Spam-tracking 104: a spammer unmasked; by Bill Mattocks
Spam-tracking 104:
a spammer unmasked

by Bill Mattocks

This is an actual case study of a spam that I received today and tracked to the source. It is intended as a lesson in spam-tracking for the uninitiated or the beginner in spam-tracking. It shows that with patience, all things are possible.

Are you sitting comfortably? Good, then I'll begin.

Today I got spam. That's nothing new, I get spam everyday. But this spam was from Wisconsin, and I happen to live in Wisconsin. I feel a powerful need to get rid of spam in Wisconsin. So, here is what happened and what I did about it.

This is the spam I got:

*****************************************************************************
>Received:  from  mail.tds.net  (unverified  [204.246.1.2])  by  mail.comp-sol.com
>  (EMWAC  SMTPRS  0.83)  with  SMTP  id  <B0000040843@mail.comp-sol.com>;
>  Mon,  06  Oct  1997  15:55:11  -0500
>Received:  from  Comp1  (mewi0-a10.midway.tds.net  [204.246.12.107])
> 	by  mail.tds.net  (8.8.5/8.8.5)  with  SMTP  id  PAA03860;
> 	Mon,  6  Oct  1997  15:19:42  -0500  (CDT)
>Date:  Mon,  6  Oct  1997  15:19:42  -0500  (CDT)
>Message-Id:  <199710062019.PAA03860@mail.tds.net>
>From:  webbs@tds.net
>Subject:  Your  Home  And  Family

>YOUR  HOME  AND  FAMILY

>Now  available,(Your  Home  and  Family),  the  consumer  guide  everyone
>has  been  asking  for.

>This  guide  is  filled  with  information  every  household  should  be
>aware  of.  Protect  yourself  and  your  family,  be  informed  of  the
>real  life  events  that  can  happen  to  you  and  your  household.

>Read  about  wills  and  trusts  (don’t  let  the  government  take
>everything)!

>Parents  worst  fears-  (Drug  Abuse,  maybe  its  already  there)!  Be
>informed!

>Dealing  with  divorce  “Get  It  Together”  “Not  The  End”.

>Safeguards  against  rape....Don’t  let  it  happen  to  you,  worse  yet
>a  member  of  your  family!

>Household:  Don’t  let  your  house  get  the  better  of  you,  TAKE
>CONTROL!

>This  guide  is  packed  full  of  important  information  that  you  will
>want  to  share  with  friends  and  other  family  members.

>This  is  “MUST  HAVE  INFORMATION”.  Get  this  NOW!

>Send  for  your  copy  today!  Here  is  how  to  order:  Send  check  or
>money  order  for  $29.95  (shipping  and  handling  included  in  price)
>to:

>Affordable  Services
>PO  Box  352
>Medford,  WI  54451

>PS:  You  won’t  believe  the  startling  information  in  the  guide!
>Order  an  extra  report  for  your  friends  and  neighbors!  Give
>yourself  a  little  piece  of  mind.

*****************************************************************************

Normally, this is the most innocuous type of spam. It purports to sell a report, but it is not MLM, a pyramid scheme, or a chain letter.

The sender appears not to have hijacked a mail server to send the spam. The return address could even be legitimate, for all I know.

Therefore, it is not illegal on its face. Sending spam itself is legal, so it would appear that no laws were broken, except that I was unhappy over having gotten the spam in the first place.

So, I sent a letter of complaint to the postmaster at TDS.NET, letting them know that they are harboring a spammer. If they don't permit spamming, they may well terminate the begger. If I never get spam from him again, that should be the end of it, right?

Wrong.

I also did a little checking. Curious sort, am I. I used DejaNews to check out the city of Medford, WI (that's where I'm supposed to send the money for the report to, right)? Here is what I got back:

>1.  97/10/05  028  [email]  (UCE)  Your  Home   news.admin.net-abus  "Nasty  Mama"

Ok, so it appears that Nasty Mama has also gotten this spam and has taken some action. But wait, there's more:

>10.  97/09/23  026  [email]  Pyramid  Sche#1/2  news.admin.net-abus  Todd  C.  Lawson

Oh-ho! Pyramid scheme, eh? Well, let's just take a look!

*****************************************************************************
>Subject:       [email]  Pyramid  Scheme  from  newnorth.net  (Your  Free  Report)
>From:          Todd  C.  Lawson  <tlawson@amug.org>
>Date:          1997/09/23
>Message-Id:    <v03110703b04d9662ef4b@[204.62.193.226]>
>Newsgroups:    news.admin.net-abuse.sightings
>[More  Headers]

>X-Reply-to:  news.admin.net-abuse.email
>Abuse-spotted-in:  mailbox  tlawson@amug.org
>Abuse-Subject:  Your  Free  Report
>Type-of-abuse:  Unsolicited  Email,  Pyramid  Scheme
>Description:  Pyramid  Scheme

[snip - VERY excellent information from Todd Lawson on what a pyramid scheme is, and why it is illegal. For a copy of his report, take a look at it. Use DejaNews and search for Todd Lawson.]

>Return-Path:  webbs321@newnorth.net

Whups, not from TDS.NET, but from NEWNORTH.NET, which is another local ISP in rural Wisconsin. Ok, so maybe this guy got bounced based on Todd's complaint. Notice the similarity in user names, though (webbs vs. webbs321).

[snip rest of headers]

>Free  Report

>Students!  Profesionals!   Unemployed!  Absolutely  anyone  can  use  this
>information  to
>make  cash  anytime  they  want.  Read  and  save  this  report  to  use  time  and  time
>again.

[snip much pyramid stuff, we've all seen it.]

>This  program  has  remained  successful
>because  of  the
>HONESTY  Integrity  the  participants.

[Well, not only does our unknown spammer send illegal pyramid schemes, but he is also a liar, as I will also show!]

[snip - more pyramid stuff]

>HERE  IS  THE  LIST  OF  NAMES  TO  SEND  TO:

>1.  R.D.Haar,  1628  Hillcrest  St.  Mesquite,  TX  75149  Fargo,  USA

>2.  James  Shanahan,  2/16  Myola  St.,  Mayfield  2304,  Australia

>3.  Diane  Wicke,   PO  box  32,   Jump  River,   WI   54434,    USA

>4.  Affordable  Services,   PO  Box  352,   Medford,  WI   54451,    USA

[But wait - here is the man who sent me the UCE! ^^^^^^^ ]

>5.  Scott  Webster,   939  High  Street  #102,   Rib  Lake,  WI   54470,    USA

[And who could this be???]

>Mail  $1.00  to  each  of  the  5  names  listed  above.  SEND  CASH  ONLY  (Total
>investment:

[snip - more pyramid scheme]

>REMEMBER  -  THIS  PROGRAM  FAILS  ONLY  IF  YOU  ARE  NOT  HONEST
>-PLEASE!!   PLEASE   BE  HONORABLE...IT  DOES  WORK!  THANK  YOU

[yet another exhortation to BE HONEST!!!]

*****************************************************************************

Ok, so now we know that webbs@TDS.NET sends UCE and pyramid scheme UCE. We could stop there and just mail a copy of this pyramid scheme to:

POSTMASTER
MEDFORD, WI 54451

and we'd be done with it. But I'm just a curious guy, so I took the very last step in identifying this spammer. I called the US Post Office in Medford, WI at (715) 748-3981. Remember, if the holder of a US Post Office Box lists their PO Box as being used for business, the information is open to the public. If they check off the little box that says that they are NOT doing business with the public, then you can't get the info, but then they are committing perjury (PO Box applications are legal documents). It seems our spammer DID want to be just a little bit honest though, because the post office told me who he is (drum roll, please):

Scott's Affordable Services
939 High Street
# 102
Rib Lake, WI 54470

Oh gee. Seems like Mister Scott Webster from our pyramid scheme above and Affordable Services from the same list are indeed the same person. On top of that, I would venture a guess to say that webbs and webbs321 both mean Scott Webster, huh? So, same person all the way around. He just could not restrain himself from cheating on his very own pyramid scheme, the one he warns people NOT to cheat on. Shame, shame, Mr. Webster.

Now, I complain to his ISP. I print a copy of the pyramid scheme that was previously posted to news.admin.net-abuse.sightings by Todd Lawson, and I send it to the postmaster at Rib Lake, WI, and Medford, WI.

Our nasty little spammer is going to stop bouncing from ISP to ISP, because he is going to jail.

Thus endeth the lesson.

Best Regards,

Bill Mattocks, CIIU

Derived from an HTML translation by Marek Jedlinski of a usenet post by Bill Mattocks


Tip of the Day

1. HTH: Happy to help or Hope that helped

2. Never try to outstubborn a cat

3. AFAIK: As far as I know

4. HAND: Have a nice day

5. RTFM: Read the fine manual

6. Your enemy is never a villain in his own eyes. Keep this in mind, it may offer a way to make him your friend. If not, you can kill him without hate, and quickly.

7. RTFF: Read the fine FAQ

8. FAQ: Frequently Asked Questions( http://www.faqs.org/faqs/ )

9. Never eat yellow snow

10. The term 'spam' is a reference to the Monty Python sketch (Vikings, remember?)

11. UCE: Unsolicited Commercial Email

12. IP addresses in Received lines are a good way to filter email

13. Never underestimate the power of human stupidity

14. NoCeM: A way of letting others filter your newsfeed ( http://www.cm.org/ )

15. Avoid making irrevocable decisions while tired or hungry.

16. BI: The Breidbart Index , a measure of the breadth of a usenet spam

17. Afterburner: The abuse guy at erols.net . One of the most rabid anti-spam people around. Erols spammers get deep-fried, extra crispy. One of the Good Guys.

18. CAUCE: The Coalition against Unsolicited Commercial Email ( http://www.cauce.org/ )

19. RFC: Request For Comments, the 'laws' of the Internet. ( http://www.faqs.org/rfcs/ )

20. postmaster: The person responsible for email problems at a site. All sites must have a 'postmaster@' email address

21. abuse: Many sites have an 'abuse@' address for handling email and usenet abuse. It isn't required.

22. Moving parts in rubbing contact require lubrication to avoid excessive wear. Honorifics and formal politeness provide lubrication where people rub together. Often the very young, the untraveled, the naive, the unsophisticated deplore these formalities as 'empty', 'meaningless', or 'dishonest' and scorn to use them. No matter how 'pure' their motives, they thereby throw sand into machinery that does not work too well at best.

23. UBE: Unsolicited Bulk Email

24. procmail : A UNIX program for filtering incoming email

25. Be wary of strong drink. It can make you shoot at tax collectors, and miss.

26. ignorebot: A program that handles email sent to an abuse@ address by sending a soothing reply, and deleting the original complaint

27. How you behave towards cats here below determines your status in Heaven

28. LART: Luser Attitude Readjustment Tool. Baseball bats are popular.

29. Cabal: There is no cabal

30. ACHTUNG! ALLES LOOKENSPEEPERS! Das computermachine ist nicht fuer gefingerpoken und mittengrabben. Ist easy schnappen der springenwerk, blowenfusen und poppencorken mit spitzensparken. Ist nicht fuer gewerken bei das dumpkopfen. Das rubbernecken sichtseeren keepen das cotten-pickenen hans in das pockets muss; relaxen und watchen das blinkenlichten.

31. Third party relay: To bounce an email message through an innocent third party's mailserver

32. Tim Skirvin : One of the main usenet spam-cancellors. One of the Good Guys.

33. S.P.U.T.U.M. The SubGenius Police, Usenet Tactical Unit (Mobile). These are the antispam SWAT team of the Church of the SubGenius

34. Church of the SubGenius : A mutant offshoot of Discordianism. Much of SubGenius theory is concerned with the acquisition of the mythical substance or quality of slack

35. Chris Lewis: One of the main usenet spam-cancellors. One of the Good Guys.

36. IP Address : Unique identifier for a machine. Of the form a.b.c.d where each of a,b,c,d is a number >=0 and <256. If it's not like that, it's forged.

37. emailed: embossed (with a raised pattern) or arranged in a net work, from the French 'emaillure', network

38. Flame: To post an email or usenet message intended to insult and provoke.

39. Fnord

40. Backbone: One of the companies who provide the main backbone of the internet. An internet provider who doesn't buy bandwidth from anyone else.

41. AGIS: Apex Global Internet Services. A rogue backbone provider. The source of much spam. Bouncing any email that's ever passed through an AGIS machine is a good way of reducing spam

42. IMHO: In My Humble Opinion

43. Kook: An extremely offensive, irrational, trolling usenetter. It's easy to troll, it takes great persistence to become a Kook.

44. KotM: Kook of the Month

45. Never appeal to a man's 'better nature.' He may not have one. Invoking his self interest gives you more leverage.

46. dialup: A non-permanent connection to the 'net, typically over a 'phone line or ISDN line. Also known as a PoP (Point of Presence)

47. mailbomb: To send someone hundreds of emails, with the intent of crashing their mail system. Don't do this. It's bad.

48. killfile: A way of filtering out usenet posts from a particular poster. Real newsreaders have these.

49. PGP: Pretty Good Privacy. A program for encrypting email and for unforgably signing email and usenet posts. ( in the US and elsewhere )

50. nastygram: A disapproving email, typically criticising anothers breach of netiquette

51. ping : Packet INternet Groper

52. dig : Domain Internet Groper

53. regexp: Regular Expression , a powerful type of wildcard pattern. Used for pattern matching in procmail, amongst many other places

54. You can have peace. Or you can have freedom. Don't ever count on having both at once.

55. cancel-bot: A program that automatically cancels usenet posts. Some of these are good, cancelling spam and mis-posted binaries. Others are rogue cancelbots, used to disrupt newsgroups

56. Spelling Flame: A usenet posting pointedly correcting the spelling of a previous article. If you make one of these, you've lost the argument.

57. BTW: By The Way

58. FWIW: For What It's Worth

59. FYI: For Your Information

60. LOL: Laughs Out Loud

61. ROTFL: Rolling On The Floor, Laughing

62. GoA,T: Go Away, Troll

63. Troll: v. To post an inflammatory article in the hope of provoking a response. From the angling term. Troll n. One who Trolls. The best thing to do to a troll is to ignore it.

64. Munge: To alter your email address, making it unusable. Don't do this. If you must do this, munge the bit to the right of the '@' sign, not the left.

65. Down, not across

66. /dev/null: The unix black-hole. Anything sent here is never seen again....

67. The answer to any question starting 'Why don't they....' is almost always, 'Money'

68. Whackamole: Spam being sent from a series of throwaway dialup accounts


whois

(Adapted from a tutorial by Ed Falk - see his original document for the full details)

When you hit the whois button - [image] - Sam Spade will contact one of the network registries to find out contact information for the current domain or IP address

Magic?

whois can be used in two different modes. You select between these using the whois server box

Simple whois

Usually the Magic server is selected, and Sam Spade will automagically choose the right whois server to contact.

In this mode Sam Spade will try to perform a sensible whois lookup for any form of address entered in the address box

The whois result will appear in a new window.

Advanced whois

You can select a specific server in the whois server box to send whois queries to. When you do this you have access to a much wider selection of arguments (which can be entered in the address box ):

(These are the arguments accepted by whois.internic.net . Use the help command to find the arguments accepted by other servers)

help

Get information on various arguments and their meanings.

sitename

Where sitename is the domain name of the site for which you want information. Only give the domain name (e.g. online18.com ), and not the full host name (e.g. www.online18.com). This will give you all the information the internic has about the given site. The whois server will attempt to match this name against all types of records: name, nicknames, hostname, net address, etc.) If there are multiple matches, whois will list them, one per line. If there is a single match, whois will give all the information about it.

pattern.

Where pattern. is the partial pattern you wish to match (note the terminating dot). Whois will return all patterns that begin with this pattern. Example: online18. ).

IP Address

Where IP Address is the full IP address in dotted-decimal notation of a host, (e.g. 206.138.239.10 ). Whois will return the hostname for this address if it is found in the database. This can often be used to determine a site's network server.

subnet (this is the same as the IP Block tool)

Where subnet is the IP address in dotted-decimal notation (e.g 206.138.239.0 or 206.138.239 ) Whois will return the site or sites listed under this subnet. If there is no match, make the search more broad (e.g. 206.138.0.0 or 206.138 ); this can often be used to determine a site's upstream provider.

subnet.

(Note the terminating dot). Find all addresses matching this pattern, e.g. 206.138.239. returns all hosts belonging to Online18.

HA handle

! handle

Where ! handle is a handle returned when there are multiple matches, (e.g. !ONLINE16-DOM or !CF624 This will return the single indicated record.

NAme name

. name

Search only the Name field. Example: .Chandler, Andrew

M mailbox

mailbox @ addr

Search only the Mailbox field. Example: admin@xxxyes.com

DOmain pattern

Search only domain records, e.g. "COM", "DOM MIT" or "DOM MIT.EDU".

GAteway pattern

Search only gateway records.

HOst pattern

Search only host records, e.g. HO WWW1032-HST

SErver pattern

Search only server records. This can be very useful for finding out which sites share the same server. For example, the search: server www1032-hst . reveals that the porn spammer Online18 is the same as -- or associated with -- the Psychic Spammer

ASm pattern

Search only autonomous system numbers records.

NEtwork pattern

Search only network records, e.g. NE WWW1032-HST

O pattern

Search only organization records.

Full search

Give full records, even if multiple matches.

SUMmary search

Give summary records, even if single match.


Sam Spade File Menu
File Menu

Save As...

Clear log

Exit


Manuals and Tutorials

A selection of useful tutorials written by a number of different people

Spam Tracking 101 - analysing email headers and tracking down the sender

Spam Tracking 102 - searching usenet for information using DejaNews

Spam Tracking 103 - finding the owner of a domain or an IP address using whois

Spam Tracking 104 - a case study in tracking down a spammer

SpuTools - the canonical tutorial on analysing usenet headers

The alt.spam FAQ - Good info on deciphering forged email headers, and pointers to a lot of other online resources

IP Addresses and DNS - all about internet addressing


Copy

Selecting Edit -> Copy or the copy button - [image] - copys the contents of the active window to the windows clipboard


Introducing Sam Spade
Sam Spade

Sam Spade is a general-purpose Internet utility package, with some extra features to help in tracing the source of spam and other forms of Internet harassment.

Configuring Sam Spade

Using Sam Spade

Menu options

Information about spam, the Internet, analysing headers...

Technical support

Elsewhere on the 'net

Credits


Options Bar

	The number of packets to send on each ping . If this is set to 0 ping will repeat forever
	Choose a whois server, or select automagic choice of server
	Choose a DNS nameserver
	Configure the web browser to use one window or multiple windows


Paste

If you copy an address to the windows clipboard and hit the paste button - [image] - it will be pasted into the address box

If you have a suspicious looking set of email headers you can copy them to the clipboard from your mail reader and paste them into Sam Spade using Edit -> Paste or the paste button - [image]. They'll appear in a new window, with any addresses highlighted as active text.

If you have Smart Paste enabled Sam Spade will run a rudimentary header analysis. It's not perfect, but can sometimes find suspicious parts of the header

You'll need to paste full headers for header analysis to be useful


Browse web

Hitting [image] or selecting Tools -> Browse web... starts a very simple, secure web browser

Instead of rendering the HTML it receives it displays the raw http traffic - both the http headers and the raw HTML body

This can be useful for looking at deceitful or malign websites, or for debugging cgi scripts

Usually a new window will be opened for each webpage, but if the single window button - [image] - is selected the window will be reused


Sam Spade Credits
Credits

Design, implementation, documentation

Steve Atkins

Inspiration

The regulars of news.admin.net-abuse.email

The SPAM-L mailing list

S.P.U.T.U.M.

The alt.gothic Special Forces

airmail.net (they threatened legal action against my online Sam Spade site, prompting me to write the personal version)

Alpha and Beta testers

Far too many to remember - here're a few:

JOWazzoo

Jim Rusling

Dave Stoddard

Captain Blade

Ruben Bunyee

Joe Shields

Graycat

John Lambert

Jeff Duggin

Reinhold Gerharz

Marek Jedlinski

Lowell Anderson

Jeff Weiss

Joel Levin

Todd & Lori

Bruce McGlashan

Chingteng Hsiao

Paul Lee

Mike Wendell

Kurt Weirich

RTG Parners

Mark (from comports)

Ron Kulik

Karl Carapellotti

Don McCallum

Keesjan Steenbergen

Scott Taylor

Jason Soled

Doktor DynaSoar Iridium

Ellen Holmes

TheCharlie

rrevved

Shmuel Metz

Darrell Larose

Jerry Brenner

Debra Walker

And everyone else

Ed Falk

Bill Mattocks

Mr Sam

Patricia Shaffer

Tim Skirvin

Countless people who gave me feedback about bugs in the online version - all that development was folded into Sam Spade

Chris Siebenman

Jordan Russell , the author of Inno Setup


Default nameserver

You need to enter the nameserver your ISP told you to use here. If you don't have it noted you can find it:

1. Open the Windows Control Panel (Start->Settings->Control Panel)

2. Open the Network dialog and select the Configuration tab

3. Select TCP/IP and click on Properties

4. Select DNS Configuration

5. The address you need is the top address in the DNS Server Search Order box

(That's for Windows 95 - it's similar for NT)

Only enter one address in the default nameserver box


Sam Spade Edit Menu
Edit Menu

Copy

Paste

Smart Paste

Options...


Advanced DNS
Advanced DNS (dig)

This tool requests all the DNS records for a host or domain

A	a host address
NS	an authoritative name server
MD	a mail destination (Obsolete - use MX)
MF	a mail forwarder (Obsolete - use MX)
CNAME	the canonical name for an alias
SOA	marks the start of a zone of authority
MB	a mailbox domain name (EXPERIMENTAL)
MG	a mail group member (EXPERIMENTAL)
MR	a mail rename domain name (EXPERIMENTAL)
NULL	a null RR (EXPERIMENTAL)
WKS	a well known service description
PTR	a domain name pointer
HINFO	host information
MINFO	mailbox or mail list information
MX	mail exchange
TXT	text strings
RP	Responsible person
AFSDB	AFS database ( RFC1183 )
X25	X25 ( RFC1183 )
ISDN	ISDN ( RFC1183 )
RT	Route through ( RFC1183 )
NSAP	NSAP ( RFC1637 , 1348 )
NSAP_PTR	NSAP-PTR
SIG	RFC2065
KEY	RFC2065
PX	Preference ( RFC1664 )
GPOS	Geographical position, also known as the ICBM record ( RFC1712 )
AAAA	IPv6 Address ( RFC 1886 )
LOC	Location, also known as ICBM record ( RFC1876 )
NXT	RFC2065
EID	draft-ietf-nimrod-dns-xx.txt
NIMLOC	draft-ietf-nimrod-dns-xx.txt
SRV	Services ( RFC 2052 )
ATMA	?
NAPTR	( RFC2168 )
TSIG	draft-ietf-dnsind-tsig-xx.txt
UINFO	Non standard
UID	Non standard
GID	Non standard
UNSPEC	Non standard
IXFR	RFC1995
AXFR	A request for a transfer of an entire zone
MAILB	A request for mailbox-related records (MB, MG or MR)
MAILA	A request for mail agent RRs (Obsolete - see MX)
ALL	A request for all records


The Spam Sketch

The cast:

Man

Eric Idle

Wife

Graham Chapman

Waitress

Terry Jones

The sketch:

Scene: A cafe. One table is occupied by a group of Vikings with horned helmets on. A man and his wife enter.

Man	You sit here, dear.
Wife	All right.
Man	(to Waitress) Morning!
Waitress	Morning!
Man	Well, what've you got?
Waitress	Well, there's egg and bacon; egg sausage and bacon; egg and spam; egg bacon and spam; egg bacon sausage and spam; spam bacon sausage and spam; spam egg spam spam bacon and spam; spam sausage spam spam bacon spam tomato and spam;
Vikings	(starting to chant) Spam spam spam spam...
Waitress	...spam spam spam egg and spam; spam spam spam spam spam spam baked beans spam spam spam...
Vikings	(singing) Spam! Lovely spam! Lovely spam!
Waitress	...or Lobster Thermidor au Crevettes with a mornay sauce served in a Provencale manner with shallots and aubergines garnished with truffle pate, brandy and with a fried egg on top and spam.
Wife	Have you got anything without spam?
Waitress	Well, there's spam egg sausage and spam, that's not got much spam in it.
Wife	I don't want ANY spam!
Man	Why can't she have egg bacon spam and sausage?
Wife	THAT'S got spam in it!
Man	Hasn't got as much spam in it as spam egg sausage and spam, has it?
Vikings	Spam spam spam spam (crescendo through next few lines)
Wife	Could you do the egg bacon spam and sausage without the spam then?
Waitress	Urgghh!
Wife	What do you mean 'Urgghh'? I don't like spam!
Vikings	Lovely spam! Wonderful spam!
Waitress	Shut up!
Vikings	Lovely spam! Wonderful spam!
Waitress	Shut up! (Vikings stop) Bloody Vikings! You can't have egg bacon spam and sausage without the spam.
Wife	(shrieks) I don't like spam!
Man	Sshh, dear, don't cause a fuss. I'll have your spam. I love it. I'm having spam spam spam spam spam spam spam beaked beans spam spam spam and spam!
Vikings	(singing) Spam spam spam spam. Lovely spam! Wonderful spam!
Waitress	Shut up!! Baked beans are off.
Man	Well could I have her spam instead of the baked beans then?
Waitress	You mean spam spam spam spam spam spam... (but it is too late and the Vikings drown her words)
Vikings	(singing elaborately) Spam, spam, spam, spam. Lovely spam! Wonderful spaaam! Lovely spam! Wonderful spam. Spa-a-a-a-a-a-a-am! Spa-a-a-a-a-a-a-am! Spa-a-a-a-a-a-a-am! Spa-a-a-a-a-a-a-am! Lovely spam! (Lovely spam!) Lovely spam! (Lovely spam!) Lovely spaaam! Spam, spam, spam, spaaaaam!


News Server

This is the newsserver that Sam Spade will use when checking a newsgroup for cancels

If you can't remember your newsserver you can find it:

Forte Agent

Options -> User and System Profile -> System

Anawave Gravity 1.1

View -> Options... -> Setup

Anawave Gravity 2.0

?

Netscape Navigator 3

Options -> Mail and News Preferences... -> Servers

Netscape Communicator

Edit -> Preferences... -> Mail & Groups -> Groups Server

Internet Explorer 3

?

Microsoft Outlook Express

Tools -> Accounts...


Online Resources

Spam fighting at abuse.net - Lots of good stuff hosted by abuse.net , the net abuse clearinghouse. Includes lots of ways of filtering spam of all flavours from your account or an entire site.

S.P.U.T.U.M. - Primarily about usenet spam rather than email spam. Well worth a read, particularly SpuTools(tm)

Spam at Blighty Design - the home of Sam Spade

The Anti-Spam HOWTO - Good, short introduction to the basics of decoding headers and finding the right postmaster to complain to

The Coalition Against Unsolicited Commercial Email - Lots of background, history and politics

All about spam - Introduction to spam, and a few ways to reduce the amount you get

Death to Spam! - Some good advice on retaliating against spam. Be very careful about threatening Denial-of-Service attacks against the host ISP, though. Doing it is illegal in most places, threatening it may be illegal in some.

Ed Falks' Spam Tracking Page - the latest news on spam, and a lot of tutorials and links

news.admin.net-abuse.email

news.admin.net-abuse.usenet

The news.admin.net-abuse.* homepage

Help! I've been Spammed! What do I do?

Mail filtering FAQ

Yahoo - spam - Lots more resources at Yahoo!


Sam Spade Help Menu
Help Menu

Tip of the Day... - show the Tip of the Day window usually shown as Sam Spade starts

Home page... - view Sam Spade homepage

About... - show release information


The Wildmat Format

From the Inn documentation set and the NNTP extensions internet draft

The WILDMAT format was first developed by Rich Salz based on the format used in the UNIX "find" command to articulate file names. It was developed to provide a uniform mechanism for matching patterns in the same manner that the UNIX shell matches filenames. Patterns are implicitly anchored at the beginning and end of each string when testing for a match. There are five pattern-matching operations other than a strict one-to-one match between the pattern and the source to be checked for a match.

The pattern is interpreted as follows:

	Turns off the special meaning of x and matches it directly; this is used mostly before a question mark or asterisk, and is not special inside square brackets.
?	Matches any single character.
*	Matches any sequence of zero or more characters.
[x...y]	Matches any single character specified by the set x...y. A minus sign may be used to indicate a range of characters. That is, [0-5abc] is a shorthand for [012345abc]. More than one range may appear inside a character set; [0-9a-zA-Z._] matches almost all of the legal characters for a host name. The close bracket, ], may be used if it is the first character in the set. The minus sign, -, may be used if it is either the first or last character in the set.
[^x...y]	This matches any character not in the set x...y, which is interpreted as described above. For example, [^]-] matches any character other than a close bracket or minus sign.
Examples

*news.admin.net-abuse.*	the usual form - matches all newsgroups in the news.admin.net-abuse hierarchy
[^]-]	matches any single character other than a close square bracket or a minus sign/dash.
*bdc	matches any string that ends with the string "bdc" including the string "bdc" (without quotes).
[0-9a-zA-Z]	matches any single printable alphanumeric ASCII character.
a??d	matches any four character string which begins with a and ends with d.


Checking for usenet cancels

When usenet was designed it was reasonable to expect none of the users would attack the infrastructure. Cancels were supposed to be used if someone posted something wrong and wanted to cancel their own post

The cancel feature is now used to automatically cancel the vast majority of usenet spam. Because of this many usenet spammers want to persuade newsserver administrators to disable cancels on their servers (so more people will read their spam)

One spammer, Mike Enlow , with the connivance of win.net , has released a program that allows people to issue massive cancels for messages containing any particular word. His hopes of persuading news admins to turn off cancels look unlikely to succeed, thanks to the efforts of some members of S.P.U.T.U.M.

Before checking for cancels you need to enter your newsserver in Edit -> Options -> News

Select Tools -> Check cancels...

To check a single group, e.g. alt.stagecraft, enter *alt.stagecraft*

Each check will take some time, and will take the same amount of time for one group as for multiple groups so it makes sense to check multiple groups at once. You can specify multiple groups using wildmat format

This function will only work if your newserver accepts the XPAT command


Smart Paste

If this option is selected and you paste email headers from the clipboard Sam Spade will look at the headers looking for suspicious lines


Configuring Sam Spade

1. Select the E dit menu item, then select Options...

2. Select the Configure tab

Default Nameserver  - set the internet nameserver Sam Spade uses for most name lookups

Maximum simultaneous connections - 100 is plenty

Your email address - this is used for email relay checking

Your ISP s webserver - used to keep a dialup connection alive

3. Select the News tab
You only need to configure this section if you plan to check for usenet cancels

News Server

Username, Password - if you need to enter a password to access your newsserver, enter it here

4. Select the Advanced tab
These three are potentially dangerous tools to enable. Be sure you understand the issues with them before you use them.

Enable zone transfers - enables DNS Zone Transfers

Enable active probing - enables port scanning

Enable relay checking - enables checking for an insecure mailserver


Keepalive

If you select the keepalive button - [image] - Sam Spade will send a web request to your providers web server once a minute to keep your dialup connection from timing out

Before you use this you'll need to select Edit -> Options... -> Configuration and enter the address of your providers web page


Spam?
Spam

Prehistory

The history of the term Spam starts with episode 25 of Monty Python's Flying Circus , and the Spam Sketch in which a group of Vikings sing the word Spam over and over, so loudly that no-one else can communicate

After a short detour through MUD s, where it was used to describe someone shouting the same thing repeatedly, stopping any interaction between other people, it came to usenet.

Usenet spam

On usenet the term spam is used to refer to the practice of posting an article, often an advert for a dubious porn site or a ponzi scam, many, many times. This might be many times to one group or more usually it'll be posted to a lot of groups.

More precise terms for usenet spam are Excessive Crossposting (ECP) - crossposting the same article to many groups - or Excessive Multiposting (EMP) - posting substantively the same article many times, to each group individually

Most usenet spamming is a mix of ECP and EMP - the spam will be crossposted to many groups, many times

Usenet spam is automatically detected and cancelled by cancelbots, but because of the way usenet propagates some percentage of the spam will make it's way through to readers before the cancels catch them

Many sections of usenet have been turned into wastelands - whole hierarchies have been so deluged by spam that it's impossible to use them. The members of the groups have left, and there's nothing there but spam.

Around 80% of usenet traffic is caused by spam

What can be done?

Killfiles. All real newsreaders have a killfile - this is a way of filtering out posts based on subject, poster or a number of other things. These are good for filtering out the background noise and occasional spam in an otherwise good newsgroup. Web browsers that claim to be newsreaders seldom have usable killfile features (Under Win95/NT Forte Agent and Anawave Gravity are two commonly used newsreaders)

NoCeM is a way to allow someone else you trust to filter out articles for you. At the time of writing no Windows client software is available, but it is possible for your news adminstrator to use NoCeMs to delete spam from the server by installing NoCeM on spool software

Server filtering. It's possible to detect and delete the huge majority of usenet spam using server filters. Spam Hippo is a filter from Zippo news, which they make freely available to ISPs who wish to run it

Shunning. At any one time the majority of spam comes from a few sites. By shunning them, refusing all articles from them the amount of spam drops

Hunt the perpetrators down. Complain to their upstream provider. Repeatedly. Get them shut down. Get the servers, web pages and email addresses of the advertisers yanked. Report the illegal schemes to the local police.

Email spam

The 'correct' term for email spam is Unsolicited Bulk Email (UBE), though you'll see the term Unsolicited Commercial Email (UCE) used more often.

Spam is popular amongst the scammers, the multi-level marketing crowd and the porn pushers because it costs them so little to send. This is because they send it by stealing the resources of others.

There are three main flavours of email spam

1. Spam sent by an ordinary customer of an ISP , sent via his ISPs mailserver, usually with minimal forging of the headers. This tends to be sent by newbie spammers. If they're slapped down by their ISP they may decide spamming is bad, or they may just get more sophisticated...

2. Spam sent using spamware - programs specifically designed to send huge amounts of email (up to 100,000 emails an hour) over an ordinary dialup internet connection. This software is designed to steal service from an innocent third party by relaying email through their server. It's also designed to forge the email headers to deflect complaints away from the perpetrator, either towards the third-party or towards yet another innocent bystander. The load this puts on the third-party server can bring an ISP down for days

3. 'Professional' spamhauses. These are companies setup purely to commit theft and fraud. They have permanent internet connections, or sometimes have their servers in the premises of other crooked service providers. They don't usually spam to advertise themselves, instead they find clueless businessmen and charge them $1000 or so to send their advert to hundreds of thousands of peoples mailboxes

What can be done?

Filter them out or bounce them back. If you receive email via a unix system you may be able to run procmail filters. If not you can use the spam filter capabilities of your mail reader, or one of the many third party filtering tools

Hunt the perpetrators down. Complain to their upstream provider. Repeatedly. Get them shut down. Get the servers, web pages and email addresses of the advertisers yanked. Invoice them for your time, sue them in a small claims court when they don't pay up. Report the illegal schemes to the local police.

Tracing the perpetrators using spamware, or the spamhauses requires some familiarity with email headers - see the tutorials for more information on those


Relay checking
SMTP Relay Checking

A common trick used by senders of UCE is to send their spam via a third party relay

Why? Two main reasons

1. It allows them to send much, much more email than they could without it. They can send one email addressed to a few hundred email addresses to the relay. The relay will then expand that to a few hundred separate emails, one sent to each recipient. This allows them to send a hundred thousand emails an hour over a cheap dialup account rather than the couple of thousand they could send without stealing service from the relay

2. It obfuscsates the headers, making it more difficult to track the original sender. In the case of badly configured relays which don't record the IP address of the sender it makes it impossible to find the originator without the co-operation of the system administrator of the relay

The only sure way to tell whether an SMTP server is insecure (allowing anyone to relay email) is to try and relay an email through it back to yourself

Some system administrators will get upset if you do this. While any reasonable sysadmin shouldn't object if you check that his system is insecure, then politely tell him so, there are a fair number of insecure sysadmins who'll go off the deep end and threaten law suits if you probe their servers. There are also servers which are secure, but which log relay attempts. Either way, don't probe servers on a whim, and send email to their admins afterwards explaining why you were probing their server

Before you can run a relay check you need to do two things

Select Edit -> Options... -> Configuration and enter your email address

Select Edit -> Options... -> Advanced and select Enable active probing

Then select Tools -> SMTP Relay Check... , enter the server you want to probe and hit OK

A new window will open, showing the transaction. Even if the server seems to accept your relayed email it may throw it away without telling you. You don't know that it allows relaying until the relayed email arrives in your inbox


Finger

Finger - [image] - asks a server about one of it's users. Many machines have finger disabled, but if it's available it can give a lot of interesting information


Traceroute

Traceroute - [image] - finds the route packets take between you and the selected address

Traceroute isn't foolproof. Some networks block ICMP packets at their boundaries, making it impossible to run traceroute into their systems.

Traceroute will send three packets for each hop of the route. Each packet that doesn't return is shown as an asterisk. If none of the three packets return from a stage it will be shown as * * * failed

If a single stage fails, but later stages return data it means the one stage doesn't respond to traceroute packets

If traceroute returns data up to a stage, but all stages after that fail it usually means that the stage after the final one is a firewall blocking ICMP packets. This is... suspicious.

A few older routers are faulty in the way they handle traceroute packets. They will set the lifetime of the error packets they return to the same lifetime as the packet they receive. This is pretty rare (I've never seen it) but the symptom is that stages 1..n-1 will return traceroute packets, stages n..2*n-1 will fail and stage 2*n will return the packet that should have appeared in stage n


Active port scanning

It can be interesting to see which internet services a range of machines provide (it's often possible to find interesting information about a system by accessing those services using telnet)

Before you can scan for open ports you must select Edit -> Options... -> Advanced then select Enable active probing

Select Tools -> Scan Addresses...

Enter the range of addresses you want to probe, and select the services you want to look for

Reverse DNS - this isn't a service, instead selecting this box attempts to lookup the hostname of each IP address scanned

Mail - port 25, SMTP mail

Usenet - port 119, usenet news

Web - port 80, http web service

Telnet - port 23, remote login

Nameserver - port 42, nameserver

If you want to scan a wider selection of ports hit the Advanced>> button and select ports in the scrollable list

Note scanning a lot of ports seems to put a lot of stress on the windows sockets library. Strange bugs and crashes happen with some versions of winsock


Save As...

This will save the currently selected window to a file


Ping

Ping - [image] - sends a series of packets to the current address to see if it's alive, and how long it takes packets to make the round trip

The number of packets sent can be adjusted on the options bar -


Technical support

Bug reports, enhancement requests

Check the Sam Spade homepage for new versions, known bugs and info about the program itself

Drop me some email at spade@blighty.com

How to use the tools

What? You mean the online help isn't good enough for you? Most of the tools Sam Spade provides are nearly identical to their unix equivalents, so any tutorials you find referring to the unix tools will be useful

Check some of the online resources for some pointers

Reading headers, tracing spam etc

Take a look at the online resources for a good start

Subscribe to the newsgroups news.admin.net-abuse.email or news.admin.net-abuse.usenet

These groups are very high traffic, and have a large number of saboteurs trolling, forging posts and posting complete lies. Lurk for a week or so before posting to get some idea of who the trolls are and whose advice you should trust

See the Tip of the day notes on kooks and trolls, and take a look at news.admin.net-abuse.* homepage too


Clear log

This will delete the contents of the log window


Crawl web

Tools -> Crawl website... will download a website to local disc, search a website for useful info or both

It will crawl all webpages it can find below the URL you give it

If there are pages below this URL that may not be reachable from the top level you can add extra seed URLs

As well as the predefined patterns you can also search for arbitrary regular expressions

It's intentionally a dumb, impolite webcrawler, as it's designed for searching malign websites. It ignores the robots.txt file designed to tell webcrawlers where they're allowed to look. It ignores the META tags that do the same thing.

If the website includes self-referential cgi scripts designed to trap webcrawlers in an endless recursion they'll trap this one


DNS Zone Transfer

A zone transfer asks a nameserver for all the information it knows about a domain. This is only really useful if the nameserver is authorative for that domain (to find a nameserver authorative for a domain run dig on that domain and look for NS entries)

A zone transfer puts a lot of load on a nameserver, and is considered impolite, so some nameservers won't allow zone transfers

Before you run a zone transfer you'll need to select Edit -> Options... -> Advanced and select Enable zone transfers

Then select Tools -> Zone Transfer... Enter the domain you're interested in and the nameserver you want to interrogate

This returns a lot of data, so you may want to save the results to a file rather than displaying them


Troubleshooting

Configuration

Make sure you've configured your email address and nameserver, or many functions will fail with strange error messages

Greyed functions on the Tools menu

Several functions on the tools menu need to be enabled before you can use them. Select Edit -> Options... -> Advanced and enable the functions you want to use

Problems analysing headers

Netscape

Netscape Navigator 3 and 4 both make it difficult to copy headers to the clipboard. Sam Spade attempts to undo the corruption in headers copied from Navigator, but sometimes fails. The right way to copy headers from Navigator is to select the message, select View -> Document Source , select the header, then hit Ctrl-C to copy the header to the clipboard

(Navigator is a bad mailreader and a worse newsreader. You're much better off if you use Navigator as a web browser, and use a real mailreader and newsreader. Internet Explorer is no better.)

Online Help

HTML Help seems to work only with Internet Explorer 4. Anything else and you should use WinHelp instead. Select Edit -> Options... -> Help . You're not missing any content - the WinHelp is generated automatically from the HTMLHelp

Anything else

Check the support page for known bugs and bug reporting information


Using Sam Spade

Configuration

Before anything else you need to configure everything

Basics

Enter the address you're interested in the address box. If you've copied an address to the clipboard you can use the paste button or menu option to paste it into the address box.

Then you can do all sorts of things to that address using the toolbar

The results will appear in a new window. Some parts of the results may be highlighted as active text. Right-clicking on the active text will popup a menu of things you can do next. Left clicking on it will do the most common operation.

If you're chasing down information about the owner of an address it's handy to be able to save the useful intermediate results. The two buttons on the left of the toolbar let you copy results to the Log Window for later use

Header analysis

If you have a suspicious looking set of email headers you can copy them to the clipboard from your mail reader and paste them into Sam Spade. They'll appear in a new window, with any addresses highlighted as active text. If you have Smart Paste enabled Sam Spade will run a rudimentary header analysis. It's not perfect, but can sometimes find suspicious parts of the header

Header analysis is only useful if you paste a full set of headers. See here for ways to turn on full headers on common mail programs

More advanced tools

There are some more sophisticated tools available on the Tools menu . Some of these may need to be enabled before you can use them.


Sam Spade Tools Menu
Tools Menu

Zone Transfer... - ask a DNS server for all it knows about a domain

SMTP Relay Check... - check whether a mail server allows third party relaying

Scan Addresses... - scan a range of IP addresses looking for open ports

Crawl website... - search a website, looking for email addresses, offsite links etc.; download a website

Browse web... - browse the web in a raw http format

Check cancels... - search your newsserver for cancels


Regular expressions

(This documentation is derived from Tom Lords documentation for the Free Software Foundation regular expression library)

Copyright (C) 1996 Tom Lord Berkeley, CA USA

Permission to use, copy, modify, distribute, and sell this documentation for any purpose is hereby granted without fee, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation.

Posix Basic Regular Expressions

The Posix Basic Regular Expression language is a notation for describing textual patterns. Regexps are typically used by comparing them to a string to see if that string matches the pattern, or by searching within a string for a substring that matches.

This chapter introduces the Posix regexp notation. This is not a formal or precise definition of Posix regexps -- it is an intuitive and hopefully expository description of them.

An Introduction to Regexps

In the simplest cases, a regexp is just a literal string that must match exactly. For example, the pattern:

regexp

matches the string "regexp" and no others.

Some characters have a special meaning when they occur in a regexp. They aren't matched literally as in the previous example, but instead denote a more general pattern. For example, the character * is used to indicate that the preceeding element of a regexp may be repeated 0, 1, or more times. In the pattern:

smooo*th

the * indicates that the preceeding o can be repeated 0 or more times. So the pattern matches:

smooth
smoooth
smooooth
smoooooth
...

Suppose you want to write a pattern that literally matches a special character like * -- in other words, you don't want to * to indicate a permissible repetition, but to match * literally. This is accomplished by quoting the special character with a backslash. The pattern:

smooth

matches the string:

smoo*th

and no other strings.

In seven cases, the pattern is reversed -- a backslash makes the character special instead of making a special character normal. The characters + , ? , | , ( , and ) are normal but the sequences  ,  ,  ,  ,  , { , and } are special (their meaning is described later).

The remaining sections of this chapter introduce and explain the various special characters that can occur in regexps.

Literal Regexps

A literal regexp is a string which contains no special characters. A literal regexp matches an identical string, but no other characters. For example:

literally

matches

literally

and nothing else.

Generally, whitespace characters, numbers, and letters are not special. Some punctuation characters are special and some are not (the syntax summary at the end of this chapter makes a convenient reference for which characters are special and which aren't).

Character Sets

This section introduces the special characters . and [ .

. matches any character except the NULL character. For example:

p.ck

matches

pick
pack
puck
pbck
pcck
p.ck

...

[ begins a character set . A character set is similar to . in that it matches not a single, literal character, but any of a set of characters. [ is different from . in that with [ , you define the set of characters explicitly.

There are three basic forms a character set can take.

In the first form, the character set is spelled out:

[<cset-spec>] 	--  every  character  in  <cset-spec>  is  in  the  set.

In the second form, the character set indicated is the negation of a character set is explicitly spelled out:

[^<cset-spec>] 	--  every  character  *not*  in  <cset-spec>  is  in  the  set.

A <cset-spec> is more or less an explicit enumeration of a set of characters. It can be written as a string of individual characters:

[aeiou]

or as a range of characters:

[0-9]

These two forms can be mixed:

[A-za-z0-9_$]

Note that special regexp characters (such as * ) are not special within a character set. - , as illustrated above, is special, except, as illustrated below, when it is the first character mentioned.

This is a four-character set:

[-+*/]

The third form of a character set makes use of a pre-defined "character class":

[[:class-name:]]  --  every  character  described  by  class-name  is  in  the  set.

The supported character classes are:

alnum 	-  the  set  of  alpha-numeric  characters
alpha 	-  the  set  of  alphabetic  characters
blank 	-  tab  and  space
cntrl 	-  the  control  characters
digit 	-  decimal  digits
graph 	-  all  printable  characters  except  space
lower 	-  lower  case  letters
print 	-  the  "printable"  characters
punct 	-  punctuation
space 	-  whitespace  characters
upper 	-  upper  case  letters
xdigit 	-  hexidecimal  digits

Finally, character class sets can also be inverted:

[^[:space:]]  -  all  non-whitespace  characters

Character sets can be used in a regular expression anywhere a literal character can.

Subexpressions

A subexpression is a regular expression enclosed in  and  . A subexpression can be used anywhere a single character or character set can be used.

Subexpressions are useful for grouping regexp constructs. For example, the repeat operator, * , usually applies to just the preceeding character. Recall that:

smooo*th

matches

smooth
smoooth
...

Using a subexpression, we can apply * to a longer string:

bananan*a

matches

banana
bananana
banananana
...

Subexpressions also have a special meaning with regard to backreferences and substitutions (see See Backreferences, Extractions and Substitutions ).

Repeated Subexpressions

* is the repeat operator. It applies to the preceeding character, character set, subexpression or backreference. It indicates that the preceeding element can be matched 0 or more times:

banana*

matches

bana
banana
bananana
banananana
...

 is similar to * except that  requires the preceeding element to be matched at least once. So while:

banana*

matches

bana

bana(na

does not. Both match

banana
bananana
banananana
...

Thus, banana+ is short-hand for bananana* .

Optional Subexpressions

 indicates that the preceeding character, character set, or subexpression is optional. It is permitted to match, or to be skipped:

CSNY

matches both

CSN

and

CSNY

Counted Subexpressions

An interval expression, {m,n} where m and n are non-negative integers with n >= m , applies to the preceeding character, character set, subexpression or backreference. It indicates that the preceeding element must match at least m times and may match as many as n times.

For example:

c[ad]{1,4}

matches

car
cdr
caar
cdar
...
caaar
cdaar
...
cadddr
cddddr

Alternative Subexpressions

An alternative is written:

regexp-1regexp-2regexp-3...

It matches anything matched by some regexp-n . For example:

Crosby,  Stills,  and  NashNash,  and  Young

matches

Crosby,  Stills,  and  Nash

and

Crosby,  Stills,  Nash,  and  Young

Backreferences, Extractions and Substitutions

A backreference is written where n is some single digit other than 0. To be a valid backreference, there must be at least n parenthesized subexpressions in the pattern prior to the backreference.

A backreference matches a literal copy of whatever was matched by the corresponding subexpression. For example,

.*-

matches:

go-go
ha-ha
wakka-wakka
...

In some applications, subexpressions are used to extract substrings. For example, Emacs has the functions match-beginnning and match-end which report the positions of strings matched by subexpressions. These functions use the same numbering scheme for subexpressions as backreferences, with the additional rule that subexpression 0 is defined to be the whole regexp.

In some applications, subexpressions are used in string substitution. This again uses the backreference numbering scheme. For example, this sed command:

s/From:.*<.*>/To:  /

first matches the line:

From:  Joe  Schmoe  <schmoe@uspringfield.edu>

when it does, subexpression 1 matches "schmoe@uspringfield.edu". The command replaces the matched line with "To: " after doing subexpression substitution on it to get:

To:  schmoe@uspringfield.edu

A Summary of Regexp Syntax

In summary, regexps can be:

abcd -- matching a string literally

. -- matching everything except NULL

[a-z_?] , ^[a-z_?] , [[:alpha:]] and [^[:alpha:]] -- matching character sets

subexp -- grouping an expression into a subexpression.

-- match a copy of whatever was matched by the nth subexpression.

The following special characters and sequences can be applied to a character, character set, subexpression, or backreference:

* -- repeat the preceeding element 0 or more times.

 -- repeat the preceeding element 1 or more times.

 -- match the preceeding element 0 or 1 time.

m,n -- match the preceeding element at least m , and as many as n times.

regexp-1regexp-2.. -- match any regexp-n.

A special character, like . or * can be made into a literal character by prefixing it with .

A special sequence, like  or  can be made into a literal character by dropping the .

Ambiguous Patterns

Sometimes a regular expression appears to be ambiguous. For example, suppose we compare the pattern:

beginbeginning

to the string

beginning

either just the first 5 characters will match, or the whole string will match.

In every case like this, the longer match is preferred. The whole string will match.

Sometimes there is ambiguity not about how many characters to match, but where the subexpressions occur within the match. This can effect extraction functions like Emacs' match-beginning or rewrite functions like sed's s command. For example, consider matching the pattern:

b^q]*ing?

against the string

beginning

One possibility is that the first subexpression matches "eginning" and the second is skipped. Another possibility is that the first subexpression matches "eginn" and the second matches "ing".

The rule is that consistant with matching as many characters as possible, the length of lower numbered subexpressions is maximized in preference to maximizing the length of later subexpressions.

In the case of the above example, the two possible matches are equal in overall length. Therefore, it comes down to maximizing the lower-numbered subexpression, . The correct answer is that  matches "eginning" and  is skipped.

Complications in Subexpression Matching

Sometimes a subexpression matches a substring of no characters. This happens when `fo*' matches the string `fum' . (It really matches just the `f' .) In this case, both of the offsets identify the point in the string where the null substring was found. In this example, the offsets are both 1 .

Sometimes the entire regular expression can match without using some of its subexpressions at all--for example, when `bana*' matches the string `ba' , the parenthetical subexpression is not used. When this happens, regexec stores -1 in both fields of the element for that subexpression.

Sometimes matching the entire regular expression can match a particular subexpression more than once--for example, when `bana*' matches the string `bananana' , the parenthetical subexpression matches three times. When this happens, regexec usually stores the offsets of the last part of the string that matched the subexpression. In the case of `bananana' , these offsets are 6 and 8 .

But the last match is not always the one that is chosen. It's more accurate to say that the last opportunity to match is the one that takes precedence. What this means is that when one subexpression appears within another, then the results reported for the inner subexpression reflect whatever happened on the last match of the outer subexpression. For an example, consider `bana*s *' matching the string `bananas bas ' . The last time the inner expression actually matches is near the end of the first word. But it is considered again in the second word, and fails to match there. regexec reports nonuse of the "na" subexpression.

Another place where this rule applies is when the regular expression `bana*s neferti* *' matches `bananas nefertiti' . The "na" subexpression does match in the first word, but it doesn't match in the second word because the other alternative is used there. Once again, the second repetition of the outer subexpression overrides the first, and within that second repetition, the "na" subexpression is not used. So regexec reports nonuse of the "na" subexpression.


Sam Spade Menus
Menus

F ile

T ools

V iew

W indow

T ools

H elp


Toolbar

	Close current window and append the contents to the log
	Append the current window to the log
	Copy the current window contents to the clipboard
	If there is a single line of text on the clipboard, paste it to the address box. If there's more than one line, paste it to a new window, then run a header analysis on it if Smart Paste is enabled
	The address box. The address in this box is the one checked by all tools
	Ping the address
	DNS lookup - find the hostname and IP address of the address
	whois - find who owns the domain name
	IP block - find who owns the address
	dig - perform a DNS query for the address
	traceroute - find the route packets take between you and the remote system
	finger the address
	SMTP verify - ask the mailserver to verify the address
	Browse the web
	Keep a dialup connection alive


Internet Protocol Addressing and Domain Name Service
Internet Protocol Addressing

(This is a pruned version of the full document )

Each machine connected to an IP network (such as the Internet) is addressed using a unique 32 bit number, the IP address.

Many machines will have more than one IP address - for example a machine running virtual websites will have an IP address for each website they host.

Other times a pool of IP addresses is shared between a number of machines - eg on a dynamic-IP dialup connection your machine will be allocated a different IP address each time you connect.

These addresses are usually written in Dotted Quad notation, as a series of four 8 bit numbers, written in decimal and separated by periods. For example 151.196.75.10

Each number is in the range 0 to 255 - so if you ever see something that looks like an IP address with numbers outside those ranges it's not a real address.

The leftmost number is the most significant, and the rightmost the least.

So 151.196.75.10 and 151.196.75.11 are right next-door to each other whilst 151.196.75.10 and 152.196.75.10 are completely unrelated.

IP Address allocation

Traditionally IP addresses were allocated to companies and ISPs in blocks.

A Class A Address Block or, less formally, an A Block is a block of 16,000,000 or so (2^24) addresses from X.0.0.0 to X.255.255.255, where 0 < X < 127.

So the entire 9.0.0.0 - 9.255.255.255 range of addresses is the A Block owned by IBM.

A B Block is a block of 65,000 or so (2^16) addresses from X.Y.0.0 to X.Y.255.255, where 127 < X < 192 and 0 <= Y < 256

A C Block is a block of 256 addresses from X.Y.Z.0 to X.Y.Z.255 where 191 < X < 224, 0 <= Y,Z <256

(There are also D and E class addresses allocated in the 224-255 range - these are reserved for multicast and experimental applications - you'll never see them in practice)

Traditional blocks are often described using the first address in the block, eg IBM own A Block 9.0.0.0 and Cyberpromo own C Block 205.199.2.0 . Other times they may be described using just the constant prefix, eg net 9 for IBM or net 205.199.2 for CyberPromo

[You'll often hear any address range from X.Y.Z.0 to X.Y.Z.255 called a C Block, even though it technically isn't unless 191 < X < 224]

CIDR Allocation

Recently things have changed. IP addresses are in short supply and routers have become more sophisticated, so it's now usual to allocate blocks of addresses on pretty much any bit boundary. You'll often see blocks of 64 addresses for instance, such as 151.196.75.128 to 151.196.75.191

A common way of naming these blocks is CIDR syntax, this is the initial constant prefix and the length in bits.

So 151.196.75.0 to 151.196.75.255 might be described as 151.196.75/24

and 151.196.75.128 to 151.196.75.191 might be described as 151.196.75.128/26

But who's in charge of this address block?

To find out who administers a block of addresses you can use the IP Block tool to query the internic database. This is sometimes wildly out of date, but can be a good start.

Special Cases

There are some special ranges of addresses reserved for special uses.

Loopback

The 127.*.*.* block is reserved for local loopback - so these addresses will always point back to your own machine.

The canonical loopback address is 127.0.0.1

Private networks

Some blocks of addresses are allocated for private networks - packets from these machines should be dropped by most routers. Why is this useful? If you want to setup a private network you don't need to use up any of the scarce allocation of 'real' IP addresses. So you need to make up your own addressing scheme to use internally.

As long as you're not connected to the internet in any way you could use any scheme you wanted. But what if you have a gateway machine that lets you e.g. send mail to and from the internet? If you chose an arbitrary IP address range for your local network and the packets leaked through the gateway onto the internet they'd end up going to the Real owner of those addresses, probably fubaring their system and provkoking stern 'phone calls.

This has happened, even within huge multinational corporations who didn't follow the rules and chose arbitrary addresses for their internal network.

So there are ranges of addresses allocated as private addresses. You can use these quite safely, as everyone's routers are told to just throw packets to or from these addresses away. So if your packets escape they'll be deleted.

These private address blocks are:

10.0.0.0 - 10.255.255.255

172.16.0.0 - 172.31.255.255

192.168.0.0 - 192.168.255.255

If you see one of these addresses in a received line it means the email has been forwarded around an internal network before being gatewayed to the internet proper.

So far, so froody.

There are some IP addresses in each block reserved for broadcast and other obscure stuff. Check the RFCs if you're really interested.

Email to an IP address

Incidentally, if you want to send email to a machine and you know the machines IP address you can send it to user@[w.x.y.z]

So, just for the sake of example, if you were to put this HTML tag:

<A HREF="mailto:postmaster@[127.0.0.1]"></A>

in a web page, and someone were to scan your webpage for email addresses and then try to send spam to them they'd end up sending a copy to postmaster at the machine 127.0.0.1. As we said earlier 127.0.0.1 is always your own machine, so this would make the spammer spam their own system administrator....

Name resolution

IP addresses work pretty well, but they're not as memorable as machine names. So we need some way to map names to addresses (and ideally back again).

Domain Name Service

DNS is a distributed system. The end user doesn't really care about this, but in case you're interested here's how it works.

You try and access http://www.blighty.com . Netscape wakes up and asks Windows what IP address www.blighty.com maps to.

Windows then sends a request to your local nameserver, usually the nameserver of your ISP. If someone else has looked up the address recently the nameserver might already know the answer. If not it realizes that it doesn't know, and works out who might know.

Your ISPs nameserver then contacts that nameserver - if it knows it answers. If not, it works out who might know.... you get the idea.

Finally the result gets forwarded back to your local nameserver, which caches the result so it can use it again later and passes the answer back to your system - 151.196.75.10.

[In reality it's a bit more formal than that, with 'zones of authority' rather than guesswork to find out who might know the answer]

DNS lookups

If you want to query your DNS server directly you can use the DNS tool

Reverse lookup

Finding the hostname given the IP address is very useful. If you're tracing spam you need the domainname to be able to find whois information.

Sometimes you can just use the DNS tool on an IP address, and it'll give you the hostname. Sometimes it won't be able to find a hostname

Just because a host has forward DNS from name to address there's no guarantee or requirement for it to have reverse DNS from address to name. Many sites do, many sites don't.

If there's no reverse DNS you need to resort to guerrilla approaches. If there's a web site that's a good bet. Do a view source to look at the HTML source, particularly for forms and mailto links.

Sometimes telnetting to the machine will give a banner identifying the machine. Or telnetting to other ports on the machine (25, 110, 119) can sometimes give a banner. Then you can use forward DNS to confirm that the address maps back to the right IP.

The port scan tool can scan a range of ports on a machine, to see which are providing services. Then you can telnet to each one in turn to see if any leak information.

What if the site is being coy, and trying to hide their domainname? Most virtual web-hosting companies require customers to have a domain name, but if it's not used anywhere and the website is advertised using it's IP address rather than domain name it's hard to find.

On some virtual web servers accessing http://w.x.y.z/stats or http://w.x.y.z/logs triggers a redirect that can give you the name.

Advanced DNS

DNS has all sorts of good stuff in it, not just the address-name mappings. You can get at this with the dig tool .

These are some of the things it can tell you:

A

The Address of a hostname. There's only one A record for each host.

NS

The authoritative nameserver for a domain

MX

The mail exchanger for the domain. For example, there is no such machine as demon.net, yet you can send email to user@demon.net. The MX record tells the mail system to send mail for user@demon.net to user@relay-1.mail.demon.net instead.

CNAME

An alias for a machine. A number of different names may resolve to the same IP address. A CNAME entry for a domain points you at the real name of the system.

HINFO

Hardware and software used by the host

RP

The responsible person for a domain

ANY

All records available

There are around 40 more, but these are the most common.

You can also ask for a complete Zone Transfer from a nameserver. This contains all the records it has for a given domain. If there's no reverse DNS setup this can be the only way of getting a full list of the machines within a domain. You can only do a zone transfer from the name server that is authoritative for a domain, so you need to query your local nameserver to find an authorative server for a domain before doing a zone transfer

References

Internet Protocol

RFC791

RFC1122

A more technical tutorial

Private addresses:

RFC1918

DNS

A good DNS overview

Lots of DNS resources

Linux DNS Howto

O'Reilly books

TCP/IP Network Administration

DNS and BIND

Essential Windows NT System Administration

Linux Network Administrator's Guide


Using Sam Spade
Showing full headers

If you don't see a Received: line in your email headers your mail client is hiding some headers from you. In order to find the source of an email you need to see the full headers

All mail readers have some way of showing fullheaders:

Eudora Light before V3

Select Tools , Options... , then Fonts & Display then Show all headers (even the ugly ones)

Eudora Light (V3+)

Press the BLAH button on the incoming mail message

Netscape 3

Select Options , Show Headers , then All


Sam Spade Window Menu
Window Menu

Cascade

Tile

Arrange Icons

None of these three are particularly useful, but they're traditional in an MDI application

They're followed by a list of the child windows


IP Block lookup

Selecting the IP Block button - [image] - will attempt to lookup the owner of the current address

The results will appear in a new window in the same way as whois

If the whois server selected is Magic the IP block lookup will try multiple servers if needed to find the owner of the block. If a specific server is selected only that server will be queried


DNS tool

Perform forward and reverse DNS queries for the current address (this will usually give you the IP address of a hostname and the hostname of an IP address)


Status bar

The status bar has three panes

The first displays flyby help as you move the cursor over controls

The second and third display the number of active network transactions


Spam-tracking 101: by Bill Mattocks
Spam-tracking 101

by Bill Mattocks

Are you sitting comfortably? Good, then I'll begin.

Here is a spam I just received. It is bad, because it is spam. It is bad, because it attempts to masquerade as being information I requested to avoid detection as spam. It is bad because it has mangled headers to attempt to deflect complaints away from the true perpetrators. It is also quite funny. Here it is, dissected for the newer anti-spammers to watch and learn from:

First line:

>Received:  from  bullets.cybercon.com  (bullets.cybercon.com  [199.217.156.7])
>by  mail.comp-sol.com  (EMWAC  SMTPRS  0.83)  with  SMTP  id
><B0000036788@mail.comp-sol.com>;  Wed,  10  Sep  1997  20:00:52  -0500

This is my mail server getting the spam from a mail server known as bullets.cybercon.com. Please note that the ISP listed here may well have been innocently hijacked by the spammer, we really don't know yet.

>Wed,  10  Sep  1997  21:02:53  -0500
>Received:  from
>From:  84903020@ix.netcom.com

This is all fake, inserted by the spammer's bulk mail software. It can be safely ignored.

>Received:  from  199.217.156.7  (hd70-155.hil.compuserve.com  [199.174.250.155])
> 	by  bullets.cybercon.com  (8.8.5/8.8.5)  with  SMTP  id  UAA03117;
> 	Wed,  10  Sep  1997  20:27:30  -0500

This line purports to show where bullets.cybercon.com actually got the mail from that it relayed to me. Please note that " 199.217.156.7 " does not belong to " hd70-155.hil.compuserve.com ." How do we know this? Simple, we use a tool called nslookup (available for many platforms). Here is what we see:

[199.217.156.7]
Translated  Name:  bullets.cybercon.com
IP  Address:  199.217.156.7

[hd70-155.hil.compuserve.com]
Translated  Name:  hd70-155.hil.compuserve.com
IP  Address:  199.174.250.155

What does this all mean? It means that the first part of the line is bogus, but the second part is correct. We know that because most mail server software will report accurate information about where it got the mail from in most cases (it has to be misconfigured or older brain-dead software to be completely silent about where it got the mail from). It has been my observation that you can trust the IP address found within the square brackets, i.e. " [199.174.250.155] "

So, we have a reasonable expectation that the spammer used a dialup account on Compuserve to send this spam. We still do not know if the ISP it was sent through is innocent or guilty, though. We will complain to Compuserve at abuse@compuserve.com , for starters.

>Received:  from  usr15-dialup53.mx1.Willowsprings.mci.net  [166.55.38.181]
    by  Willowsprings.mci.net  (8.8.5/8.6.5)  with  SMTP  id  GAA02664
for  <bullwinkle@rocky.com>;  Wed,  10  Sep  1997  20:59:04  -0600  (EST)
>Date:  Wed,  10  Sep  97  20:59:04  EST
>To:  bullwinkle@rocky.com
>Subject:  Here's   the  info  you  requested
>Message-ID:  <19970908182053.load2391.in@don>
>Reply-To:  mrchicken@answerme.com
>X-UIDL:  12345678987456123012345698745612
>Comments:  Authenticated  sender  is  <don@Willowsprings.mci.net>

The above is all trash. You can ignore any headers after the correct ones are found. That is because mailers put the headers onto the top of the message when they pass it along, not somewhere inside the message. Thus, the very top message was from my mailer, receiving the mail. The one right under that was from the ISP's mailer, sending it to me and reporting where it got it from. The rest is junk, designed to confuse us. Don't be fooled by "Authenticated sender" messages. They are easily faked, and mean nothing. They don't "authenticate" anything.

><HTML><PRE><BODY  BGCOLOR="#000000"><FONT  COLOR="#00FFFF"  SIZE=3>
>Everybody  loves  Mr.  Chicken!

Ah, here's where it gets amusing! So, let's just enjoy this spam for a moment, shall we?

>Kids  are  going  wild  over  Mr.  Chicken.   Parents  laugh  hysterically  at  the  sight  of  him.
>Why  spend  $50  on  toys  that  your  kids  forget  about  the  next  day  when  for  pennies
>they  can  have  a  Mr  Chicken  that  they'll  enjoy  for  months?
>For  full  details,  Email  MrChicken@answerme.com

Now, if we follow Rush Limbaugh's advice and "follow the money," it would appear that the perpetrator of this spam has a mailbox at answerme.com , and his handle is "MrChicken." What do we know about answerme.com ?

Cyber  Promotions  (ANSWERME4-DOM)
8001  Castor  Avenue,  Suite  #127
Philadelphia,  PA  19152
USA

Well, it happens that Cyberpromo is the owner of this particular domain. That kind of ends that trail for us, because Cyberpromo is a spamhaus, and their upstream provider, AGIS, is well aware of it and supports it. AGIS is a "backbone" on the Internet, so there is no one above them to complain to. Still, since Cyberpromo CLAIMS to be against illegal relaying, we can send a copy of the complaint to relayabuse@cyberpromo.com and also to abuse@agis.net . This won't do anything, but what the heck.

></FONT><FONT   COLOR="#000000"  SIZE=3>

So, that ends the spam. Now, what about the original ISP who sent the spam to me? Innocent party or spamhaus? Well, let's take a look at their web page: http://www.cybercon.com/aup.html

Cybercon Acceptable User Policy

It is contrary to Cybercon policy for any user to effect or participate in any of the following activities through a Cybercon service:

[snip]

3. To send unsolicited mass emailings to more than twenty-five (25) email users, if such unsolicited emailings provoke complaints from the recipients;

4. To engage in any of the foregoing activities using the service of another provider, but channeling such activities through a Cybercon account or remailer, or using a Cybercon account as a maildrop for responses;

Now, it would appear from looking at their homepage (http://www.cybercon.com/) and also by "reading between the lines" of their AUP, that Cybercon is a spamhaus, however thinly disguised. That does not mean that they authorized this spam, or that they were not hijacked. But the suspicion is definitely there. In any case, they get a copy of the complaint as well. If they were hijacked, they may wish to investigate further and perhaps initiate legal action. If they were not, they may remain silent on the matter. In any case, they also have an upstream provider, which can be determined by doing a traceroute on " bullets.cybercon.com "

 1   156.46.104.254  (156.46.104.254)
 2   alpha-nomad.alpha.net  (206.190.31.149)
 3   mke-1.alpha.net  (156.46.1.1)
 4   chicago2-cr2.bbnplanet.net  (204.167.132.9)
 5   chicago1-br1.bbnplanet.net  (199.92.131.11)
 6   core5-hssi5-0.WillowSprings.mci.net  (206.157.77.201)
 7   core1.NorthRoyalton.mci.net  (204.70.4.205)
 8   core-hssi-2.Chicago.mci.net  (204.70.1.93)
 9   border4-fddi-0.Chicago.mci.net  (204.70.3.83)
10   startnet-llc.Chicago.mci.net  (204.70.27.6)
11   router.cybercon.com  (199.217.252.58)
12   bullets.cybercon.com  (199.217.156.7)

So, we know they get their service from mci.net. Therefore, a complaint also goes to abuse@mci.net .

What else do we know about the elusive Cybercon? Let's check their IP range , to see who might own it. We can use " whois "

whois  199.217.156.0
[rs.internic.net]
STARNET,  L.L.C.  (NETBLK-STARNET-CBLK)
P.O.  Box  6286
St.  Louis,  MO  63006-6286

Netname:  STARNET-CBLK
Netblock:  199.217.128.0  -  199.217.255.0
Maintainer:  STLL

Coordinator:
Myers,  Chris  B.  [President]   (CBM10)   chris@STARNET.NET
(314)  227-3136  (FAX)  (314)  716-6163

Domain  System  inverse  mapping  provided  by:

ADMIN.STARNET.NET             199.217.253.10
NEWS.STARNET.NET              199.217.253.11
NS1.DRA.NET                   192.65.218.14

Record  last  updated  on  30-Aug-96.

So, it appears that Starnet owns their Class "C" license. Now, let's jump into DejaNews (the land of "all my sins remembered") and see what we can find out:

For " cybercon.com ," we find only this:

*******************QUOTE*******************
2  Matches  for  search:   cybercon.com

1.  97/05/18  016  [email]  Information  /uu.  news.admin.net-abus  LINDSEY
JEAN  NICE  <
2.  97/03/01  016  [email]-BETTER  THAN  AOL   news.admin.net-abus  LINDSEY
JEAN  NICE  <
******************ENDQUOTE*****************

Upon reading the messages in question, it appears that they once complained that they had been mischaracterized as "cybercoM.com" and not " cybercon.com " and wanted a retraction printed. OK, no spam reports. How about their class C ticket holder?

[nothing of consequence found]

What about doing a search for " mrchicken ?"

Here is what we find:

**********************QUOTE**********************

Subject:       Everyone  loves  Mr  Chicken
From:          igynews@sprynet.com
Date:          1997/09/08
Message-Id:    <5uv7e4$qiv$1@juliana.sprynet.com>
Organization:  Sprynet  News  Service
Newsgroups:    alt.activism.children
[Fewer  Headers]

EVERYONE  LOVES  MR.  CHICKEN!

Are  you  tired  of  paying  hundreds  of  dollars  for  toys  your  kids  break
or  get  bored  of  the  next  day?   How  would  you  like  a  toy  that  can
provide  countless  hours  of  fun  for  literally  pennies?   MR.  CHICKEN  is
the  answer.   For  full  details,  email  MRCHICKEN@answerme.com

**********************ENDQUOTE**********************

So, it appears that MrChicken has posted an identical message a few days ago in UseNet. Just one, so not spam, although since it just happened, the others may not have been picked up by DejaNews yet. Still, we see that sprynet.net was used, not cybercon.com . It begins to look as though cybercon.com is not guilty, but either was hijacked or has a bad actor on their hands. So, we still complain to Cybercon, but scratch abuse@mci.net (their upstream provider) from the list.

Now, it appears that we have done "due diligence" on our search to find the source of the spam. We believe that the guilty party is only mrchicken@answerme.com . So, here is our complaint e-mail:

To:  mrchicken@answerme.com

[ Note - this will get me a response from their autoresponder, which may give me more information on the identity of "Mr. Chicken." However, it may also subject me to more spam. I am willing to risk it, for the sake of the exercise. You probably do not want to do this.]

From:  bmattocks@comp-sol.com

Subject:  SPAM  REPORT  ->Re:  Here's   the  info  you  requested

CC:  staff@cybercon.com,support@cybercon.com,  abuse@agis.net,relayabuse@cyberpromo.com

NOTE  TO  CYBERCON.COM:   It  would  appear  that  your  SMTP  server  was
either  hijacked,  or  you  have  a  "bad  actor"  on  your  hands.   Could  you
please  investigate  and  take  action  on  this?

NOTE  TO  CYBERPROMO:   It  would  appear  that  a  client  of  yours
(MrChicken@answerme.com)  is  failing  to  use  your  relay  service,  and  may
have  hijacked  the  SMTP  server  belonging  to  cybercon.com.   Please
investigate  and  take  action!

NOTE  TO  AGIS.NET:   This  spam  was  sent  via  what  may  well  have  been  an
illegally  hijacked  SMTP  server.   Please  investigate  and  take  action.

Thanks,

Bill  Mattocks
Computer  Solutions  of  Kenosha
http://www.comp-sol.com

>Received:  from  bullets.cybercon.com  (bullets.cybercon.com  [199.217.156.7])  >by  mail.comp-sol.com  (EMWAC  SMTPRS  0.83)  with  SMTP  id  ><B0000036788@mail.comp-sol.com>;  Wed,  10  Sep  1997  20:00:52  -0500
>From:  84903020@ix.netcom.com
>Received:  from  199.217.156.7  (hd70-155.hil.compuserve.com  [199.174.250.155])
> 	by  bullets.cybercon.com  (8.8.5/8.8.5)  with  SMTP  id  UAA03117;
> 	Wed,  10  Sep  1997  20:27:30  -0500
>Received:  from  usr15-dialup53.mx1.Willowsprings.mci.net  [166.55.38.181]  by  Willowsprings.mci.net  (8.8.5/8.6.5)  with  SMTP  id  GAA02664  for  <bullwinkle@rocky.com>;  Wed,  10  Sep  1997  20:59:04  -0600  (EST)
>Date:  Wed,  10  Sep  97  20:59:04  EST
>To:  bullwinkle@rocky.com
>Subject:  Here's   the  info  you  requested
>Message-ID:  <19970908182053.load2391.in@don>
>Reply-To:  mrchicken@answerme.com
>X-UIDL:  12345678987456123012345698745612
>Comments:  Authenticated  sender  is  <don@Willowsprings.mci.net>

><HTML><PRE><BODY  BGCOLOR="#000000"><FONT  COLOR="#00FFFF"  SIZE=3>
>Everybody  loves  Mr.  Chicken!

>Kids  are  going  wild  over  Mr.  Chicken.   Parents  laugh  hysterically  at  the  sight  of  him.
>Why  spend  $50  on  toys  that  your  kids  forget  about  the  next  day  when  for  pennies
>they  can  have  a  Mr  Chicken  that  they'll  enjoy  for  months?
>For  full  details,  Email  MrChicken@answerme.com

></FONT><FONT   COLOR="#000000"  SIZE=3>

OK, folks, that's it for tonight. Any questions? If not, class is dismissed.

Best Regards,

Bill Mattocks, CIIU

Derived from an HTML translation by Marek Jedlinski of a usenet post by Bill Mattocks


Sam Spade View Menu
View Menu

Toolbar - shows or hides the toolbar

Status Bar - shows or hides the options bar

Options Bar - shows or hides the status bar


Spam-tracking 102: the many uses of DejaNews; by Bill Mattocks
Spam-tracking 102:
the many uses of DejaNews

by Bill Mattocks

Are you sitting comfortably? Good, then I'll begin.

Since posting Lesson 101 (spam tracking for newbies), I have received a few comments by people curious about DejaNews and how it works. Quite simply, DejaNews is one of the dedicated spam-tracker's most powerful tools, and it is quite simple to use.

DejaNews is a free service and trademark of Deja News ™ is a trademark of Deja News Research Service, Inc . They make their money by selling banner advertising that the user sees across the top of their screen when it is used.

DejaNews is the memory of UseNet. There are ways to prevent a given UseNet message from being archived by DejaNews, and there are ways to remove your own information from DejaNews, but for legitimate spam-trackers, that's not important. For the most part, DejaNews simply records a major part of UseNet News traffic, and indexes every single word of it (that's important, as we'll see later).

What is important is that DejaNews has many powerful features that we can use to track spam back to its source.

Keeping in mind that most spammers have been at it for awhile, we can use DejaNews for the following:

1. Determining from where and for how long a spammer has been spamming.

2. Determining if anyone has succeeded in unmasking the spammer yet.

3. Determining if the spammer has given away clues to his or her own identity over a period of time.

To expand on that:

1) By searching for a spammer's name or address, we can see if the spammer has been spamming from more than one location over time. In effect, we can track the spammer's history as they are kicked from ISP to ISP. This is useful information!

Often, we get "I'm sorry" responses from clueless ISPs or even the spammers themselves, who want to fool us into thinking that they are "beginners" at the spamming game. DejaNews can put the lie to this one right away! If an ISP gets a spam report, that's one thing. But, if the ISP gets a report that gives detailed information on just how long the spammer has been at it, and how they've been kicked from ISP to ISP, that's quite another. It may be enough to convince some ISPs to dump the spammer, since he has been lied to. In any case, you'll know when NOT to believe the clever "I'm sorry" lie.

2) One can see how quickly the messages fly by in NANAE. This can make it hard to recall exactly who said what to whom and when. Often, a spammer is unmasked due to the hard work of some anti-spammer, and then is RE-unmasked by another anti-spammer 6 weeks later. Before investing all of your time and energy in tracking a spammer, do yourself a favor and see if the job has already been done for you! Of course, you must still exercise due diligence to be certain that the spammer is the same one you're after, but take the time to look! The power of DejeNews lets you network with anti-spammers who are speaking to you, as it were, from the past.

3) Spammers often change little bits and pieces of their spam as they fine-tune it. If they find that they've left themselves vulnerable, they change the ugly bit and continue on. They hope that nobody realizes that they've fixed whatever it was that gave them away in the first place. However, DejaNews is the answer here. By comparing past and present spams from the same spammer, one can find interesting things which can finish a puzzle sometimes. This is not frequent, but it does happen. Keep your eyes open for subtle changes in a spammer's methods that might indicate a weak link.

HOW TO USE DEJANEWS:

Quite simple to begin. Go to http://www.dejanews.com/ and type in the name or mailing address of the spammer. Click on the FIND button. However, sometimes it is not as simple as all of that. Fortunately, as I said earlier, DejaNews indexes the COMPLETE TEXT of all that it collects. Given that, you can search on random bits of text that can shed light on the identity of a spammer. Is he using a PO Box? If so, type that in. You'd be amazed at how many spammers are too cheap to get a new PO Box after they're unmasked at one spam and move on to another. Same PO Box generally means same spammer. Phone numbers. Searching for ISPs can give a clue as to whether or not they've been known to host spammers. Use your imagination! Try matching up the IP address that the spammer came in from. That is less useful, since most IP numbers are pseudo-random when they're hosting a dialup account, but you never know. It might be an IP address that's been made to look like a dialup, but is really a dedicated circuit. You have to think a bit like a detective. Use logic and reasoning to satisfy yourself that a hit is or is not the spammer you're looking for. Even a ".sig" line can ID a spammer sometimes. Spammers are often quite gray little blobby creatures, devoid of individual traits, but sometimes one burns with a bit of creativity, or happens to seize upon a certain phrase which they like to use over and over. It can be their undoing.

Don't forget to search all the way back in DejaNews. At the end of the initial search, you'll see another block with your original search in it, and a couple of radio buttons for "recent" and "old" news. The default that you've just completed is recent. Make sure to check out the "old" news as well.

DejaNews has many powerful features, including a power search mode. I encourage you to explore those features as well, although you'll have to learn a bit about boolean logic , which is beyond the scope of this lesson.

That's it for now. Remember, DejaNews is a big hammer for the anti-spammer. Don't be afraid to use it to clobber a spammer.

Best Regards,

Bill Mattocks, CIIU

Derived from an HTML translation by Marek Jedlinski of a usenet post by Bill Mattocks


Finger
SMTP Verify

Verify - [image] - asks a mail server about one of it's users. Many machines have verify disabled, but if it's available it can give a lot of interesting information


Spam-tracking 103: WHOIS database; by Bill Mattocks
Spam-tracking 103:
the WHOIS database

by Bill Mattocks

Many thanks to all; I have received a warm response to Spam-tracking 101 & 102. I was intending to do 103 in a few days, but what the heck, you all have warmed the cockles of my heart! (What exactly is a cockle, anyway?) So here it is - Spam-tracking 103 , the WHOIS tool.

By the way, there are a lot of folks out there who know MUCH more about spam-tracking than I do. Please feel free to put out your own curriculum. The important thing is that we educate this flood of newbies and lurkers who hate spam as much as we veterans do. We want everyone to get into the the spam-fighting biz, don't we?

Are you sitting comfortably? Good, then I'll begin.

Since the Internet was essentially started by stringing together a bunch of computers that spoke the Operating System known as Unix, most of the administrative and client tools that act over the internet were originally Unix tools, as well. Even UseNet was at one time only readable by Unix machines and those who had mastered its arcane command set. There are still a bunch of us old grizzled veterans around, and you will see us speaking to each other in bizarre terms and buzzwords, and you might wonder what the heck we're talking about.

Fortunately, most, if not all, of the tools that are used on the Internet have been reproduced in a more user-friendly, graphical, way in the Windows, Windows 95, and MacIntosh arenas. This, then, is an introduction to the major tools that systems administrators (sysadmins) use to track down Internet problems. Also fortunately, most of them are readily adaptable to search out the roots of spam.

Shameless Plug (I have nothing to do with this company, but I like their software):

My personal favorite is NetScan Tools for Windows 95 . It has a very nice user interface, and it contains all kinds of tools other than just whois - we will cover those in future lessons, since WHOIS is a big topic. You can get a shareware copy of it at: http://www.nwpsw.com/ . It is a free 30-day evaluation copy of the tool. It is expected that you will register and pay for it if you use beyond 30 days. It costs $US25, and I believe it is money well spent. End of plug .

You can obtain these tools from a variety of sources. I recommend taking a look at http://www.tucows.com/ but there are many other sources, such as http://www.download.com/ and http://cws.internet.com/ .

Besides Unix, I am most familiar with Windows/Win95, so these are the tools I will refer to. If anyone knows of their Mac analogue, perhaps they would post those tools as a followup to this message.

In this lesson, we begin with WHOIS :

The WHOIS database is a compendium of domain names. You may already know that the Internet itself does not speak "human" or "english." It speaks in IP (Internet Protocol) addresses . Those addresses have to be linked to the human domain names in a database in order to be useful. If I were typing from a Unix prompt, I would type the commands like this:

whois comp-sol.com

-or-

whois 156.46.104.0

-or-

whois '!NETBLK-SPRINT-CF284F'

The point here is that WHOIS can be used in a variety of ways to query the infomation contained therein. Sometimes, you may get a bewildering response from Internic, but there is usually something further that you can query to track a source of spam. If you don't know how to begin, try just typing in whois "anything" and see what you get. You won't break it or make anyone mad at you.

QUERYING A DOMAIN NAME

If you query a domain name, say "spamlovers.com" and get a "No Response Found" reply from Internic, that means that it is NOT a legitimate domain name, because Internic has authority over all domain names that end in .com. Same for .net , .org , and .edu . Notice, please that you must enter "spamlovers.com" and not "www.spamlovers.com" or "spammachine.spamlovers.com" to get a positive response. It is just the last bit of the domain name in front of the dot that we are interested it. The bit in front of "spamlovers.com" denotes a machine belonging to that organization, but it is named locally, not by Internic.

Now, on to the domain name. If you are querying a US domain name, and it is legitimate, you should get back a response, and it may look something like this:

whois  comp-sol.com

[rs.internic.net]
Computer  Solutions  of  Kenosha  (COMP-SOL-DOM)
   2031  22nd  Avenue
   Kenosha,  WI  53140
   US

   Domain  Name:  COMP-SOL.COM

   Administrative  Contact,  Technical  Contact,  Zone  Contact:
      Mattocks,  Bill   (BM561)   bmattocks@COMP-SOL.COM
      (414)551-8088
   Billing  Contact:
      Mattocks,  Bill   (BM561)   bmattocks@COMP-SOL.COM
      (414)551-8088

   Record  last  updated  on  06-Sep-97.
   Record  created  on  09-Aug-95.
   Database  last  updated  on  12-Sep-97  04:47:08  EDT.

   Domain  servers  in  listed  order:

   DARKSTAR.NOMAD.NET            156.46.104.2
   NOMAD.NET                     156.46.104.1

The  InterNIC  Registration  Services  Host  contains  ONLY  Internet
Information  (Networks,  ASN's,  Domains,  and  POC's).
Please  use  the  whois  server  at  nic.ddn.mil  for  MILNET  Information.

Let's deconstruct the information and see what it means:

Computer  Solutions  of  Kenosha  (COMP-SOL-DOM)
   2031  22nd  Avenue
   Kenosha,  WI  53140
   US

OK, so this is a supposedly a business, called Computer Solutions of Kenosha, in Kenosha, Wisconsin. The "(COMP-SOL-DOM)" bit indicates that comp-sol.com is indeed the domain name. Please bear in mind that spammers are becoming educated about domain names and whois. They often put bogus information in when they register with Internic to get their domain name. That's against the rules, but Internic won't do anything about it at this time. We live with what is. Still, many times this information will be correct. If nothing else, Internic has to have a way to bill the domain. If the information given is totally bogus, the spammer probably intends not to pay the bill, but merely to use the domain name until it expires, and then register a new one. Let's move on:

   Administrative  Contact,  Technical  Contact,  Zone  Contact:
      Mattocks,  Bill   (BM561)   bmattocks@COMP-SOL.COM
      (414)551-8088
   Billing  Contact:
      Mattocks,  Bill   (BM561)   bmattocks@COMP-SOL.COM
      (414)551-8088

This bit tells us who is responsible for the domain, who pays the bills, who keeps it running, etc. Again, it is supposed to contain legitimate information, and again, it often does not. Just the same, if the information is accurate, we now have an e-mail address to complain to. Hmm, happens to be me, doesn't it. Well. Please don't take me too literally. We also have a telephone number to call if we wish to register a complaint that way.

   Record  last  updated  on  06-Sep-97.
   Record  created  on  09-Aug-95.
   Database  last  updated  on  12-Sep-97  04:47:08  EDT.

This bit is not too exciting. It is as it appears, showing us when the domain was created, and when it was last changed.

NOTE: Remember our last lesson about DejaNews ? If the "Record last updated" date is fairly recent, this would be a good time to search for the offending domain name using Dejanews ( http://www.dejanews.com ) to see if any other anti-spammer has posted similar WHOIS information. As a spammer hops from ISP to ISP, they take their domain names with them, and that will show up. Just a tiny bit of information, but it may help to prove to your satisfaction that a spammer is indeed a spammer, and that a particular domain is or is not a spamhaus. It's the little things...

   Domain  servers  in  listed  order:

   DARKSTAR.NOMAD.NET            156.46.104.2
   NOMAD.NET                     156.46.104.1

Finally, we have the bit about the Domain servers. A domain server is simply the machine that does lookups for a particular domain name when someone sends anything to that domain, like when you go to a web page or when you send mail to a particular domain. In this case, if anyone goes to a web page at www.comp-sol.com, their request will be "looked up" by one or both of the machines above. This is important, because a spammer may receive his upstream account (or feed) from one source, and have another source do his DNS or Domain Name Service. It could be another source to complain to. Many times, when you are dealing with a spammer, you will see this:

   Domain  servers  in  listed  order:

   NS7.CYBERPROMO.COM 	205.199.2.250
   NS5.CYBERPROMO.COM 	205.199.212.50
   NS8.CYBERPROMO.COM 	207.124.161.65
   NS9.CYBERPROMO.COM 	207.124.161.50

And you know you are dealing with the deathstar itself. To many of us here on NANAE, seeing this is final and irrevocable proof that the domain in question is a spamhaus, and the sender of the e-mail is a spammer. We tend not to believe that there are any legitimate domains hosted by Cyberpromo.

When you see this, it is like swimming in the ocean and seeing a dorsal fin rise up out of the water and start towards you.

USING WHOIS TO LOOK UP AN IP RANGE:

As we mentioned above, whois can be used in other ways, not simply to look up a domain name. For example, we can use it to find out who a particular IP address belongs to:

whois  156.46.104.1
[rs.internic.net]
[No  name]  (NOMAD4-HST)

   Hostname:  NOMAD.NET
   Address:  156.46.104.1
   System:  IBM  PC  486/66  running  DOS/IPAD

   Record  last  updated  on  03-Aug-95.
   Database  last  updated  on  12-Sep-97  04:47:08  EDT.

This in itself doesn't give us much information (In fact, this information is out of date, and needs to be updated.) Ah well, another task, another day. What's more important than spam-fighting?

IP Blocks

(You can do an IP Block lookup automatically using the IP block lookup tool rather than using the following manual process.)

So, we can look for the owner of the license in question by stripping off the last digit of the IP address and replacing it with a zero. In this case we would do:

whois  156.46.104.0
[rs.internic.net]
No  match  for  "156.46.104.0".

OK, so we didn't get a match. Still, someone owns the IP range in question. So, now we take off the last two IP "octets" and replace both of them with zeros. Thus:

whois  156.46.0.0
[rs.internic.net]
alpha  dot  net,  corp.  (NET-ALPHA)
   324  East  Wisconsin  Avenue,  Suite  609
   Milwaukee  WI,  53202

   Netname:  ALPHA
   Netnumber:  156.46.0.0

   Coordinator:
      Chase,  Tim   (TC15)   support@ALPHA.NET
      414-274-7040

   Domain  System  inverse  mapping  provided  by:

   HOMER.ALPHA.NET               156.46.10.10
   HELEN.ALPHA.NET               156.46.10.20

   Record  last  updated  on  10-Jan-96.
   Database  last  updated  on  12-Sep-97  04:47:08  EDT.

Here is some useful information! We see that the actual IP range (often called a "Class C license") is owned by someone else entirely. In this case, it is owned by alpha dot net corp, in Milwaukee, Wisconsin. We have a contact name and e-mail address, and we have a telephone number. Remember, this will be an upstream provider for the spammer in question, and possibly not spammers themselves. We phrase our complaint accordingly, so as to not offend the good guys.

If that failed to get a result, we could simply keep replacing octets with zeros until we got the owner of an entire block of licenses, and again, we would have someone else to complain to.

The further away we get from the spammer, the less likely it is that we are dealing with spammer-friendly folks. If they get enough complaints, they MAY decide to take action, and we have all heard the phrase, "Shit rolls downhill." Eventually, someone has to take the heat and perhaps terminate the spammer. Keep this in mind.

USING WHOIS WHEN THERE ARE MULTIPLE RESULTS:

Sometimes, when we use whois, we get many responses, not just one. Here is an example:

whois  mattocks
[rs.internic.net]
Mattocks  E-mail  Service  (MATTOCKS-DOM)     MATTOCKS.COM
Mattocks,  Bill  (BM561)           bmattocks@COMP-SOL.COM  (414)551-8088
Mattocks,  Bill  (BM1199)          bmattocks@COMP-SOL.COM  (414)551-8088
Mattocks,  Christopher  (CM3732)   kolis@LVWEBMASTERS.COM   6024884305
Mattocks,  Darryl  (DM812)         darryl.mattocks@BOOKSHOP.CO.UK
Mattocks,  Jeff  (MJ100-ORG)       JeffMattocks@MSN.COM    (360)  896-8150

To  single  out  one  record,  look  it  up  with  "!xxx",  where  xxx  is  the  handle,
shown  in  parenthesis  following  the  name,  which  comes  first.

And sure enough, there are instructions right there as to how to narrow down your search. Simply type in an "!" followed by the information shown in the parenthesis. In my case, it would be:

whois  '!BM561'

and that would bring up my information.

FOREIGN WHOIS SEARCHES:

What about domains located outside the US? Well, our information is a bit spotty there. There are equivalents of Internic outside of the US, and they work the same way. Some of them can be searched using the WHOIS tool, but just telling it to point itself at a different database. Other times, a search of the web using something like www.yahoo.com will bring you to a web page that will let you do a foreign whois search directly from that web page.

(List of foreign servers snipped - Sam Spade handles these for you)

That concludes the lesson for today. Please feel free to throw roses or brickbats, as you see fit. Permission is hereby granted for anyone who wishes to publish this information in any form, as long as it remains intact and attribution to the author is given. I maintain copyright and transfer all other rights to the public.

Best Regards,

Bill Mattocks, CIIU

Derived from an HTML translation by Marek Jedlinski of a usenet post by Bill Mattocks


InterNetNews Usenet Newsserver


Internet Service Provider


Multi User Dungeons


Posting one copy of an article so that it will be seen on multiple groups


Internet Service Provider


Internet Control Message Protocol


Read the group without posting


Universal Resource Locator, eg http://www.blighty.com/


Multiple Document Interface