how to report spam

i use this spam policy, along with maintaining robust global email filters, running SpamAssassin, and blocking IP addresses that are used for abuse. the result of using these procedures has resulted in my having to get this far MAYBE as many as 10 times in a day, and some days i don’t have any spam at all. YOUR MILEAGE WILL VARY! and, remember… the more you do it NOW, the fewer spam messages everyone gets down the road!

this is written from the perspective of a person who uses an email client and a web browser. if you ONLY use a browser (if you use webmail), there may be extra, intermediary steps that are not written down here.

the first thing you need to know is how to extract headers from your email messages, which is different depending on how you get your email.

  1. once you’ve extracted the headers, go to this URI:

    https://www.iptrackeronline.com/email-header-analysis.php

    leave wherever you have extracted the headers — the “message source” — open, because you’re going to need to copy more of the message, later.

  2. for now, paste only the headers into the form, and click “Submit header for analysis”.

    the analysis is WAY more information than you need, but the information you DO need is right near the top: under the header “Email header analysis report” will be a table that contains “All valid IP Addresses found in the header”, and usually the top one (or, possibly, two) will have an asterisk (*) next to them, which is the “Probable originating IP address”.

  3. copy that address. if it’s two, copy the first one, do the next steps, and then come back and copy the second one and do the next steps for that number, as well.
  4. now, go to this URI:

    https://centralops.net/co/DomainDossier.aspx

    paste the IP address in the “domain or IP address” field, check the following three boxes:

    domain whois record
    network whois record
    DNS record

    and hit the “Go” button.

    then, i find that it’s easiest to use the “Edit” -> “Find In This Page” function of my browser, to search for every instance of the commercial at symbol – @ – which is used in email addresses.

  5. now, go back to the message source, where you extracted the headers (remember that?)

    select and copy the entire message, including the headers. now you can close the message source.

  6. select the message in your inbox, and choose “Forward”.
  7. this will open a new message, with the message you’re complaining about inside a forwarding header. select everything EXCEPT the forwarding header, and delete it. then paste the message source that you copied in where the other stuff used to be.
  8. then, go back to the web browser, and find every email address for the IP address you’re complaining about, and put them into the “To:” line of your new, forwarded message.

    SOMETIMES the information will tell you something like “Report abuse only to…” or something like that. you can do that, if you want to, but frequently the “abuse” address is disabled, and the other addresses aren’t, so i’ve found that it’s a good idea to send email to EVERY address, whether or not it says to.

    if your search at iptrackeronline.com came up with two “Probable originating IP addresses”, now is the time to go back to step 3), copy the second IP address, and continue from there.

    you’ll end up with a forwarded message that contains the raw, text-only message, which is addressed to at least two, and sometimes as many as 9 or 10 email addresses.

  9. if you’re REALLY hung up on privacy, at this point, you can search for YOUR email address using the “Edit” -> “Find” feature of your email client. if you do this, replace every instance of your email address with an X to make it obvious that you haven’t done anything except remove your address from the header. seriously, if you do this, and mess around with the headers too much, eventually someone will complain about it, and YOU’RE supposed to be the one who is complaining, here.

FINISHING TOUCHES:
i usually like to mark my new message “Urgent”, and i also like to get a “Return Receipt” (which is not available on all email clients). i also like to insert the words “ABUSE VIOLATION” in the subject line, prior to the original, forwarded header, so that they know that you’re complaining, and not just sending more spam.

if you (like me) run your email through SpamAssassin, or something like it, you may have a special header section that gives you reasons why this particular message is (or is not) spam. sometimes this will include things like URIBL_BLOCKED information, which gives you the URIs that are used in the message, which are blocked by various spam lists. if you get an identifiable URI, you can use the “Edit” -> “Replace…” feature in your email client to replace these URIs with human-readable, but machine-invisible equivalents, which will further attest to the fact that you’re complaining, and not just sending more spam.

——

it is important to remember that all of this information is time sensitive: if you don’t get around to reporting spam until two or three days later, it has considerably less effect than a report that is made as soon as the spam message is received. generally, if more than 12 hours has passed, i just trash the spam and continue with my life.

about half of the reports i send produce some kind of response. about half of the responses i get are automated, either telling me that the message has been received, or telling me that it has not been received for one reason or another. a few of them are, actually, human responses, usually saying that they’ve forwarded the message to their client (the spammer), or saying that there’s nothing they can do about it. this is where requesting a return receipt is helpful: if you get a return receipt, there’s a good chance that someone at least saw your message. even if the return receipt says “not read”, you know that it’s a good address, and that someone saw your complaint, even if they didn’t do anything about it.

step 9) is important if they say they have forwarded your message to the spammer, because if you have not replaced all of the instances of your email address with an X, then the spammer now has your email address, surprise! they can do whatever they like with it, which usually means sending you more spam. in extreme cases, they send a SHIT-TON of spam (like, 500,000 messages) or try to send you viruses or malware, so it’s really important to do ALL nine steps.

believe me, speaking from personal experience, cleaning up after a 500k message bomb is no fun. 😕

in the case of someone who says there’s nothing they can do about it, that’s the point where i go back to the IP address that i complained about originally, and put the /16 or /24 into my IP blocker (depending on how egregious the abuse has been).

also, i put commonly used words and phrases that typify abuse (things like “ALMIGHTY GOD” and “flight simulator” and “Pílula” and “电子邮“) into my global email filters, and update them with new information frequently.

occasionaly — VERY occasionaly — i get a response such as this one, which makes all of this rigamarole worth while.

also, why i only accept plaintext email (and why you should, as well)

update

it has now been two weeks i haven’t been on fecesbook. i logged in once to alert a vendor from OCF, and i logged in once to clean up my ad settings (which i do regularly, regardless of whether or not i logged in). i discovered that, in spite of my not logging in for two weeks, and clearing out my “interests” before i left, i had collected 15 or 20 new “interests”, which included “protest”, “activism”, “guns”, “law enforcement” (specifically “law enforcement in stockton, california”), and a number of other things that make me seriously wonder about my compatibility with fecesbook’s “algorythm”. i’m on the verge of deleting my account, all together.

the lack of fecesbook still leaves a void in my life, which has yet to be filled, but i am confident that it will be filled, very likely with multiple things that i enjoy a HELL of a lot more than being chained to fecesbook.

i have a sousa band gig at deception pass on saturday, and a snake suspenderz gig next wednesday at “lake city mini-park”, which is an intersection on lake city way that used to be full of shopping-basket-homeless people… well, the homeless people are still there, but now they have a “mini-park” that the city put in to encourage them to go elsewhere… and, apparently, the city has also hired snake suspenderz (and another klezmer group with whom thaddeus plays) in order to make it look like the homeless people are a smaller proportion of the city population than they really are. seriously, this place has been a gathering place for homeless people since i was a cab driver, in the mid-’80s. it’s going to take a lot more than a “mini-park” and outdoor concerts to make them disappear.

moe and the dogs may accompany me to deception pass, on saturday. the plan (whether or not moe and the dogs go along) is to make it a day trip, and drive up the peninsula to port townsend, and take the ferry, then come home through mount vernon. i have to be in deception pass by 5:30, the concert starts at 7:00 and should be over by 9:00. we’re having dinner with friends ross and leanna, and leanna’s brother and his wife, on friday.

official news

i spent a week without connectivity, at the oregon country fair, last week.

when i returned, i had no desire, whatsoever, to reconnect to fecesbook.

tomorrow, i will have been home exactly one week. during that time, i have actually logged into fecesbook once, and that was to alert a vendor i met at OCF that i was no longer on fecesbook, and that she should contact me using email.

i have connected with a few people on fecesbook messanger, but that has diminished considerably over the past couple of days.

the longer i am resolute in my decision not to reconnect to fecesbook, the longer it has been since i connected, the more convinced i am that i have definitely made the right decision.

and, when i went back and looked at my first ‘post-farcebook‘ post, i find that, not only can i do without those connections, i am actually somewhat put out that the people listed in that post don’t do the same, and join me in abandoning fecesbook, but if they’re not going to join me, the fact that they’re not has no effect on my life, so i don’t really care. it just means that they won’t be able to contact me as often.