How to Report Spam

Hide Your Own Email Address

If you decide to fight back on spam and report them make sure they do not have your email address or know that it is you. Many spammers will send you mail bombs, filling your mailbox to overflow with useless trash or they will send out spam, pretending to be you and get your email account shut down.

If you Can't Find Spammers, You Can't Report Spam!

Spammers Hide because once they start getting complaints to their ISPs, they get shut down and have to set up a new account. This costs them time, which costs them money. Here are some of the tricks that spammers use to hide their real contact and thwart complaints.

Decimal IP Addresses Sometimes you'll find email addresses like this: "spammer@123456789"? It's a legitimate IP address that your system will recognize, but it is in decimal form. To get a human-readable IP address, you need to convert it into hexadecimal, divide it into four sets of two digits, then convert each set back into decimal (it is easier than it sounds) The Windows calculator will do base conversions when placed into "scientific" mode. If you don't want to do this yourself, then try the "Convert Decimal to Hex" tool at www.network-tools.com.
Hexadecimal Addresses are starting to be used as well. These start with "0x", and the browser knows what to do with that. Take each pair of characters after the "0x", convert it from hex to decimal, and place a period between each resulting decimal number. This is the IP address.
Escaping There are also legal URL-formatting tricks that effectively obscure information. This includes "escaping", usernames, passwords, and redirection. Escaping encodes the URL with a percent sign followed by a hexadecimal code. An escaped URL can look like "http://%2E%2E%2E%48%20%18%32%2F%48...". You can easily decode this by copying it into the location bar of your browser and hitting return or clicking go. The status area at the bottom will show you the real address usually. Sometimes, it is not safe to go to these addresses ( we recommend NOT going as it could be a tracking link to send you more spam, verifying your email address ). Instead you can manually decode each % using a ASCII translation table or even the scientific mode of the windows calculator.
Usernames and Passwords Usernames and passwords can be passed in a URL. Most people do not do this because it leaves the information in plain sight, which comprimises the account info. Spammers use this technique to confuse you though. Here is how it works: "http://username:password@www.website.com". Here is a long and confusing example: "http://www.website.com:www.spammer.com/@12343523/x.html". They are trying to trick you into not finding the real address. The one that is important is after the "@" sign, and the others are there just to throw you off the trail. The use of a numeric IP address after the "@" sign is supposed to confuse you even more.
Redirection Many search engines like google can track when you click a search result. They then are able to redirect that click and send you to the proper website. They do this so they can tell which websites are the most popular. Some spammers use the inner workings of these search engines to give you cryptic links to click. The search engine names are visible, the real link is protected using the username/password, escaping or hexadecimal techniques and the result is a very confusing and hard to trace link. If you find these, report them to the search engines so they can ban these sites.
Relay Page There are many free hosting services that give you a few pages. Spammers use these to link to their real websites. So if the freebie gets shutdown, they just make another. Examples of this are tripod.com The spammer hopes that complaints go to the free ISP instead of their real business site. You may have to dig into the code of the relay page to find the real business, but it is there.
Encryption It is common for spammers to try and encrypt their entire website or relay page using javascript, making it very difficult to read the source code. One way to defeat this is to use a little bit of programming skill: add adocument.write("<textarea>"); right before the decryption routine, and adocument.write("</textarea>"); right after it. This will dump the html to a copy and paste field that you can copy and paste into notepad for easier viewing ( it is all decrypted ). If you see anywindow.open calls, you can replace those withdocument.write calls. Remove all but the first argument in these calls, and the browser will display the URL instead of opening a separate window to it. Now you can download the page at this exposed URL for inspection.
Security Many spammers try to disable your view source and right click abilities to make your job of finding them that much harder. If you can find the actual URL, you can make a small webpage to download their source code instead of rendering it in a browser ( disabling their protections ). This allows you to inspect the file in a text editor, such as Notepad. If you have an editor that is made specifically for web pages, then it may be able to load a page directly from a URL. If not, then create a little file with the following HTML inside of it:
```
     <html>
     <body>
     <a href="http://place url here">this</a>
     </body>
     </html>
    
```
Place the URL that you want to grab in the appropriate spot in the file. Now, save this file with an ".html" extension, such as "getit.html". You may have to enclose the whole file name in double quotes to prevent Notepad from automatically appending a ".txt" extension. Open the file with your web browser, and you will see a simple link, "this". Right-click on that link, (or click-and-hold on a Mac) and save the target to a file. Now you have captured the web page as a file to look at.
Domain Registries There are many places to register a domain name. Some of these places have very relaxed rules or do not speak the language of the complainer, making it easier for the spammer to get away with their fraud. Because of this reason, you cannot always trust the information in the domain registry to be accurate. It is always a good idea to instead get the IP address for that site and then do a network lookup on that IP. ISPs won't accept fake information here, so your chances of finding good information are much better. www.network-tools.com is great for looking up information about a website. Look toward the bottom of the report for the actual owner of the IP address.
Telephone Number If the only thing you can get is a telephone number, you'll have to complain to the company hosting the phone number. This information can be found at www.nanpa.com, the North American Numbering Plan Administration. First find the state served by an area code in the NANPA list at http://docs.nanpa.com/cgi-bin/npa_reports/nanpa?function=list_npa_geo_number. Then download the corresponding table from their http://www.nanpa.com/number_resource_info/co_code_assignments1.html page. You will need to match the state, the area code (first three digits), and the exchange (second three digits) on the table to get the company responsible for serving the phone number. Now you can use your favorite search engine to find out how to contact that company. For 900 numbers, use this link: http://www.nanpa.com/number_resource_info/900_codes.html.

How to Investigate Email Headers

All emails have what is called a header. This header contains all of the information about where the email came from. Some peices of this header can be easily forged, but others cannot be forged. Realize that email does not go directly from one computer to the other. Each computer or server that the email touches leaves a digital fingerprint, which can be traced and sometimes forged. A much better tutorial has been written about this subject here: http://www.stopspam.org/email/headers.html

If you are serious about tracking spam, you'll have to know how to decipher the headers!

What is an Open Relay?

Open relays are servers that have their mail settings improperly configured. It is important to know about this BEFORE you attack a spammer or send them nasty threats. Many spammers seek out open relays so they can send mail from someone else's server. Sending nasty letters to spammers is often useless because they've used a relay and your letter goes to an innocent person. The best thing to do is to find the actual company that benefits from the spam and report them.

Next You Have to Find The Proper Authority

Here is a partial list of additional addresses that you may want to report the offending email to. Not all of these will take immediate action, but it does help government agencies to build cases against spammers. Use your judgement about who to involve in what kind of report.

After reporting to their ISP ( for example, if they were using yahoo.com, you would visit the yahoo.com webpage, look for an abuse reporting email ( likely abuse@yahoo.com but check ), and sending a polite email requesting that they stop their spammer, you would also report to one of the following addresses depending on the content of their email.

uce@ftc.gov - Federal Trade Commission
pyramid@ftc.gov - FTC - Pyramid Schemes
health-claims@ftc.gov - FTC - Health Claims
419.fcd@usss.treas.gov - U.S. Treasury - Nigerian 419 Scams
enforcement@sec.gov - Securities & Exchange Commission
fraud@uspis.gov - U.S. Postal Service
webo@fdadr.cdrh.fda.gov - FDA - Medical Devices
otcfraud@cder.fda.gov - FDA - OTC Drugs
sfeedback@nasdaq.com - NASDAQ Stock Fraud
spamrecycle@chooseyourmail.com - Spam Recycling Center
cybertip.org - Report Child Pornography