Tag Archive for fighting spam

Spam Fighting Update

My blog post titled “I’m Fighting Acai Berry Spam Today” from August 14, 2008 is the 4th most read post on Skylarking. It has received a fair amount of commentary since April of this year. The comments have lead me to add an update to the post to clarify the intent and purpose of the article:

This post is about spam in general, using Acai Berry spam as an example. I aim to (1) illustrate that sometimes email addresses and web site addresses don’t match; and that when WHOIS is used, one may often find that they might not belong to the same person or organization. That should be a warning as to the legitimacy of the email message (or the site). Some readers have focused more on the email aspect of spam, but (2) much spam directs you to a web site. As some commenters have pointed out: email addresses can be spoofed, and tracking an email can be very difficult, BUT it is my opinion that web sites can be easier to track.

So my point is that spam is often associated with a web site, and discrepancies between a web site and an email message can often help determine the validity of the email and/or the site.

You can read the updated post and comments here.

Thanks to everyone who has commented, and added their thoughts, ideas, and knowledge concerning the subject. And thank you for leading me to elaborate further. I look forward to hearing more comments and thoughts on the subject.

I’m Fighting Acai Berry Spam Today

Clarifying the
Meaning of Spam

The term spam refers to email that has the purpose of promoting and selling a product or service. Furthermore, the email message has to be from an organization or individual that you didn’t request information from, nor did you tell them that it was okay to contact you. The FTC defines spam as “unsolicited commercial email” or “UCE” for short. If you tell a company it’s okay to send you email, then that applies to all email from that company unless otherwise specified.

FTC Law, Commercial Email:
CAN SPAM ACT 2003

  • Bans false or misleading ‘Header’ information. The “From” and “To” info must be accurate.
  • Prohibits deceptive “Subject” lines. The subject must match the content of the message.
  • Message must have an “opt out” or “unsubscribe” method. The link must
    be good for 30 days, and must be honored in 3 business days. (Previously 10 days
    was the allowance, but this changed in July 2008)
  • Message must list a legitimate physical address. The sender cannot register the address under an assumed name either.
  • Message must clearly state that it is an advertisement.

Update and Clarification (May 6, 2009):  This post is about spam in general, using Acai Berry spam as an example. I aim to (1)  illustrate that sometimes email addresses and web site addresses don’t match; and that when WHOIS is used, one may often find that they might not belong to the same person or organization. That should be a warning as to the legitimacy of the email message (or the site). Some readers have focused more on the email aspect of spam, but (2) much spam directs you to a web site. As some commenters have pointed out: email addresses can be spoofed, and tracking an email can be very difficult, BUT it is my opinion that web sites can be easier to track. (Read my “Spam Fighting Update”).

The original article begins here:

I hate spam.

I mean I really hate spam.  I don’t just delete it, I report it. I send it to the FTC’s spam@uce.gov email address so they can record it. If I get really bothered about it, I contact the company that registered the name for the owner of the email address and let them know that someone is using their service for spamming.  A lot of decent companies don’t like to hear about that.  It can hurt their law abiding users. How’d you like to learn that your emails don’t go through because someone on the same service as you was spamming, and getting everyone else blocked because of it?

For about two weeks now I’ve been receiving emails claiming to be from the “American Health Association” telling me how to lose weight with various products made from Acai Berries. After clicking unsubscribe links (when available) and deleting, I began to “get testy” when they continued rolling in. So I started fighting back.

The Law Is On Our Side

Let’s see what laws and such are on my side and yours here.

  1. Web and email addresses have to be registered to an owner or registrant. It is illegal to do so under an assumed name.
  2. Commercial messages (they wanted me to buy these berry products) must by law contain truthful addressing info both in email and in the physical world. And, once more, no assumed names are allowed. A physical address must be included.
  3. Many other nations have teamed up with the US to fight spam, so even if these spammers aren’t in the US, the country they live in may work with the US to fight spam.
  4. Many reputable internet and email services will not allow their clients to use their systems for the delivery of spam.

How did I fight back?

The Registrant / Owner of the Email Address. If the message was from the “American Health Association” then its email address — according to my Google search — would be either “@ahahealth.com” or “@americanhealthfoundation.com”.

Instead the email addresses pointed to “@brightbat.com” and “@prodemosite.com” among others. So there’s an FTC violation for false or misleading header information.

Want to know the registrant/owner of an “@whatever.com” address? Just go to Google and search for “whois whatever.com”. There’s no space in whois, and don’t include the quotation marks either. So I did a search for whois brightbat.com and whois prodemosite.com. Both came up with private or anonymous listings, they were both registered through the same service and one was registered just yesterday (a one day old address) and the other was registered in mid July.  Go to Google and try searching for them yourself. Oh, heck, here’s the direct link to brightbat’s listing and here’s prodemosite.

Also, the addresses were registered through a company in the UK, and the UK works with the US to fight spammers.

I contacted the private registration service, PrivacyProtect.org, and reported the owners of these two addresses. Privacy Protect will reveal the registry information if they deem it appropriate. I let them know the owners of these addresses were sending spam messages in violation of the provisions of the FTC’s CAN SPAM Act. I also forwarded copies of the emails to them at abuse @ privacyprotect.org.

What Other Violations Were In Those Emails?

You can follow along with the violations by taking a look at the legal requirements for commercial email messages listed in the yellow box at right. Several people have received up to three or more years in jail for violating these laws.

Back to the Acai berry violations:

  1. Along with the misleading email names (claiming to be the AHA when they weren’t), they also
  2. failed to mention the messages were advertising
  3. failed to include a postal address
  4. In several cases they failed to include an unsubscribe link, and in some cases the link didn’t work. All violations.

What Else Did I Learn?

The people at PowerSupplements, a manufacturer of Acai berry products wasn’t to thrilled to hear about the Acai berry spam. That was according to a report at SpamFighter.com, a provider of spam filtering software at www.spamfighter.com.

So if you decide you’d like to join the fight against spam you can follow my lead.

  1. Look for the same violations I looked out for.
  2. Forward spam to the FTC at spam@uce.gov.  (UCE stands for unsolicited commercial email).
  3. Want to go the extra mile? Go to Google, and do a whois search on the email address it came from.  Just use the part of the address that comes after the @ symbol, don’t use the whole address. Then find out where the reistered the address. For example, whois brightbat.com. Then find out who the registrar is and let them know a user of their service is sending out spam.

If anyone has a question, please email them to me using the Contact link, or, if it relates to today’s message, please use the Comment and Question link below. Follow me on Twitter. I’m looking forward to hearing from you.