Spam-tracking 102 -- the many uses of DejaNews 


Subject:      LESSON: Spam-tracking 102 (the many uses of DejaNews)
From:         bmattocks@comp-sol.com (Bill Mattocks)
Newsgroups:   news.admin.net-abuse.email
Date:         Fri, 12 Sep 1997 16:26:44 GMT
Organization: Computer Solutions of Kenosha

Are you sitting comfortably? Good, then I'll begin.

Since posting Lesson 101 (spam tracking for newbies), I have received a few comments by people curious about DejaNews and how it works. Quite simply, DejaNews is one of the dedicated spam-tracker's most powerful tools, and it is quite simple to use.

DejaNews is a free service and trademark of Deja News (TM) is a trademark of Deja News Research Service, Inc. They make their money by selling banner advertising that the user sees across the top of their screen when it is used.

DejaNews is the memory of UseNet. There are ways to prevent a given UseNet message from being archived by DejaNews, and there are ways to remove your OWN information from DejaNews, but for legitimate spam-trackers, that's not important. For the most part, DejaNews simply records a major part of UseNet News traffic, and indexes EVERY SINGLE WORD of it (that's important, as we'll see later).

What is important is that DejaNews has many powerful features that we can use to track spam back to its source.

Keeping in mind that most spammers have been at it for awhile, we can use DejaNews for the following:

  1. Determining from where and for how long a spammer has been spamming.
  2. Determining if anyone has succeeded in unmasking the spammer yet.
  3. Determining if the spammer has given away clues to his or her own identity over a period of time.

To expand on that:

  1. By searching for a spammer's name or address, we can see if the spammer has been spamming from more than one location over time. In effect, we can track the spammer's history as they are kicked from ISP to ISP. This is useful information!

    Often, we get "I'm sorry" responses from clueless ISPs or even the spammers themselves, who want to fool us into thinking that they are "beginners" at the spamming game. DejaNews can put the lie to this one right away! If an ISP gets a spam report, that's one thing. But, if the ISP gets a report that gives detailed information on just how long the spammer has been at it, and how they've been kicked from ISP to ISP, that's quite another. It may be enough to convince some ISPs to dump the spammer, since he has been lied to. In any case, you'll know when NOT to believe the clever "I'm sorry" lie.

  2. One can see how quickly the messages fly by in NANAE. This can make it hard to recall exactly who said what to whom and when. Often, a spammer is unmasked due to the hard work of some anti-spammer, and then is RE-unmasked by another anti-spammer 6 weeks later. Before investing all of your time and energy in tracking a spammer, do yourself a favor and see if the job has already been done for you! Of course, you must still exercise due diligence to be certain that the spammer is the same one you're after, but take the time to look! The power of DejeNews lets you network with anti-spammers who are speaking to you, as it were, from the past.

  3. Spammers often change little bits and pieces of their spam as they fine-tune it. If they find that they've left themselves vulnerable, they change the ugly bit and continue on. They hope that nobody realizes that they've fixed whatever it was that gave them away in the first place. However, DejaNews is the answer here. By comparing past and present spams from the same spammer, one can find interesting things which can finish a puzzle sometimes. This is not frequent, but it does happen. Keep your eyes open for subtle changes in a spammer's methods that might indicate a weak link.

HOW TO USE DEJANEWS

Quite simple to begin. Go to http://www.dejanews.com and type in the name or mailing address of the spammer. Click on the FIND button. However, sometimes it is not as simple as all of that. Fortunately, as I said earlier, DejaNews indexes the complete text of all that it collects. Given that, you can search on random bits of text that can shed light on the identity of a spammer. Is he using a PO Box? If so, type that in. You'd be amazed at how many spammers are too cheap to get a new PO Box after they're unmasked at one spam and move on to another. Same PO Box generally means same spammer. Phone numbers. Searching for ISPs can give a clue as to whether or not they've been known to host spammers. Use your imagination! Try matching up the IP address that the spammer came in from. That is less useful, since most IP numbers are pseudo-random when they're hosting a dialup account, but you never know. It might be an IP address that's been made to look like a dialup, but is really a dedicated circuit. You have to think a bit like a detective. Use logic and reasoning to satisfy yourself that a hit is or is not the spammer you're looking for. Even a ".sig" line can ID a spammer sometimes. Spammers are often quite gray little blobby creatures, devoid of individual traits, but sometimes one burns with a bit of creativity, or happens to seize upon a certain phrase which they like to use over and over. It can be their undoing.

Don't forget to search all the way back in DejaNews. At the end of the initial search, you'll see another block with your original search in it, and a couple of radio buttons for "recent" and "old" news. The default that you've just completed is recent. Make sure to check out the "old" news as well.

DejaNews has many powerful features, including a "power search" mode. I encourage you to explore those features as well, although you'll have to learn a bit about boolean logic, which is beyond the scope of this lesson.

That's it for now. Remember, DejaNews is a big hammer for the anti-spammer. Don't be afraid to use it to clobber a spammer.

Best Regards,

Bill Mattocks, CIIU

PS - All rights granted to republish this in any form, so long as the information is complete and attributed to the author. Have fun. 

***************************************************************
* Keep up to date on SPAM in the MEDIA!  Visit SpamWatch and  *
* click your way to useful up-to-date information for free!   *
* http://www.psyclone.com/spamwatch                           *
***************************************************************