Subject: Re: Last Call: Anti-Spam Requirements on an SMTP MTA to BCP

From: Gunnar Lindberg <[email-masked]>
Date: Wed, 4 Mar 1998 13:50:19 +0100 (MET)

>Date: Wed, 4 Mar 1998 11:23:41 +0100
>From: Jacob Palme <[email-masked]>

>We started implementing anti-spam features which check the
>correctness of the domains of senders of incoming messages a few
>weeks ago. This did reduce the amount of spamming temporarily, but it
>is growing again, obviously the spammers have found ways to work
>around such measures. I believe these kind of anti-spam features are
>tools for MTA-owners who do not want their MTAs misused, but they are
>not, except for a short time, much help for end users who want to
>avoid spams.

If a spammer says "MAIL From: <[email-masked]>", i.e. using
an existing domain name to get around the From sanity checks, it is
quite likely the the Legal Dept. of Home.Example will sue him for
giving them bad reputation etc (I'm sure US lawyers can and will).

Therefore, just the knowledge that these tests exist and are in use
may/will force spammers to make mistakes and may get them to court.

And, you get a sanity check of the address your ordinary user puts
into his/her mail UA just for free - less confusion, less lost mail.

But, this area seems extremely hard to resolve - is there any IETF
method to handle "strong opinions"? Not just by humming I guess?

	Gunnar

---

From: Sascha Ignjatovic <[email-masked]>
Date: Wed, 4 Mar 1998 14:16:59 +0100 (MET)

> giving them bad reputation etc (I'm sure US lawyers can and will).

thats the point  the spamers are using domains from big companys 
like  @worldnet.att.net  or @mci.com etc to fake their identity/origine
and they also give a contact and phone nummber becouse they want to sell
something

IT MUSST BE ABLLE FOR BIG COMPANYS TO SUE SUCH SPAM COMPANYS WHO USES
THEIR DOMAIN NAME-NOT ACUOUNTS  AND TRADEMARKS TO 
 
but the big companys hase some problems with this 

becouse i always forward to the postmaster and abuse teams of the big
companys the spam mails but i continue to receive the spam mails with the 
domains from the same companys - as in the case of worldent.att.net

the will send you a automaitc replay 

"this mail was not generated from the worldent.att.net acount so we can do
nothing but we will continue to improve our systems" or something like
that 

i was engry becouse they always come with the argument "its now originated
from our acounts  so we can do nothing"  and i contiue to receive 

[email-masked]  FROM THE SAME BIG SPAM COMPANY WICH SELLS SPAM
                       EMAIL SENDING SYSTEMS 

this is a strange world :-)

sascha

---

From: Bob Stewart <[email-masked]>
Date: Wed, 04 Mar 1998 08:52:05 -0500

>THEIR DOMAIN NAME-NOT ACUOUNTS  AND TRADEMARKS TO 

There was a recent case in Texas (I believe) where a small-time spammer
caused significant trouble for an ISP and a small company by using that
company's domain name as a fake return address.

The court found in favor of the small company that the spammer had damaged
them and misappropriated their resources.

The spammers can be slammed legally if the companies being abused will just
do it.

	Bob

---

From: Sascha Ignjatovic <[email-masked]>
Date: Wed, 4 Mar 1998 15:26:19 +0100 (MET)

> The spammers can be slammed legally if the companies being abused will just

YES and the rest would be easy  

you could than use the mechainsms decsribed in previous mails 
wich rejects fantasie domains :-)

> 	Bob

thanks bob
sascha
ps.the bigest problems spamers hase is that they have to releave their
   indentity some how  earlier or latter :-)

---

From: "Jonathan Clark" <[email-masked]>
Date: Thu, 5 Mar 1998 00:46:23 -0500

On Mar 4, 14:16, Sascha Ignjatovic wrote:

	becouse i always forward to the postmaster and abuse teams of the big
	companys the spam mails but i continue to receive the spam mails with
	the domains from the same companys - as in the case of worldent.att.net
	the will send you a automaitc replay 

	"this mail was not generated from the worldent.att.net acount so we can
	do nothing but we will continue to improve our systems" or something
	like that 

I think perhaps Sascha has AT&T Worldnet confused with someone else -
possibly another large US-based ISP. Unless someone has rewritten it quite
recently our auto response from [email-masked] doesn't say anything
like this. It says:

	Thank you for your report to the WorldNet abuse desk.

	We are not able to respond personally to each message
	received, but wish to assure you that we investigate
	each and every abuse report we receive, and will take the
	appropriate action.

Sascha goes on to say:

AT&T is a big company and I don't know everything we sell, but I can state
with authority that if AT&T is selling a spam mailing system then AT&T
Worldnet is *not* using it. And as far as I am aware AT&T Worldnet has not
been accused with any evidence of spamming the Internet. Plenty of our users
have been, and when we identify them, we take appropriate action.

For over a year now I have had requests out on various anti-spam lists,
and I make the same offer in this forum, that if anyone receives mail with
forged headers which appear to implicate AT&T Worldnet for them to please
send it to me, or to our abuse desk. To date I have received exactly two
examples. So I don't know whose headers are being forged, but I have no
evidence that it's ours.

Also please note that it is a violation of AT&T Worldnet's AUP to use a
mailbox on our service as a response address for a spam, even if the mailing
did not originate with us.

Sascha (or anyone else), if you feel you have a genuine complaint, please
feel free to contact me directly. However, routine abuse matters should
go directly to [email-masked], since all I'll do is send them there anyway.

Jonathan

---

From: Sascha Ignjatovic <[email-masked]>
Date: Thu, 5 Mar 1998 14:04:45 +0100 (MET)

Jonathan

mr.jonathan

true my bad english and pasionate nature-only when i am thinking i am
right and other side dont understand me and continue to missundersandme:-)

i am very sory for beeing again missunderstud 

i am not acusing at&t of having anything to do with spaming or other us
isp i just repeate my CALL FOR YOUR UNDERSTANDING

THE POINT IS FOLOWS  
ATACHED YOU WILL FIND A MAIL WICH I GOT JUST RIGHT TODAY AND IS THE SAME 
SPAMER -AND HOPEFULY THE ONLY FROM WICH I CONTINUE TO RECEIVE THE SAME
SPAM MAIL AGAIN AND AGAIN AND AGAIN -HE SELLS HIS SPAM MAIL SYSTEMS 

AT THE MOMENT THERE IS FAKE ADRESS IN ITS HEADERS FROM NETCOM.COM 
BUT MANY TIMES IS WAS THE ADRESS FROM WORLDNET.ATT.NET AND OTHER ISP AND 
NETWORK PROVIDERS  IN USA 

BECOUSE ATT IS SO WELL KNOWN I HAVE FORWARDED THIS MAIL TO THE POSTMASTER 
AND THAN ALSO TO ATT ABUSE DESK  

I RECIEVE A AUTOMATED REPLY-WICH IS VERY NICE THANK YOU   IN WICH THAY
STATED THAT THE PARTICULAR MAIL WAS NOT ORIGINATED FROM A ATT WORLDNET
ACOUNT  AND THATS IT ..

IN VUEW DAYS AFTER I RECEIVE AGAIN SPAM MAILS  FROM THE SAME COMPANY-SEE
BELOW  AGAIN UNDER WORLDNET.ATT.COM FAKE ADRESS AND ALSO WITH FAKE
ADRESSES  FROM SOME OTHER BIG US COMPANYS 

WHY IN THE WORLD YOUR BIG COMPANYS TOLERATE THAT SOMEBODY IS SENDING 
SPAMING MAILS WITH YOUR DOMAIN NAMES ON IT AND MISSUSING YOUR TRADEMARKS
-WHEN I START TO SELL PHONE SERVICES HIER IN VIENNA UNDER THE LABEL ATT
YOUR LAWYERS WOULD EMDITIATELY SUE ME  !!

BUT IF SOMEBODY IS SENDING SPAM
MAILS WITH THE NAME AND TRADEMARK OF YOUR COMPANY ON THE HEADER OF THE
MAIL YOU JUST SEND A MAIL WHERE YOU STATED  

ITS NOT ORIGINATED ON OUR ACOUNTS 

THATS THE POINT !!

IF BIG COMPANYS ARE NOT ABLLE TO DO ANYTHING AGAINST SPAMERS WHO COULD ???

SORY  THEY ARE USING AGAINA ND AGAIN THE DOMAINS OF BIG COMPANYS AS FROM
AND TO ADRESSES AND YOU CONTINUE TO TELL ME I SHOULD SEND IT TO YOU??

GO TO YOUR POSTMASTER OFFICER AND LET THEM SEARCH FOR MY
MAILS-UNFORTUNATELY I HAVE DELETED IT ALL  AND SEE HOW OFTEN I HAVE WROTE
TO THEM AND IN ALL CASES JUST CONTINUE TO RECEIVE YOUR AUTOMATIC REPLY

WHY NOT BIG COMPANYS SUE THE SPAM COMPANYS WICH IDENTITY IS VERY CLEAR 

WHY YOU LIKE THAT YOUR COMPANYS ARE ASSOCIATED IN SUCH WAYS WITH A 
VERY PRIMITIVIE BEHAVIOUR OF OUR MATERIALISTIC SOCIETYS - SPAMING

SO PLEASE GO TOGETHER WITH SOME OTHER BIG COMPANYS AND DESCIDE 
THAT YOU WILL TAKE ACTION AGAINST SPAMING COMPANYS WHO ARE MISSUSING 
YOUR COMPANYS NAME AND TRADEMARKS 

DO YOU NOW UNDERSTAND IT  ??

COULD YOU FORWARD THIS PLEASE TO THE RIGHT PLACE WITHIN THE ATT ??

IF YES THAN I THANK YOU VERY MUCH 

I HOPE IN THIS WAYS WE WOULD BE ABLLE TO "ORGANIZE" ADVERTIZING ON THE 
INTENET IN A BETTER WAY 

IF NOT PLEASE DONT REPLY TO ME 

I AM NOT INTERESTED  ...

thanks
sascha
ps.i got this atached spam mail all vuew days always with 
   the name of big companys on the header  
   becouse i am shure i am not the only one who gets this mails
   and it musst some how be known to the companys wich domains are 
   abused-if not i hope that they know it now :-)  

   WHY THIS SPAMER IS ABLLE TO CONTINUE TO SEND HIS JUNK 
   
   WHY THE BIG COMPANYS ARE TOLERATING SUCH BEHAVIOUR ??

   IS REALLY A SECRET TO ME !!!

---------- Forwarded message ----------
Date: Thu, 5 Mar 1998 02:39:02 -0500 (EST)
From: 7h66hg4 <[email-masked]>
To: [email-masked]

Authenticated sender is <[email-masked]>
Subject:  with
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

EMAIL MARKETING WORKS!!

Bull's Eye Gold is the PREMIER email address collection tool.
This program allows you to develop TARGETED lists of email
addresses.  Doctors, florists, MLM, biz opp,...you can collect
anything...you are only limited by your imagination!  You can
even collect email addresses for specific states, cities, and
even countries!  All you need is your web browser and this program.
Our software utilizes the latest in search technology called
"spidering". By simply feeding the spider program a starting
website it will collect for hours. The spider will go from website
to targeted website providing you with thousands upon thousands of
fresh TARGETED email addresses. When you are done collecting,  the
spider removes duplicates and saves the email list in a ready to
send format. No longer is it necessary to send millions of ads to
get a handful of responses...SEND LESS...EARN MORE!!!

A terrific aspect of the Bull's Eye software is that there is
no difficult set up involved and no special technical mumbo-jumbo
to learn. All you need to know is how to search for your targeted
market in one of the many search engines and let the spider do the
rest! Not familiar with the search engines? No problem, we provide
you with a list of all the top search engines. Just surf to the
location of a search engine on your browser then search for the
market you wish to reach...it's that easy!

For instance if you were looking for email addresses of Doctors
in New York all you would do is:

1) Do a search using your favorite search engine by typing in
the words doctor(s) and New York
2) Copy the URL (one or more)...that's the stuff after the
http://...  for instance it might look like
http://www.yahoo.com/?doctor(s)/?New+York
3) Press the START button

THAT's IT!!!  The Bull's Eye spider will go to all the websites
that are linked, automatically extracting the email addresses
you want.

The spider is passive too! That means you can let it run all
day or all night while you are working on important things or
just having fun on your computer. There is no need to keep a
constant watch on it, just feed it your target market and give
it praise when it delivers thousands of email addresses at
the end of the day!

Features of the Bull's Eye Software:

* Does TARGETED searches of websites collecting the email
  addresses you want!
* Collects Email addresses by City, State, even specific
  Countries
* Runs Automatically...simply enter the Starting information,
  press The Start Button, and it does the rest
* Filters out duplicates
* Keeps track of URLs already visited
* Can run 24 hours per day, 7 days per week
* Fast and Easy List Management
* Also has built in filtering options...you can put in words
  that it "Must" have while searching,...you can even put in
  criteria that it  "Must NOT Have"...giving you added flexibility
* Also imports email addresses from any kind of files (text
  files, binary files, database files)
* List editor handles Multiple files to work on many lists
  simultaneously
* Has a Black-Book feature... avoid sending emails to people
  who do not want to receive it
* Built-in Mail program...send email directly on the internet
  with just a click of your mouse
* Personalized Emails...if the email address has the user's
  name when it is collected,..you can send Personalized emails!!!
* Sort by Location, Server, User Name, Contact Name
* Advanced Operations:
· Email address lists export in many different formats
  (HTML, Comma delimited, text file)
· Advanced editing...Transfer, Copy,  Addition, Delete, Crop,
  Move to Top/Bottom
· Operations between lists...Union, Subtraction, Comparison
* Program is Passive,...meaning you can run other programs at
  the same time

CALL FOR MORE INFORMATION   213-980-7850
CALL FOR MORE INFORMATION   213-980-7850

ORDERING INFORMATION

Customer Name
Company Name
Address
City
State                       Zip
Phone                                       Fax
Email Address

______ BULL'S EYE SOFTWARE   $259.00
Includes Software, Instructions, Technical Support

______ Shipping & Handling  (2-3 Day Fedex)  $10.00
                           (Fedex Overnite) $20.00

______  TOTAL
                 (CA Residents add applicable sales tax)

*All orders are for Win 95 and Win NT

                *****CREDIT CARDS ACCEPTED*****
                   MASTERCARD   VISA   AMEX

   PLEASE CALL 213-980-7850 to process your order
                        9am-5pm Pacific Time
                Checks or Money Orders send to:
                      WorldTouch Network Inc.
5670 Wilshire Blvd.  Suite 2170 Los Angeles, CA 90036
Please note:  Allow 5 business days for all checks to
clear before order is shipped.

---

From: "Jonathan Clark" <[email-masked]>
Date: Thu, 5 Mar 1998 22:40:25 -0500

[ I'll be happy to take this argument to private Email... ]

I think you have the wrong end of the stick here. I don't think anyone
could make a case that a regular user is claiming any business relationship
with their ISP. If you like, part of the fee that users pay their ISPs
is a licence to use the ISP's name in certain ways, such as in a return
address (OK, guys, this is a stretch, don't pillory me here).

Look at it the other way round - if regular users did *not* use their
ISP's names in this way, everyone would have to register their own
personal domain-names and just use them. And even so there would be
claims that an ISP hosting a particular user is somehow agreeing with
their views and should be treated (or mistreated) accordingly. Telcos
get around this problem by being covered under ``common carrier''
legislation, but to date (as far as I know) no court has ruled that this
legislation covers ISPs, and there are some part of that legislation
which the ISP industry would take a frosty view of (such as tariffs).

As far as I can tell, the spammer in the case you attached is claiming
no business relationship with Netcom except as a regular user. Hence
there would be no grounds for legal action here.

You said previously that you had received this particular spam from an
AT&T Worldnet account, but now it is coming to you from a Netcom account.
If AT&T Worldnet was tolerating this behaviour, why do you think the
perpetrator of this spam moved their account? Do you not consider it
possible that perhaps we did *not* tolerate this behaviour, possibly
because it would be a violation of our Terms and Conditions?

Jonathan

---------- Forwarded message ----------
Date: Thu, 5 Mar 1998 02:39:02 -0500 (EST)
From: 7h66hg4 <[email-masked]>
To: [email-masked]

EMAIL MARKETING WORKS!!

ORDERING INFORMATION

Customer Name
Company Name
Address
City
State                       Zip
Phone                                       Fax
Email Address

______  TOTAL