SPAM Information

Also known as Unsolicited Commercial E-mail (UCE), Spam is a common problem from which no one, including our University e-mail systems, is immune. Unfortunately, much of the junk e-mail we receive has fake (spoofed) return addresses. Although our Computer and Network Usage Policy prohibits using MSMC's e-mail systems for sending junk e-mail, it is not possible for us to police individuals or companies outside our University.

Many spammers take advantage of poorly configured mail servers, and free e-mail accounts to hop around the Internet.  They can also forge almost all of the information in an email (address, IP, etc.) and they may not reside in the US so it might even be legal if they could be found.  It is important for reasons explained below to understand that “headers”  (they tell the route that the email took to get to you) are usually the one exception to the forging ( “spoofing”) problem. Many e-mail clients hide them to prevent clutter.

There are many ways spammers can get valid e-mail addresses. This list shows only a few of the most common ways a spammer may get your address:

• They buy your name from a list: Junk mail and targeted e-mail lists have been around almost as long as the Internet itself. For as cheap as $100, anyone can buy a list of over 11 million addresses. These lists are created by unscrupulous website owners and online stores that “share” their customer information for some money. As you can imagine, it is impossible for spammers to identify your personal taste or interests when sending messages to such a large group, so a “shotgun” mailing is sent out with product offers, get rich quick schemes, adult porn sites, and Korean & Chinese mailings. The worst part about this? They are sent out to all 11 million names, including you!
• Opt-in Lists: These lists are developed by partnering with legitimate websites which make you check “Don’t send me offers” as part of registration for their services. Sooner or later one of the boxes will escape your attention, and then you’re added to an opt-in list. Many opt-in lists are legitimate and will honor your removal requests, but for every one legitimate list, there are three that are not, and it only takes being on one or two opt-in lists to eventually generate a mountain of spam in your inbox.
• E-mail Extractors: Spammers use these programs to scour the web including forums, alumni sites, and news posts, for e-mail addresses. These software bots can harvest  thousands of e-mail addresses an hour, and spammers run them day and night. To avoid having your address harvested in this way, don't put your main e-mail address on any website, forum, or newsgroup. Use a separate address that you don't mind getting spam to.
• MX Server Extractors: These programs exploit Internet mail server protocols. When an e-mail is sent to you it is handed over to your Mail Provider’s server, which starts “communication” with the sender. The sender’s server asks to deliver a message to a user on your server, but before the message is actually accepted by your server it wants to know who it the mail is addressed to. So your address is sent over, and your server replies whether the name is OK, or the address does not exist on the server (what happens when a message is “bounced” back to you). Basically the MX server extractors mimic the communication without actually trying to send the message. Think of it as someone ringing your doorbell and asking if “Joe” is home, no one named Joe may live at your house, however if the person at your door tries enough names sooner or later the may stumble upon yours, and you will say “Yes”. Programs exist that can mine over 5000 e-mail addresses per minute, and believe it or not those programs can be purchased by unscrupulous spammers for less than $100.
• Viruses, Spyware, and Malicous Code: Not to long ago viruses and spyware started to appear that transparently load themselves on your computer or are sent via e-mail to your mail client. As soon as you open books, contact lists, and distribution lists, they are scanned and then reported back to home base. Viruses such as Klez, Sobig, and Mimail can make any PC a Spam-generating machine.

What are some tips to avoid Spam?

• Never respond to Spam.  Responding to Spam in any way, even trying to "unsubscribe" or "remove me" by following the removal instructions in the Spam will only validate your email address to the spammers, and you will GET MORE SPAM.   Just delete the email.
• Watch out for those CHECKBOXES!  Whenever you sign up for something on the web, there is often some innocent looking text at the end of the form saying something like, "Yes, I'd like to be contacted by  select third parties regarding products I might be interested in."  Look closely -- the checkbox next to that text is already checked and your email address will be given to those who don't know you.
• If you are a frequent visitor to chat rooms, use a screen name that's not associated with your email address.
• Use a unique email address, containing both letters and numbers.  Your choice of email address may affect the amount of  Spam you receive because spammers use "dictionary attacks" to email as many possible name combinations at large Internet Service Providers (ISP), hoping to find a valid email address.
• Avoid displaying your email address in public places, including newsgroup postings, chat rooms, websites, or in any online service membership directory.
• Check the website's Privacy Policy before submitting your email address.  Make sure the website doesn't share or sell your email address.  If possible, you should "opt-out" of such plans.
• Set up an e-mail account with Yahoo or one of the other free email providers and use the free e-mail address whenever a site or software installation requests that you enter an e-mail address. If your information is subsequently shared with spammers, your junk account will collect the spam instead of your e-mail account at MSMC.

How can I tell where the Spam actually originated?

Knowing how to read Internet Messages Headers will help you determine where the Spam originated.  Remember, sometimes a backdoor Trojan can enter a PC and make it a Spam-producing machine without the owner even knowing it.  Having said this, the instructions to read message headers depend on your email client software.  SpamAbuse.org has instructions for some of the most popular programs.  Click Here: http://www.spamabuse.org/

Note: Send the header information as text pasted into your e-mail - not as an attachment.

Is there anything I can do if I continue to receive Spam?

Create filters for your email account using MSMC's email client software (Groupwise). CLICK HERE FOR INFORMATION The message rules can automatically delete the mail, or move it to a separate mail folder. Filtering the mail is particularly helpful if you are unlucky enough to receive offensive Spam.

If you are motivated enough, you can report the Spam. There are several options available, depending on the originating source of the e-mail. In all cases, you will need to decipher the full header text of  the e-mail to identify the source. Also, a copy of the full header and  text of the e-mail must be sent with the complaint. (Note: Forwarded e-mail does not include full header text).  As stated above, you can visit  http://spamcop.net/fom-serve/cache/19.html for instructions on displaying full header text. Also include correspondence regarding your spam complaint.

Methods to report:

Report spam originating from outside the University to the Federal Trade Commission at uce@ftc.gov, or spamcop.net, or to the spammer's Internet Service Provider (ISP). Because the ISP can be forged, it can
be tricky to find and notify the correct ISP. A good resource on how to  do this is at http://spam.abuse.net/  Do not expect a personal reply from the ISP, since the ISP may receive numerous complaints just like yours.

Delete the message. Think of it in the same context as throwing away the junk mail you receive at home every night.

To Learn More About Spam

http://www1.ifccfbi.gov/index.asp - Internet Fraud Complaint Center - For e-mail involving fraud only

http://spam.abuse.net/spam/ - Fight Spam on the Internet - From spam.abuse.net

http://www.cauce.org/about/resources.shtml - Coalition Against Unsolicited Commercial E-mail