3

I recently received a spam (see bellow) from a french e-commerce company (which I don't have an account on it) asking me for my personal address because I won a wonderful price.

spam 1

This is the link provided to me in order to specified my address in the mail. I didn't click it, and I removed a t from http bellow for disabling the link on the site.

This is probably a bad website, beware if you want to reach it!

htps://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=3&cad=rja&uact=8&ved=0ahUKEwjuwt2ThtHOAhVBtBQKHazUCYoQFggrMAI&url=http%3A%2F%2Fwww.wholesalejaipurkurti.com%2Fleggings.html&usg=AFQjCNEs0WUDSZfjLSIsCiInWYzGG6ELLA&sig2=RSUPjVa49dAurAZEz5WS9w&bvm=bv.129759880,d.d24

Moreover, in the mail, there are a lot of images with the same kind of link. (Thx to thunderbird for disabling retrieving the remote images). As I understand those links, google will redirect me to a website (www.wholesalejaipurkurti.com) which has definitely been corrupted.

Received part in the Source code of the mail:

Received: from AM3PR07MB1138.eurprd07.prod.outlook.com (10.163.188.12) by
 VI1PR07MB1149.eurprd07.prod.outlook.com (10.163.168.146) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 15.1.587.9 via Mailbox Transport; Sun, 21 Aug 2016 03:00:52 +0000
Received: from HE1PR0701CA0001.eurprd07.prod.outlook.com (2603:10a6:3:5::11)
 by AM3PR07MB1138.eurprd07.prod.outlook.com (2a01:111:e400:536f::12) with
 Microsoft SMTP Server (version=TLS1_0,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.549.15; Sun, 21 Aug
 2016 03:00:52 +0000
Received: from HE1EUR01FT007.eop-EUR01.prod.protection.outlook.com
 (2a01:111:f400:7e1f::204) by HE1PR0701CA0001.outlook.office365.com
 (2603:10a6:3:5::11) with Microsoft SMTP Server (version=TLS1_0,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.587.9 via Frontend
 Transport; Sun, 21 Aug 2016 03:00:51 +0000
Received: from BAY004-MC1F53.hotmail.com (10.152.0.57) by
 HE1EUR01FT007.mail.protection.outlook.com (10.152.1.243) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 15.1.577.8 via Frontend Transport; Sun, 21 Aug 2016 03:00:51 +0000
Received: from mout.perfora.net ([74.208.4.196]) by BAY004-MC1F53.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23143);
   Sat, 20 Aug 2016 20:00:44 -0700
Received: from web02-03 ([217.40.22.124]) by mrelay.perfora.net (mreueus002)
 with ESMTPA (Nemesis) id 0LsS5u-1b8wK21Z5k-011y0d for <MYADDRESS>;

CMM-sender-ip: 74.208.4.196
CMM-sending-ip: 74.208.4.196
CMM-Authentication-Results: hotmail.com; spf=none (sender IP is 74.208.4.196)
 smtp.mailfrom=cdiscount@webmail.123-reg.co.uk; dkim=none
 header.d=webmail.123-reg.co.uk; x-hmca=none
 header.id=cdiscount@webmail.123-reg.co.uk
CMM-X-SID-PRA: cdiscount@webmail.123-reg.co.uk

Note: I removed my real email address, and changed it with "MYADDRESS".

74.208.4.196 has already been reported as SPAM here.


What can I do in order to report this spam? to whom (email provider, website administrator...)? I have some ideas, but I prefer to be sure before reporting anything.

  • You see that the email was sent from the 123-reg.co.uk mailserver. You can forward the email including the headers to abuse@123-reg.co.uk (source) – grooveplex Aug 21 '16 at 12:14
3

I don't think that it makes any more sense to report such a single spam by yourself. You are very lucky or you have a provider with a good spam filter if you don't get lots of these spam. Trying to report everything just does not scale.

Instead ISP and specialized companies fight spam on a more global scale, for example by using honey addresses to collect spam and then automatically look for pattern in content or delivery. Also spam filters inside modern mail clients usually do a good job of detecting spam as long as any undetected spam is marked as such so that the filter can learn.

  • Agreed. I think you are developing a healthy interest in spam, in a good way :-) the Wikipedia article on "Anti-spam techniques" is a great starting point. – dotproi Aug 21 '16 at 23:04
1

Please don't report this to anyone except someone who you pay to provide you with services or someone you have good reason to think bears some responsibility for it. Most likely, all you would be doing is magnifying the damage the spam does by causing more people to spend more time dealing with it. You've already spend way more time than could possibly be justified by any kind of practical argument and can only justify this as an interesting intellectual exercise.

There are automated systems you can submit to, of course.

0

Report SPAM to your CISO, and no one else.

He will be able to evaluate correctly what is the level of risk involved and who it is worth to report it to, what counter measures are to be set in place at your MXs or your firewalls to protect your company.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.