8th Layer Archive

« Cough, Cough, ack, Thanks! | 8th Layer Archive | Thanks! »

November 28, 2001

I'm baaaaaaack!

As those in my linkage know... I'm feeling much better now. I've updated both my blogs (finally put Hoopty's new address in his link) and joined the zlisters. I finally was able to surf "my blogs" and had a really fun time.

Mercy has put some of her photography on her page. I found that we use the same camera - and there's a cat pic that is soooooo adorable.

Some great big *smooooooooochies* to Jamie ... just because... Geez, Jamie...and I even told someone I thought you were studying last night. I didn't know you were studying the bottom of your cup! And how are those classes going???? I was feeling so good yesterday that I even tackled another chapter! [Hey...I might actually be ready for the test before the free voucher expires...*grin*]

Hoopty is buttonating the entire interneck. He's stealing everyone's eyes and labelling them. I'm afraid...very afraid...

And now I find that I have Cooties! Get out the Quell!!!! Save the children!!! Actually, he's very sweet and an integral part of the Z-listers. He even went to my webpage and signed my guestbook! *faint* Btw...you hit the nail on the head about that poem. And the duality was intended. I wrote it as a present - one year I didn't have any money for presents, so I wrote everyone poems for Christmas.

I ran across a link to Tech Support Hell courtesy of the Elegant Hack site. As with most Network Engineers...I started off in tech support. I've gotten many of those calls.... *shivers* It was a chilling reminder of what could happen if I don't keep studying - I could end up back in tech support! I got the "I hate your hold music" call... We were doing some streaming audio for one of our customers (in 96-97 it was bleeding edge) and the president somehow hooked that into our phone system for the music during the "on hold" time. It was also the office music. The techs didn't know all that - so one night we changed the station on the radio....and ended up broadcasting the wrong station on the Internet... (got in just a little trouble for that one) I've also had to deal with the screamers - geez...this is tech support - the complaint section is in ADMIN...we're TECHNICAL... Let them go kiss your customer-is-always-right ass. One time one of our customers came to the office to complain - and started a fist fight! A few of the guys had to pull the Network Admin off the jerk. *giggle* I didn't know it was such a dangerous job. Jeez...I can't wait to work at another ISP...

You know I even had enough time to visit my most favorite time sink => usr/bin/girl! I love the links she posts. I go there and start playing with all the flash sites...an hour goes by...click, click - make the skeleton dance....another hour goes by.... Anyway, here's a link from her site to YES...ANOTHER ONLINE TEST! This one is the ebore test.

Oh...and I almost forgot. While I was gone (not blogging) - I chased down a spammer and a mail relay site for Tracy. She got spammed with a link to ...well, you can read about that in her blog. I mention it because I want to let others know how to track these things down too.

She uses Outlook - so the first thing I had to do was look at the full header of the email. To do this in Outlook:

Double click the email in the preview pane to "open" it. You should now have just that email in front of you (most people click the header and read the mail in the preview pane). You have to "open" the message (not the link INSIDE the message, but the message itself) to get to the menu you want. [Double clicking the message "opens" it.]

Then click on View | Options. This will open a smaller grey window with the Message Options. At the bottom you will see the Internet Headers. This shows you (in reverse order) all the mail servers the message went through to get to you. These are the "full headers" that you need to track the path this email took to get to you. Copy the entire header and paste it into Notepad. When you write your nastygram to all the admins, make sure you send them the info in this header. It might look confusing, but it's pretty simple to "decode"... and this will "prove" where the letter came from...

Return-Path: This is not necessarily a valid email addy or the address that the spam came from... The value shown here is whatever the person put in their email client settings as a return address. When you hit the "Reply" button, this is the address that gets put in the TO part of the header. Some spammers put a bogus (or stolen) address here. They don't want reply mail.

Received: There may be a number of these in the header. If there are, the spammer is using other email servers to relay the message. Each one of these will tell the mail servers [server.domain.com] and their IP addresses [12.23.102.56]. The format is FROM -> TO. You should see the backward trail of the message. Don't worry about the first part of the address (some of them may be very long - mail008.mail.bellsouth.net). Just look at the domain.com or domain.net part of the address. Then open a browser and go to www.domain.com or www.domain.net for each of the domains. For most of them, you'll see the homepage of the ISP - look for a Terms of Service link...usually it tells you the address for sending spam complaints. [Make a list of these addresses - and send one mail to all of them.] The intermediate "Received" addresses are probably mail servers being used as a "relay" for spam. They need to know this so they can fix the configuration of their server - it helps them, it helps you, and it lessens the tools of the spammers. The IP address of the user (and possibly the computer name) may be included in this mess along with the IP address of the person's ISP and their mail server. Make sure you get all the lines in the header...

X-Abuse: This would be a place to also send a complaint. You'll sometimes see X-Something in the headers. They are called "X headers" and can be optionally added by the mail server admin (if they know what they're doing) so that if one of their customers abuses their server, they can be alerted.

From: This is only the address that the person put in their email client. Again, it may or may not be a valid email address.

Since Tracy's email included a link... I traced the path to that web site. Click Start | Run and type cmd in the box. This gives you a command prompt. Type tracert www.pornsite.com and press enter (use the address in the link instead of "www.pornsite.com"). This will show you all the hops (routers usually) used to get from your computer to the site. The first few are just your computer, your ISP and its path to the Internet. Look at the last few hops. It will tell you the web site's IP address and ITS connection to the Internet. Sometimes you'll get the full name of the router/switch/server etc... sometimes you'll just get an IP address.

You can get more information on who owns and administers the domain from a WHOIS query from Network Solutions. Please read the FAQ so you know how to use the query and get results. Sometimes it's just easier to put www in front of the domain name in a browser and get the homepage. For those that want to use a graphical interface, I highly recommend NeoTrace. They have a 30 day trial download and the price is reasonable if you want to keep it. It's very easy to use - just put the web address or IP address in the box and hit enter or trace...and it shows you all the hops and any available information on the registrant for that domain.

Once you get a list of addresses to send the complaint to, you have to draft your complaint letter. Yes, most of these addresses will be in the form of abuse@domain.com. Please remember that you are writing to the ADMIN ... not the person that spammed you, and not the person that created that awful site. You always get a lot more accomplished with a little respect and civility than you will if you blast an innocent person. All the admins I know hate spam too. They're on your side. All you have to do is provide them with the information and they will take care of it (if they know how). And please make sure you give them enough info to be able to act on it. A vague complaint without the headers can only be "fixed" by tossing it in the ~~bitch~~ bit bucket. Help them to help you.

Forward the original letter that you received. At the top of the email - write your complaint about the spam/disturbing site. Then tell them that "here is the full header of this email" and copy and paste the header you saved in Notepad. Thank them in advance for their help and assistance. Send the email.

If you get a nastygram back...or a snide remark...or excuses... There is another place you can send the email. It's called the RBL (Realtime Blackhole List). This is yet another reason why the admins are on your side. No one wants their domain blocked - then their users can't send email. Believe it or not, even email marketing firms want to send _only_ to those who *want* to hear their message. Bandwidth costs. (This is how opt-in and double opt-in lists came about...) And innocent but ignorant admins don't want their servers used as a relay. Sometimes they just don't know *how* to protect their servers.

To Report Spammers to RBL. The site has a LOT of information on spammers and what to do about them. There is also a site for Mail Relays where you can find out more about what a mail relay is...check on a mail server to see if it's listed as a relay... and submit a complaint about spam that has gotten to you through an open relay mail server.

See - it's not magic and it's not superhero strength. It's just knowledge. Knowledge is power. Now you're powerful too. ;)

Posted by BlueWolf on November 28, 2001 04:25 PM