• Spam tracking and complaining lessons

• Spam prevention tips for ISPs

• There is a new email address for reporting financial scams on the Internet. You can report them to cyberfraud@nasaa.org. You can still use the SEC address of enforcement@sec.gov for stock fraud.

• California passes two new anti-spam laws! California Governor Pete Wilson signed into law two anti-spam bills. AB 1676 requires that the spammer put "ADV:" in the subject line, or in the case of porn spam, "ADV:ADLT.". Violators can be prosecuted for up to $500 per email message or 6 months in jail. AB 1629 will allow any email provider to sue for damages for any losses caused by network clogs or crashes. Providers can sue for $50 per unauthorized message, up to $25,000 per day, or for actual damages, whichever is greater. Note that although California and several other states have passed powerful anti-spam laws the new federal Can-Spam law preempts them and basically legalizes spam in many instances.

AB 1629 also makes spoofing a crime. Sending UBE "knowingly and without permission using the Internet domain name of another individual, corporation, or entity" is covered.

AB 1676 will make it much easier to filter spam if the spammer's follow it. Enforcing 1676 is another story, since California authorities are much more interested in prosecuting people smoking pot. AB 1629 leaves prosecution up to ISPs.

Both laws go into effect on January 1, 1999.

• There is an excelent article on UCE on this PBS Online Newshour page.

• It has been reported that the California AG responds to complaints about spammers. If you are being hit with spam from Worldtouch, you can contact the CA Attorney General here.

• Washington State Anti-Spammer collects from a spammer! With the introduction of anti-spam legislation in the state of Washington, residents of that state who clearly indicate that they are Washington residents can collect $500 per spam. I wish I lived in WA, then I could "get rich quick" by sueing spammers.

• Here is what the FTC has to say about the usual spam you receive.

• It looks like Sanford Wallace has done a 180. He has recently been hit by a clue by eight and has learned the error of his ways. He has dropped GTML and says he will even support the Smith bill (HR1742). He has also brought a couple of spam sources to light. Update: Sandord Wallace is still the same old scumbag he was before and has since been sued for similar activities.

• Draft of Government CDT Spam Report - forged headers are FRAUD

• Even Bill Gates hates spam!

• Spam Tools

• More spam tools for UNIX users

• Netscum Website - This is a parody of the original which will shortly be shut down on October 16, 1997

• Spam abuse FAQ
• Chris Smith's bill in congress to curb spam - Encourage your representative to support it. Accept no substitutes.

• CAUCE, the Coalition Against Unsolicited Commercial Email is pushing for some good legislation in the US to put an end to it. Support the Smith bill. Write your Senators and ask them to support it. It extends the junk fax law to also cover email. It is simple and should be effective. The junk fax law has withstood the courts, and there are no loopholes or client side filtering requirements.

• Check out sites like Fight Spam on the Internet

• You can email the FTC about Make Money Fast (MMF) letters at pyramid@ftc.gov and fraud messages to nfic@internetmci.com. You can also alert the IRS about scams and such by emailing net-abuse@nocs.insp.irs.gov.

Here's a list of government addresses you can send complaints to:

	bbroder@ftc.gov  [MMF]
	pyramid@ftc.gov  [MLM, phone card]
	consumerline@ftc.gov  [Porn]
	uce@ftc.gov [especially forgeries]
	fraud@uspis.gov  [chains, mail money]
	nfic@internetmci.com  [gen. fraud]
	postmaster@fcc.gov [whenever other mailboxes are full]
	webcomplaints@ora.fda.gov [medical scams]
	net-abuse@nocs.insp.irs.gov [claims of great earnings]
	enforcement@sec.gov  [investment/stock scams]
	webmaster@ofta.gov.hk [spam originating in Hong Kong]

Most Internet Service Providers (ISPs) have complaint addresses for spam originating from their networks or for web sites hosted on their networks. Usually they can be contacted at abuse@isp.com or postmaster@isp.com. A good service is abuse.net. Once you are a member of abuse.net, you can just forward the spam with the headers and any notes to spammers.isp.com@abuse.net and abuse.net will attempt to forward it to the appropriate email address to deal with the spam.

• Always check the headers and use tools like whois and traceroute (tracerte in OS/2, tracert in NT 4.0) to verify that the spam isn't designed to attack someone else. Sometimes people forge the reply to and from fields in the email to point to some poor innocent bystander (often their former ISP who kicked them off for their behavior).

• If you forward the spam to an ISP or anyone else to investigate it make sure you send the full headers in the email message, not just the to, from, and subject lines as the headers usually tell the real story about who sent it and who was involved.

• To check the headers, look at the Received from fields. These will show you the route the email took, usually identifying the culprit's ISP or system. Note that sometimes these are forged, and sometimes a site used to relay or forward mail doesn't bother to verify the sending system.

• Often I have been successful in getting people kicked off of their ISPs by tracking down their ISP and sending email to postmaster or abuse at their ISP. Sometimes I've received responses after emailing people listed in the whois information or their ISP (from traceroute and whois). I would guess I've kicked around 20 spammers off the net. I don't keep count anymore.