting spam correctly to the accurate address.
Determining the Source of Spam
How does SpamCop find the right ISP to complain to?
It takes a close look at the spam message’s header lines.
These headers contain information about the path an email took.
SpamCop follows the path until the point from which the spammer sent the email.
Let’s take a closer look at how this works.
Email Header and Body
Everyemail messageconsists of two parts, the body andthe header.
The body has the text and the attachments.
They are just convenient.
That’s why they insert fictitious email addresses in the From lines of their junk messages.
Received Lines
The From line is useless in determining the real source of an email.
You don’t need to rely on it.
The headers of every email message also contain Received lines.
Email programs do not usually display these, but they can be beneficial in tracing spam.
Imagine every post office putting a unique stamp on each letter.
If you got the letter, you could determine the exact path taken by the letter.
This is precisely what happens with email.
The Received line is always at the top of the message header.
Received Line Forging
Spammers know that people apply this procedure to uncover their whereabouts.
They might insert forged Received lines that point to somebody else sending the message to fool the intended recipient.
Every server notes who it is and where it got the message from (in IP address form).
If the two don’t match, the earlier is a forged Received line.
In this case, the email’s origin is what the server placed immediately after the forged Received says.
We’ve just received an exemplary piece of spam that we can use for exercise.
Here are the header lines:
Can you tell the IP address where the email originated?
Sender and Subject
First, look at the forged From line.
The spammer wants to make it look like the message came from a Yahoo!
Next, the Subject is a curious accumulation of random characters.
Still, it is also quite skillfully crafted to get the message across despite this.
The Received Lines
Finally, the Received lines.
So far, this is in line with what the previous Received line said.
Now let’s see where our mail server did get the message from.
To find out, look at the IP address in brackets immediately beforeby mail1.infinology.com.
This is the IP address the connection was established from, and it is not 38.118.132.100.
No, 62.105.106.207 is where this piece of junk mail was sent from.
