Turnbull China Bikeride/Turnbull China Bikeride - Disc 1.iso/ARGONET/PD/COMMS/JUNK.SPK/!Junkmail/!Help

Text File | 1998-01-10 | 12KB | 334 lines

!Junkmail is a program which automates the preparation of complaints about
e-mail spam.



It should work with any Internet package which contains

(A) A mail client program from which you can output the full headers of the
messages that you want to complain about, with the headers at the top of the
message.

and

(B) Either

    A mail client into which you can save the generated complaint messages
with their full headers.

    Or

    One of the following transports:  Ant, Termite, KA9Q, SOUP, Taylor, UUCP


For example, it won't work with the Offlite mail client, because Offlite
refuses to output the headers at the top of the message.

For example it will work with the Termite/Newsbase/TTFN combination, since
TTFN will output the message with full headers, and Termite is a supported
transport.

!Junkmail has not yet actually been tested with SOUP, Taylor or UUCP.


** Important ** You should configure the files in the !Junkmail.Formats
** directory before using !Junkmail.
**
** In particular, you should set up the "From:" and "Reply-To:" lines to
** identify yourself.
**
** Leave the "To:", "Date:" and "Message-ID:" lines empty.
**
** If using an "Ant" format (see below), you should set up the "MAIL FROM:"
** and "From:" lines exactly as they appear in files that the Ant Suite
** creates in its mail queue.
**
** The remaining header lines and text may be editied to your taste.


What it does
============

If you drop a copy of an e-mail spam (including the full header) onto the
!Junkmail iconbar icon, it will use the current Format file to compose a
message reporting the abuse to what it considers to be the proper
authorities.

You should then persuade your Internet system to send this message. You can
either configure !Junkmail to open a save box, and then copy this message
into your mail client; or you can configure it to write the message directly
into the mail queue of the Ant Suite, Termite, TTFN, KA9Q, SOUP, Taylor or
UUCP.

When using the save box to pass the message to a mail client:-

  With TTFN, you need to start to compose a mail message, to a bogus
  destination, copy the whole of the message generated by !Junkmail into the
  working copy, and delete all the original lines.

  With Voyager, I've been told that you have to enter the "To:" line
  manually.

When writing a message directly to the Ant Suite queue, you must use a
Format file (see below) which has Ant Format SMTP commands in it (like the
supplied "AntUCE" Format file).


The clever bit - abuse reporting addresses
==========================================

For each 'domain' that !Junkmail detects in the header of the message, it
scans its database for corresponding abuse reporting addresses and adds any
matching address to the "To:" line.

It also has a list of known and suspected rogue domains, e.g.
"strategicmail.com" looks like it is associated with Samford Wallace's
"cyberpromo.com" spamming service (Samford is registered as the Technical
Contact for strategicmail) so it's unlikely to be worthwhile complaining to
them.

E.g. if !Junkmail considers that the mail may have originated from
"[e-mail]", it will prepare a complaint addressed to
"[e-mail]".


Another clever bit - rogue domains
==================================

If !Junkmail considers that the message originated from a known rogue domain, it
will take one step back, up the "Received:" stack and consider complaining
to the abuse address of the ISP that relayed the spam. (Legitimate ISPs now
refuse to relay mail from known rogue domains)


Yet another clever bit - registered contacts of rogue domains
=============================================================

!Junkmail contains details of the registered contacts and of the primary
domain server for many suspected rogue domains. So, if the spammer is
operating out of a spam nest (like cyberpromo.com), but has registered, say,
the Administrative Contact with a responsible ISP (like aol.com), it might
possibly be worth complaining to [e-mail].

For example, the domain "gamelin.com" operates out of the "nancynet.com"
spam nest, but their registered Administrative Contact is "[e-mail]",
so it might possibly be worthwhile reporting the spam to [e-mail].

The use of this facility is configurable.


Yet another clever bit - ISP addresses
======================================

Occasionally I've noticed that spammers may manage to completely hide the
name of the domain they are posting from, but the numeric ISP address may
still be present. !Junkmail has a small library of common ISP addresses, and
will translate them into domain names.

For example, when !Junkmail sees the header line:-

    Received: from [207.217.139.140] by zeus.furkon.com

It knows that all addresses beginning with 207.217 belong to the
earthlink.net domain and will route the complaint to [e-mail]


The not very clever bits
========================

(1) Many e-mail spammers disguise their addresses. !Junkmail isn't
particularly smart, and falls for it every time. This can cause complaints
to be sent to ISPs which had nothing to do with the spam, as well as those
which are.

(2) If it can't match any abuse reporting addresses at all, it will direct
the complaint to "postmaster" at each non-rogue domain it finds.

(3) The usefulness of this program depends largely on the quality of the
information in the database. At present, there doesn't seem to be any
central registry of Internet complaint addresses, so this database is
certain to be incomplete. I've included some information which may not be
completely reliable, because of the shortage of reliable sources.

(4) The database is quite likely to become out of date fairly rapidly. If
you use this program a lot, it would be a good idea to try to use an up to
date copy.


Report Templates
================

As delivered, there are three report formats in the !Junkmail.Formats
directory. You can create your own report formats in a similar manner, and
!Junkmail will detect them when it starts up. You might like to have
separate complaint templates for various different types of e-mail spam.

You should not attempt to have more than 9 format files, otherwise the icons
associated with them will fall off the bottom of the control window.

When setting up a report template, you should identify yourself in the
"From:" line and in the "Reply-To:" line. If you are a Demon subscriber, I
suggest using your "postmaster@???????.demon.co.uk" or
"root@???????.demon.co.uk" address.

The "AntUCE" is a file for use with the Ant suite, and should not be used
for other Internet systems. This file is in the format used by the Ant Suite
for messages in its mail queue, so the resulting file can be output directly
into the Ant mail queue folder. When using this format you must set the
"MAIL FROM:" line to contain your e-mail address inside "<>" brackets, e.g.

MAIL FROM:<[e-mail]>


Processing: "Include Comments"
==============================

With this option selected, !Junkmail will include a comment in the complaint
message which explains any clever processing which it has performed.

I recommend that you activate this option whenever any of the "Track"
options are activated, otherwise the receiver won't know why you think that
the spam is associated with them.


Processing: Tracking Contacts
=============================

Whenever a domain is created, the following details are registered:-

Administrative Contact
Billing Contact
Technical Contact
Zone Contact
and a list of Domain Server IDs

For suspected rogue domains, !Junkmail's database contains copies of the
contact details, and the first named Domain Server. When one or more of the
Tracking options are activated, !Junkmail will examine these contact
details, and complain to the reporting address associated with that ISP.


Processing: Send To
===================

When this box is set to "Save box", then when !Junkmail has created a
complaint message, it will open a save box, from which you can drag the
message into a suitable mail client program.

When this box is set to "Ant", "Termite", "KA9Q", "SOUP", "Taylor" or
"UUCP", then when !Junkmail has composed a complaint message, it will write
it directly into the mail queue of the specified Internet system. The filer
must have seen that Internet system for this to work. When using  [Sne To
Ant], you must use a format file which is set up in the Ant mail queue
format.


Logging: Log Headers
====================

Writes a copy of the headers of the messages it processes to a text file
called !Junkmail.Headers.


Logging: Write WhoIs File
=========================

With this option activated, whenever !Junkmail encounters a domain which is
not in its database, it will write a HTML link into a file called
!Junkmail.Who.

These links point to a WhoIs server, and pass it the domain name. In some
cases the WhoIs information will return information which gives you a clue
about the ISP who provides the service.


Logging: Write WWW File
=======================

With this option activated, whenever !Junkmail encounters a domain which is
not in its database, it will write a HTML link into a file called
!Junkmail.WWW.

These links call http://www.<domain> for each unmatched domain encountered.
If the domain has a complaints address, it will probably be listed somewhere
in the website.

Some of the domains that !Junkmail logs into these files will be obviously
bogus, and many will be duplicated. !Junkmail just isn't very smart yet.


Logging: Log Explanations
=========================

With this option activated, !Junkmail will display an explanation of the
reasoning it used to determine the destinations to which it is sending the
complaint message. The explanations are also logged to a text file called
!Junkmail.Explain.


Hints
=====

Try to keep the text of your complaint messages reasonably polite.
Respectable ISPs do impose acceptable use conditions on their subscribers,
and will act against their subscribers when the rules are broken. However,
they only know that the rules are being broken when someone complains.


Digging Deeper
==============

If you want to know about how to delve more deeply into how to trace
spammers, in order to target your complaints more precisely, I recommend
Spam Tracking 101 etc., at <http://www.pdi.net:81/~eristic/junkmail/> and
the Journal of Lysander Spooner at <http://www.iswest.com/~howardk/lysander.html>.
Lysander analyses a Usenet spam, but many of the same techniques can be used
with e-mail spams.


Is it effective?
================

Yes. I got my first hit within 24 hours of sending the first complaint:-

> Thank you for writing,
>
> This individual has been warned regarding the consequences of sending
> Unsolicited Commercial Email , Hacking and Off-Topic Posting.
> Please continue to report any abuse generated by <ibm.net> customers.
> Regards,
> [e-mail]

and then, a 14 hours later I got an update:-

> Thank you for writing,
> We have cancelled this account, please inform us if the abuse continues.
> Thank you,
> [e-mail]


Is it safe?
===========

Not completely. It's possible that the address !Junkmail is sending your
complaints to might, in a few cases, be the spammer himself.


Errors and Enhancements
=======================

When reporting errors relating to inapropriate selection of complaint
addresses, it would be helpful of you could supply the "Explain" output and/or
the header of the spam message.

I'd be quite keen to add support for other Internet systems. If you use a
system which is not currently supported by !Junkmail, then send me the
technical details of how to inject messages into their mail queue and I'll
write code to handle it.


Author
======

Mike Williams      [e-mail]