Top Ten Tricks of the Spammer

Top Ten Tricks of the Spammer

The spammer's most fervent hope is that you are ignorant of the tricks and tactics used to spam your inbox. Learning the spammer's nefarious ways is your best protection against spam.

Manipulating Text:

This is one of the most commonly used spamming techniques. Spammers will manipulate the text in the email, to foil the anti-spam filters. They may, for example, deliberately misspell some words: "M0rtg4ge" for example. They may add characters or spaces to words in the email header, to make the email seem unique from other email. Like this: X_A_N_A_X Here's an example, . They may also insert random strings of text within the email.

Chain Letters:

Spammers may send out chain letter instructing you to forward the email to your friends and family. To entice you to do so, it may claim that forwarding it will bring good luck. This spam may carry viruses or a Trojan horse, which is sent along to anyone you forward the email to.

Image-based Spam:

The spammer sends out spam that contains an image in GIF format. This image bears the spammy message. Image-based spam is effective in by-passing spam filters because they are generally text-based.

Dictionary attacks:

This is a technique used by the spammers to find email addresses that they can spam. It involves trying random combinations of common names and words, and using these to making up email addresses, e.g. JaneDoe@YourISP.com, JDoe@YourISP.com, JaneDoe1@YourISP.com. The spammer will then send out junk email to the different variations of these addresses in the hope that some of it will go through,

Spammers tend to direct the dictionary attacks at the large email companies, which have a large number of customers. 

Email spoofing:

Email spoofing involves the use of a fake email header that is written to make it look like someone other than the spammer sent the email. Very often, the spammer will make it look like the email came from a credible source such as your bank or yahoo, and try to get you to reply with personal information such as a password, social security number or credit card number. This technique is widely used because it is easy to do, and tends to catch the recipients off guard.

JavaScript:

The spammer can use Javascript that will ensure that the spam is only visible when the email is loaded. This type of spam can only be prevented using anti-spam software that decodes or blocks the java script.

Social engineering:

This spammer ploy attempts to fool the recipient into reading the junk email by pretending to be an acquaintance. It involves a junk email that has a "personal" subject line, such as "I'm leaving tomorrow," "I got your message" or "Let's meet again".

Mining message boards and chat rooms:

When you post a message to a message board or chat room and leave your email address, automated programs called spambots will find your address and add it to the spammer's mailing list. Much like a listed phone number in the telephone directory, leaving your email at these types of websites makes it public information.

Web beacons:

A web beacon, also called an "invisible GIF," is an image sent out with spam that is invisible to the recipient. When the email is opened, the spammer will be alerted that your email address is "live."

Open proxy, 3rd-party servers:

An open proxy is a third-party server that enables the spammers to camouflage their real identities as well as their Internet locations, when they send out their junk mail. Many spammers use these open proxy servers to help maintain their anonymity.

The Costs of Spam

The Costs of Spam

The volume of spam that is sent out every minute of the day has reached pandemic proportions. The simple reason for this is because the cost to a spammer ranges from zero to negligible. In fact, anyone with a list of email addresses and Internet access can spam thousands, even millions of people with a single click of the mouse. The cost of spam, however, now runs in the millions.

Bandwidth

Spam takes up valuable Internet bandwidth that would otherwise be used for legitimate business and personal use. Bandwidth refers to rate at which data is transmitted; it is the amount of data that can be transmitted within a fixed amount of time. The lower the bandwidth, the slower the transmission.

When spam uses up valuable bandwidth, and clogs up the system, it causes costly delays in the transmission of important, legitimate information. It forces the Internet Service Providers (ISPs) to increase bandwidth just to handle the increased volume. This costs money, and this cost is passed on to the consumer.

Viruses, Worms and Malware

It is becoming an increasingly common menace. Spammers will attach viruses to the email they send out for purely criminal or malicious purposes. Some viruses, for example, are programmed to self-install and give the spammer access to all the vital information stored on your computer. This information is often be used for identity theft purposes.

Other viruses simply do great harm to computers the world over. A Consuner Reports  study estimates that the cost of repairs and replacement parts for damage done to computer systems by viruses was over 8 billion over the past two years. This does ot take into account the billions spent on anti-spam and anti-virus software.

Productivity

Spam is not only annoying, it also takes up valuable time just to go through it and figure out sort out the spam from the valid mail. For businesses that receives hundreds of emails a day, the cost in time and productivity really adds up.
The "cost of spam calculator" that is available at cmsconnect.com estimates  the that spam costs almost $1000 per employee each year, with over 50 hours of lost productivity for each one.

Lost Messages and Data

As we try to battle the spammers by installing spam filters and blockers, these programs often weed out legitimate businesss correspondence. Lost correspondence from a client or supplier can easily cost businesses money, clients and goodwill

Identity Theft

The phenomenon of phishing has become more prevalent as spammers think up new ways to make a buck at your expense. Phishing involves the use of email that is designed to look like a legitimate company has sent it. It is sent out to millions of people in the hope of scamming them into revealing personal information that the scammer can use for identity theft. The cost of Phishing and identity theft to their victims now also runs in the billions.

The cost of spam is a financial drain on the economy. We pay a high price for the spammer to scam his victims. The spammer pays nothing.

How to Report Spam Abuse

How to Report Spam Abuse

Spam is as prolific as the leaves on the trees and because there are so many kinds of it, it is a challenge to find the right site or organization to report spam to.
Each type of spam will violate the law in one way or another and each can be prosecuted if it can be proven.

Saving and sending the entire email header is an important step in reporting spam. The header of every email you receive will contain information on the full chain of computers through which the email passed in order to get to you. Generally, most email will pass through at least four computers: The spammer's computer, the spammer's ISP, your ISP and finally your computer. This is the most reliable way for an anti-spam service to track down the spammer's ISP because the spammer will camouflage the "from" address.

As the email passes through each computer, information is added to the header indicating who the mail came from, as well as where they are sending it. While this header information will seem complicated, you just need to make note of the originating ISP, which will be easy to recognize. For example, if you receive your mail through AOL and you note "yahoo" in the string of information, then you will know to report the spam to yahoo.

To read the information in the email header, just right click on the email, choose properties and then either "options" or "header" depending on your email program. Then cut and paste the header path in its entirety, into the body of the email. Finally, forward the spam email first, to the spammer's ISP, and then next to spam reporting agencies

You should also forward the spam to the Federal Trade Commission (FTC). You can do this at the website: uce@ftc.gov. While the FTC will not take action on individual incidents, they will add the spam to a database reffered to as UCE (unsolicited commercial email)

A common spam scam you may come across is called a "419 Scam", or the Nigerian Advance Fee Fraud. These spam emails generally relates a tale of woe - a death in the family and a huge inheritance that the sender needs your (financial) help to claim. As improbable as it sounds, many people have fallen for this scam and millions of dollars have been defrauded from them. Fax a copy of this spam along with the header information to the United States Secret Service.

Here is a list of the agencies you may report spam to, along with the type of email they can handle or will deal with.

The Federal Trade Commission (FTC).
www.ftc.gov/bcp/conline/edcams/spam/ - This site offers you information about the law enforcement actions that have been taken against deceptive mailers and companies and those who do not honor opt-out requests from email recipients..

www.spamabuse.org
This is a third party reporting agency.

www.spamcop.net
Another third party agency which will report spam on your behalf to the relevant anti-spam agency.

For stock fraud, email the Securities and Exchange Commission (SEC) at enforcement@sec.gov . They are prosecuting however they are only able to deal with fraud in email that has to do with stocks and bonds.

How Spammers Get Your Email Address

How Spammers Get Your Email Address

Each minute of each day, there are literally thousands upon thousands of spam email messages flooding in boxes the world over. Some of that email even goes out from what appears to be your very own email address! Where on earth do spammers get your email address? There are various ways - some are legitimate, and most are not.
Typically, spammers will "harvest" email addresses from legitimate web sites, such as USENET groups, chat rooms, message boards, AOL profile pages and special interest group postings. These are sites you have visited and requested more information from, or corporate sites where you may have placed an order.

The spammers collect these addresses using automated programs called spam bots. Spam bots are designed to harvest the email addresses from these web sites. They scan every page on the site, collecting any text containing the symbol "@" they find. The email addresses they collect are compiled into a database, loaded into a bulk-emailing program and out goes the spam. Often, these harvested email addresses are also sold to other spammers ; once you email address makes it to a spammer's mailing list, it will make it onto their fellow spammer's lists.

Some websites require you to register before you can place an order or access certain parts of the site. Not all these websites will be as protective of your email address as you may wish. Newsgroups are particularly notorious for exposing their users' email addresses to the spam gatherers. Most newsgroups do not take a great deal of care to hide the email of their users, and each and every email member email address is exposed and up for grabs by spammers. Some of the websites that ask you to register may also sell to spammers.

Another method commonly used by the spammers is to target a domain. They simply guess or make up every possible variation of email address based on the domain name, for example @yourDomain.com . They create a mailing list of these addresses and then spam them. Corporate emails are especially vulnerable, as their emails have a distinct format such as @BusinessName.com.

While most of the spam will bounce, it really does not bother the spammers because they can and do send out millions of this type of junk mail a day. A small proportion of the emails will actually be legitimate and will receive the spam - that is good enough for the spammer. This method of gathering email addresses is called a brute force spam attack.

One way to defend against this is to make it more difficult for the spider to harvest your email. When you place your email address on a web site, remove the @ symbol and replace it with the word "at." This makes it far more difficult for the spam harvester to gather your address, because it cannot be gathered mechanically; it can only by read by a human who is actually reading the site. Alternatively, you should display your email address as an image rather than as text.