The Anti-virus Times

Friday, February 9, 2018

If you have an anti-spam up and running, it is likely to prevent unsolicited messages from appearing on your computer—but the spammer will remain unpunished and continue to send out spam. Is there a way to stop it?

Spammers never use their personal mailboxes for their mailings—otherwise they would be identified very quickly, and their mail accounts would be blocked. To send out spam, they can use infected PCs comprising a botnet or utilise someone else's improperly configured mail servers. Most ISPs don't involve themselves with scammers and criminals. But some are prepared to rent out their assets to anonymous individuals. And those anonyms can be identified.

Let's take a look at a message header. In Microsoft Outlook, email metadata is displayed in the Message Options window. In other mail clients, you may need to use a different menu option. We already wrote about how the metadata can be accessed in the issue From grandpa in the village.

So we open a spam message and look for the Received parameter in the Internet Headers window.

Sometimes it can be unavailable. If so, try a similar parameter, such as Received-SPF.

Important! If the message passed through several servers, the metadata may contain multiple Received entries. We need the first one, at the bottom.

Now we can check the respective IP address to determine who it belongs to. We checked the address at 2ip.ru. However, you can use any similar site you like.

In our case, the IP pointed to a certain ISP. We don't know if the company is aware that its server is being used for illegal activities. What are we going to do?

1. If we don't expect any emails from abroad, we can configure the mail server so that no messages from specified regions are received.
2. Or get in touch with the ISP. Especially, if the company resides in our country. No one is looking for problems with law enforcement agencies.

Of course, there exist other types of unwanted messages. For example:

Would you like to receive messages from a site of this kind?