ooking
for e-mail addresses on web pages. If you have a personal web page that
has your e-mail address on it (especially as part of a "mailto:"
hyperlink), or there is some other page (departmental, school, etc.)
with your address, they might acquire it this way as well.
- If you've ever subscribed to an e-mail discussion list, or listserv,
it's possible that the listowner sold all the addresses to a spammer
- Spammers often probe large, well-known mail hosts (Penn has several)
to learn active account names. This sometimes involves the "brute
force" approach of attempting to send mail to every possible 8-character
- If your e-mail address appears in an online directory, it may have
been picked up by a spammer. Penn's online directory is at http://www.upenn.edu/directories.
To update the information about you that is available to a search of the online directory, select the "Update directory listings" link on the main directory page (PennKey authentication required)
- Spammers also sell and swap "catalogs" of e-mail addresses
among themselves. These catalogs are sometimes printed, but recently
are more likely to be on CD-ROMs that contain literally millions of
What can I do to keep "spam" out of my inbox
Here's a foolproof method:
- Locate the cord (usually black, about 1/2 inch thick) coming from
the back of your computer and going to an AC power socket on the wall
or power strip.
- Pull it out of the socket.
- Never plug it back in again.
If you're not quite ready for that drastic a step, start by coming to
terms with the fact that it is virtually impossible to avoid dealing with
spam at some level unless you're willing to give up using computers entirely.
There are some things you can do, though, that will help ease the pain
of dealing with spam, even if it's just a little bit:
- The Direct Marketing Association's DMAchoice Service (http://www.dmachoice.org)
lets you register e-mail addresses that you would like to keep out of
mailing lists. All DMA members (more than 4,500) are required to remove
registered addresses from their mailing lists, and the service is available
to non-members as well.
- If you receive spam that appears to be originate from a Penn user
or computer, or appears to pass through a Penn computer (see "e-mail
relays", below), contact Penn Information Security at firstname.lastname@example.org.
Using Penn computing resources for commercial purposes is a violation
of the Acceptable Use Policy. Be aware, though, that e-mail headers
are very easily forged, especially the "From:" and "To:"
- If the spam is coming from off-campus (and this is the case well over
99% of the time), and you want to be more proactive about it, you can
attempt to identify the spammer's Internet Service Provider (ISP) and
send a complaint directly to them. This sometimes yields results, and
some ISPs will be very responsive, but be aware that is easy for spammers
to simply change ISPs, or open a phony account with one of the free
e-mail services (Hotmail, Yahoo, et al) and pick right up where they
left off. There are a number of web-based services that will help you
trace and identify the sources of spam (as much as is possible - spammers
are very crafty). Probably the best known is SpamCop (www.spamcop.net) .You can do this yourself, of course, but you'll need
to know how to interpret e-mail headers and do a whois lookup. A good
set of free tools for this can be found at http://www.samspade.org
With regard to Usenet spam, there are rules on Usenet relating to the
posting of multiple copies of the same "article". When the thresholds
are exceeded, the posting is termed "spam" and cancels for the
posting can be issued. This definition relies solely on message count,
If you are a regular poster to Usenet, you can reduce your "spam
profile" to some degree. One technique is to avoid putting your actual
e-mail address in a posting (either in the headers or the text of the
post) in a form that can be interpreted and collected by a "bot"
(automated web-crawling software application that combs websites, newsgroups,
etc. for data). For e