Identifying the source
The return address on an e-mail message may not be the real source of
the e-mail.
It's possible that a third party is trying to enlist your unknowing
help in mail bombing the supposed sender. The third party first sends
you and thousands of other people an annoying message that appears to
come from the intended victim, then just sits back and waits for the
victim to receive the angry responses.
E-mail can be forged, and detecting a forgery can be difficult.
Finding header information
The "envelope" contains important header information.
Most e-mail applications hide headers (known as SMTP or trace headers)
that help identify the source of the message, but they can be displayed
by issuing the appropriate commands. With Eudora, open the message and
click on "blah blah blah" (upper left corner of window).
For other e-mail applications, see the CIT HelpDesk's page on
How to obtain header info
from various e-mail clients.
News reader applications usually have an option to display header information (e.g., Newswatcher has a "show details" option).
Deciphering headers
Deciphering the headers is not easy, even for experts.
Here is a typical e-mail header. Not all headers contain the same
information, so you may need to check with your local computer support
staff for additional help. The bolded parts are the most useful to
examine.
- Return-Path: dork@geeks.com
- Received: from server1.geeks.com (SERVER1.GEEKS.COM
[111.222.333.444]) by postoffice2.mail.cornell.edu (8.7.5/8.7.3) with
ESMTP id JAA28319 for ; Fri, 19 Jul 1996 09:50:30 -0400 (EDT)
- Received: (from daemon@localhost) by server1.geeks.com (8.7.5/8.7.3) id JAA01199; Fri, 19 Jul 1996 09:50:29 -0400 (EDT)
- Received: from [111.222.333.999] ([111.222.333.999]) by server1.geeks.com (8.7.5/8.7.3) with SMTP id JAA01159 for ; Fri, 19 Jul 1996 09:50:24 -0400 (EDT)
- X-Sender: dork@server1.geeks.com
- Message-Id:
- Mime-Version: 1.0
- Content-Type: text/plain; charset="us-ascii"
- Date: Fri, 19 Jul 1996 09:50:11 -0400
- To: my-netid@cornell.edu
- From: dork@geeks.com
- Subject: chain mail - pass this on for luck
To identify the sender, look at lines 1, 4, 5, and 11 in the example above.
If they exist, they should contain similar information about the e-mail address of the sender.
If the information is very different, then it's a possible forgery. The most reliable field to use
to identify the actual sender is in line 5 (X-Sender).
To identify the client computer used to initiate the e-mail, look at line 4 in the header
above. It was sent from a computer with the IP address of 111.222.333.999. In some cases, this can
be traced to a specific location or person.
To identify the server used to receive and deliver the e-mail, look at line 4.
In this example, the server that received the e-mail and later delivered it to
postoffice2.mail.cornell.edu is shown as server1.geeks.com. If you want to complain, use the domain
name from line 4 (geeks.com in this example) and follow the instructions below.
In some cases, the message may be sent via an anonymous re-mailer. Mail from a re-mailer is
usually identified as such and will often contain a disclaimer about the contents. Sometimes the
message will identify an address to complain to. However, these sites rarely take any action and
will never disclose the true identity of the sender without a court order. Often they do not know
the identity of the sender.
Who can you report the problem to once the source has been identified?
- Postmaster
Every site is supposed to have a postmaster, though some sites ignore
e-mail sent to postmaster. To copy the postmaster, take the sender's
e-mail address and replace the sender's user name with "postmaster".
For example, if you wanted to complain about e-mail you received from
dork@geeks.com, and you have verified that this is the origin by
examining the headers (as described above), you would send e-mail to
postmaster@geeks.com. If there is no postmaster account set up, the
e-mail will bounce back to you. Then try sending to root or admin, for
example, root@geeks.com or admin@geeks.com. Keep in mind that the
postmaster or system administrator might be the same person you are
complaining about and you may only make the situation worse.
-
Administrative Contact
All Internet sites are supposed to list an official contact person for their domain. Contact
this person only for serious incidents. The easiest way to find this person is to go to the
InterNIC Registration Services Center. Use
their search facility to search for the domain name of the sender's site. For example, if the
sender was dork@geeks.com, then the domain to search for is geeks.com. Again, keep in mind that
the administrative contact might be the same person you are complaining about and you may not
get any resolution.
- Outside agencies
If a situation is serious, you may get results by reporting the incident to the appropriate outside agency.
- Law enforcement agencies
These agencies accept reports of illegal activities in their jurisdiction.
Cornell University Police 255-1111
Ithaca Police 272-3245
NY State Police 273-4671
- Federal Bureau of Investigation
The
FBI pursues cases of wire fraud (applicable to the Internet since
communications travel over phone lines). However, note that the FBI is
mainly interested in "big" cases involving large sums of money (for
example, over $10,000) or large numbers of victims (perhaps more than
20).
- Federal Trade Commission
The FTC deals with consumer protection. Investigates deceptive marketing practices and scams that cross state lines.
- US Postal Service
The
USPS investigates cases of mail fraud, including pyramid schemes and
other money-making scams that use the Postal Service to send money via
the mail. If you have done business over the Internet and received an
item via US Postal Service that wasn't what you paid for or you shipped
an item via US Postal Service and never received payment, this is where
you should file a complaint.
- Better Business Bureau
This
is a private organization dedicated to helping consumers. They accept
complaints about businesses and try to assist in settling disputes.
- Software Publishers Association
This
is an international organization of software companies and developers
that pursues software piracy. They accept reports of ftp and bulletin
board sites containing pirated software. You can also report if
software you developed has been pirated.
- Recording Industry Association of America
This
is a private, not-for-profit corporation whose member companies
produce, manufacture, and distribute approximately 90% of all
legitimately recorded music in the US. You can get more information on
their web site or you can report sound recording piracy by calling
1-800-BAD-BEAT or sending e-mail to BADBEAT@RIAA.COM.
Preparing the complaint or report
- Include a brief, concise description of the problem, and be sure to identify yourself.
- Include copies of any communication that is relevant, including all header information.
- Send only one message. Remember that mail bombing is a violation of Cornell policy.
- Be polite and do not threaten.
- Do not blame the site administrator because one of their users misbehaves.
- Do not assume that the incident was intentional or malicious.
E-mail is easily misdirected due to typos.
- Do not expect an immediate response.
Some sites, like AOL, get lots of e-mail.
