How to fight Newsgroup SPAM
Date: Wednesday, November 05, 2003 11:29 AM
**-- AN UNOFFICIAL MINI-FAQ --**
PREFACE:
-------
Given the proliferation of SPAM (off-topic postings) to I decided to put
together an unofficial mini-FAQ to give the average user some help with how
to fight it. Its everyone's responsibility to do something
about this problem. Since is not moderated we, as an on-line community
must take action ourselves. No one is going to do it for us, and I don't
have the time to play "Net Cop" either, though I have successfully had
numerous internet accounts terminated to date for violation of newsgroup
spamming as have other users here.
WHY ?
-------------
The bulk posting programs being used by junk mail advertisers do not even
know where they are posting. A database of newsgroups is used to send out
the off-topic advertisements in an automated fashion. Human interaction is
almost devoid save for the set up to get such programs to run. In some
cases a predefined database of "apparent" sexually oriented newsgroups is
used by such programs. In such cases the programs key on words or text
strings such as "alt", "sex", and unfortunately for us, "nude". The
vast majority of posting programs do so indiscriminately.
Spamming by junk mailers was never foreseen when Usenet was set up decades
ago. Many servers are now blocking postings of messages that are "cross
posted" to a number of newsgroups all at once. However this is being done
on a site by site basis with no formal procedure in place. Unfortunately
many bulk posting programs can send one message per newsgroup bypassing such
settings. So until there is a resolution, we have to fight this from the
trenches.
KILL FILES/FILTERS
------------------
As the name implies, a "kill file" is a way of making news postings that
you do not want disappear from view. This does not kill it off the news
server but simply makes it invisible to your news program. This
feature and how it is set up is specific to your news program so no 'how-to'
can be offered here. Some news programs do not have kill features, Such as
AOLs built in reader (older versions of the AOL program - I have no
experience with versions over Ver. 5).
FIGHTING SPAM
-------------
--POSTING NASTY REPLIES--
It may relieve your personal tensions and anger but the odds are that the
return address was a forgery and the e-mail message will either flounder in
cyberspace until it dies a natural death or is bounced back to you.
Postings into the newsgroup itself only cramp the newsgroup and provide no
help what so ever. In fact it exacerbates the situation. These people know
that what they are doing is wrong so by forging their return e-mail address
they avoid your ire or that of other complainers from over 60 thousand
newsgroups.
--COMPLAINING--
This is what we need to do -all of us- but it must be done in a specific and
orchestrated way otherwise all you get is a nice form letter back telling
you what you did was not right and, hopefully, how to do it
right. That's not always the case.
--ANONYMOUS REMAILERS--
Forget it. These systems were set up to protect the identity of "whistle
blowers" or those who otherwise needed the safety of anonimity. They were
set up for people such as victims of personal abuse or harm to share or get
helpful information, or for certain instances of concern for the public
welfare. There are those who abuse these systems for advancing a personal
agenda. Unfortunately for us there is no way for such messages to be
stopped. Usenet Administration is however looking into abuse of these
systems including abuse of them in and is considering numerous policy
changes.
--KNOWING WHAT TO USE AND DO--
The only way that a systems administrator, in this case a news administrator
or abuse administrator, can take action is if you send them the complete
news posting "header". That's all of the computer-ese
stuff at the top (occasionally at the bottom in some programs) of each
message that shows where it came from. With this information in hand a
systems administrator can, within the local system, identify the abuser and
take appropriate actions. Your news reading program may or may not display
the news headers for you or there may be settings that prevent it from
displaying. Check your news program to see if it will allow you to see the
full headers.
The following is a sample "header" I pulled from on March 16,
1998 which will be used as an example. Definitions follow below.
School is now in session.
================================================
Path: newsflash!news-feed1.tiac.net!newsfeed.internetmci.com!
209.89.75.15!News.Toronto.iSTAR.net!News.Vancouver .i
STAR.net!news.istar.net!discovery.intergate.bc.ca! not-for-mail
From: Skymass
Newsgroups:
Subject: $1000 TO THE WINNER!
Date: Mon, 16 Mar 1998 23:17:34 -0800
Organization: Internet Gateway Corporation
Lines: 56
Message-ID:
NNTP-Posting-Host: pm43s11.intergate.bc.ca
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="------------6A7910B49608FA290C409FDE"
X-Trace: discovery.intergate.bc.ca 890117970 10864 (None)
207.194.175.82
X-Complaints-To:
X-Mailer: Mozilla 4.04 [en] (Win95; I)
Xref: newsflash :70909
--------------6A7910B49608FA290C409FDE
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
-----message begins here----
================================================
PATH:
This is sometimes referred to as the "bang list". This is a last-to-first
history of how the message got to you with an exclamation point "!"
separating the machines the message flowed through to get to you. Your
news server machine is the first in the list and the last one is, or should
be the machine from which the spam posting came from. Look for the last
"domain name" in the list and you are likely to discover where the message
came from. In the example above this message came from the machine
"discovery.intergate.bc.ca!not-for-mail"
The "not-for-mail" designation means its a newsgroup posting. The machine
it came from was called "discovery.intergate.bc.ca". "Discovery" is the
actual machine that the news posting came through and
"intergate.bc.ca" is the domain name. NOW WE HAVE IT! It came from
"intergate.bc.ca"
You may note that in this example the last letters are not the customary
".com", ".edu", or ".org" seen in many domain names. In this case "ca"
designates it as a Canadian domain. Other countries have other
letters in this location.
FROM:
This line is usually a forgery in spam postings, but in this example it
appears that it may be a legitimate return address at this domain. Keep
this handy if it looks real.
NEWSGROUPS:
The newsgroups this message was posted to. This may show one newsgroup or
a whole list of multiple groups where it was cross posted.
SUBJECT:
Well that says it all.
DATE:
The date it was dispatched.
ORGANIZATION:
Often forged but in this case the domain found in the header seems to match
so we may have a clean address to send a complaint.
MESSAGE-ID:
This is a most important line as this is the key to the system administrator
being able to locate who sent what.
NNTP-POSTING-HOST:
This line shows in many headers and is missing from others. This also
identifies the machine through which the message was posted. In this
example the domains match as "intergate.bc.ca". If they don't match make
note of this domain as well as you may have two domains to send a complaint
to.
X-COMPLAINTS-TO:
This line may not exist in all news headers. The "X" indicates its a
non-standard line. If there is a "complaints" address make note of that as
well.
------------The rest need not be reviewed-------------
IT'S STILL DIFFICULT TO UNDERSTAND:
---------------------------------
For those with Windows (PC) based news readers I am told there is Free
Spam-Hater software which automates the search of the bang-list, emailing
the postmaster, etc. at the following URL:
http://www.compulink.co.uk/~net-serv...spam_hater.htm I have not
personally tested this but it came with some recommendation.
WHAT YOU DO:
-----------
Take the entire spam message with __full header__ and __complete text__ of
the message and either forward it by e-mail using your program's FORWARD
feature (if you have one) or paste the whole message into a new e-mail
message.
In the "TO" field you will address this to the domain from which the message
originated. You cannot just send mail to a domain name and must have a
valid recipient name. The person to complain-to varies on each system and
may have to be sent to "Postmaster", "News", or "Abuse" at the domain. The
recipient "Postmaster" is a default that all systems are supposed to
maintain so that is a good start. So to review, your message is being sent
to one or all of the following:
If there is a specific Abuse address specified in the header, use that.
In the TITLE/SUBJECT of the message insert "NEWS ABUSE COMPLAINT". This
will flag the message so that it can be routed to the proper administrator
for handling.
Note that in reviewing the header content you think that you have found
two domains, such as when the last domain in the bang list and NNTP
posting host do not agree. Send it to both locations.
Above the copied text in the message area insert/paste the following text
or compose your own message along the same lines. Again place this _above_
the message you are complaining about, right above the full header and
separate it with a couple of blank lines.
---Attention News Abuse Administrator---
This is a newsgroup abuse complaint. This posting appears to have
originated from your domain. It is off topic or off charter.
The newsgroup "" is chartered as a text-only discussion
group for the topic of social nudism/naturism. Binary files are
not allowed. is not a sexually-oriented news group.
This is being brought to your attention for appropriate handling.
Thank You.
If the abusing party has posted more than one spam message make sure that
you send copies of all of them - not just one. The abuse administrator
needs to see a pattern of abuse. Yes, that could be a lot of work, but no
one said this was going to be easy.
FORGED RETURN ADDRESSES:
------------------------
This is a common problem as noted. The spammers know that what they are
doing is wrong and a reason for their internet accounts to be terminated.
If it was not, there would be no reason for them to forge their return
address, right?
If you get lucky and it appears that a person posting an off-topic message
has a valid return e-mail address you may want to *nicely* explain to them
via e-mail that their posting is off topic in and ask *nicely* to not post
such there again. You'd be surprised at the number of people who want to
do the right thing but who have otherwise been misled that this type of
advertising spam is OK. Some people will comply and apologize.
When its obvious that the return address is a forgery your only hope is the
abuse administrator.
SPAM PATTERNS
-------------
You may often see multiple forged return addresses on spam but find that
they all come from the same domain. In such a case you may want to indicate
in your leading message to the abuse administrator that there are "xx" or
"multiple" messages of the same type in the newsgroup. That will save you
some work, but again sending several copies of problem posts is important
to establish with the administrator the pattern of abuse.
A WORD ON VIRTUAL DOMAINS
-------------------------
A "virtual domain" is a domain name that is hosted on a guest machine. Such
a machine may actually be running several domain names for various clients.
This is a common practice with internet services. When the last domain
name in the bang list and the NNTP host do not match this is a likely
arrangement. Send the complaints to both.
IP ADDRESSES:
-------------
On occasion you may see an Internet Presence (IP) address instead of a
domain name in the bang list or NNTP posting lines. It is a series of
numbers separated by periods such as "222.333.44.5". Simply treat
this as a domain name.
THE COMPLAINT BOUNCED BACK AT ME:
--------------------------------
All ventures have a risk. Some of your complaint messages have a
possibility of bouncing back at you, especially of you sent to multiple
complaint default addresses such as "abuse", "news", "admin", or
"postmaster". At least one of these should work with "Postmaster" being a
customary default. Foreign systems that are set up as spam profit makers
will likely not respond or bounce mail.
I GOT A STOCK REPLY:
--------------------
Some abuse complaints sent to systems get an automated reply. AOL and other
services are known to do this. All this means is that your complaint has
been received (probably along with thousands of others)
and that its in the queue for handling.
SPAM KILLERS AT THE SOURCE
---------------------------
Some news systems are employing global spam filters in attempts to stop as
much spam as possible but these are not absolute. There will always be
something getting through.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
This mini-FAQ is an unofficial attempt to advise people on how to help fight
SPAM in the newsgroup .
It is incomplete. Various areas are subject to change.
The objective is to offer the average user a method for helping to reduce
off-topic postings to the newsgroup. If we all take some time to do this
we may eventually get a reputation as a "hands off" newsgroup from the
spammers.
For more information on fighting spam use your web browser and favorite
search engine and use keywords "fight spam" in the search field.
--
--
Christopher A. Young
Learn More about Jesus
www.lds.org
www.mormons.com
How to fight Newsgroup SPAM
Similar Threads
Linear Mode
