How Do I Report a Spammer?

Once you have successfully traced a spam email and have discovered the sender's email address or domain name, you can consult the appropriate Whois Database (see How do I trace a spammer? for more details about Whois databases). By entering the domain name or email address suffix (the part of the email address after the "@") into a whois database, you can get the contact information for the spammer's domain, and find out who owns the server that the spammer is currently residing on.

Once you have armed yourself with this information, there are several options available for reporting the spammer. Depending on how much time you want to spend, and how severly you want to hinder the spammer, you may wish to perform one or more of these reporting actions.

Report it to the Spammer's Provider
Most commercial non-solicted email originates from the servers of commercial internet providers. These providers are not usually aware that spam is being sent from their servers, and are usually quite opposed to being a source of spam. Having spam originate from your company's server can get it blacklisted with other web servers, anti-spamming authorities, and internet users. Getting a server off of these blacklists can be costly, time consuming, and is a huge inconvenience for providers. Therefore, notifying a spammer's provider will most often result in swift and decisive action against the offending party.

The best way to get your complaint to the providor is to attempt to send it to "abuse@provider" or "postmaster@provider." These are the standard email addresses that most ISPs set up to handle complaints of this nature. If your complaint emails bounce back from these addresses, then you should send your complaint directly to the administrator's email address found in the whois listing.

In your report, be polite, concise and to the point. Something along the lines of "This is an unsolicited commercial email I received from one of your domains, please take the appropriate action to stop it." Be sure to include the full headers of the spam in your message, especially the Received: headers or else the provider will be unable to act. You may or may not receive a response to your email.

Use a Complaint Forwarding Service
If there is no such information provided, then you can use a complaint forwarding service such as Abuse.net. Complaint forwarding services use large databases that store domain names and their best known reporting addresses. If a domain is set up to ignore all emails, the complaint is forwarded to their next-level-up providor. If nothing is known about the domain name in question, the forwarding service will attempt to guess the reporting address by using common email address prefixes and any of the domains name's suffixes (eg: x.y.com will be checked for "postmaster@x.com" and "postmaster@y.com"). You can also check the Abuse.net Current List for a complete listing of the information currently in their database. For an in-depth description on how to use Abuse.net's forwarding service click here.

Use a Spam Reporting Tool
If you are tired of dealing with spam and would like to automate the complaint process, you can download a spam reporting script. These scripts attempt to intercept spam emails sent to your inbox and compose complaints to the responsible providers. It should be noted that these programs are not 100% fool-proof, and that some devious spam emails may sneak by them, or may trick them into sending a complaint to the wrong source. However, using these tools can create a noticeable reduction in the amount of spam you receive.

Some Reporting Tools to consider are:

• Sam Spade a multi-function analysis program that decodes the headers of a junk email and makes an educated guess about where it originated from.
• Spam Cop a very popular web-based system that attempts to decifer where a junk email came from and send the necessary complaints
• Spam Assassin for Unix based systems is run from procmail and uses a scoring system to identify spam. This tool has gotten mixed reviews because some consider its criteria to be naive.
• Spam Hater a free program for Windows users, helps to automate the process of sending complaint emails. Spam Hater cannot recognize forged email addresses in the header information, so you will have to edit out some of the complaint addresses before sending them.
• Remove Spam is a spam-reporting service that offers manual tracking and reporting of your spam on a per-report or monthly fee basis.
• Spam Punisher is a program that assists with creating complaints about received spam.

Many of these reporting tools also double as Spam Filters. Consult later pages on Email Filters for more information in regards to these tools.

Report it to Agencies that Maintain Spam Statistics
There are a number of agencies set up to monitor the amount and nature of spam on the internet. These agencies will not do anything directly in regards to the spam that you received; however, they will make a note of the incident and add it to their statistics. It is hoped that the statistics maintained by these agencies may be useful in creating future policies regarding spam. When you notify one of these agencies, be sure to forward a copy of the spam and include the full header information. This will help them identify the common types of email forgery, and the actual locations that spams originate from.

Contact any of the following agencies:

• The Spam Recycling Center maintains statistics for informational purposes. Put your state/province abbreviation into the Subject header and send the spam to spamrecycle@chooseyourmail.com.
• The U.S. Federal Trade Commission Send the spam to uce@ftc.gov.
• news.admin.net-abuse.sightings is a community-based Usenet newsgroup set up for people to post their spam in the interest of following spam trends.
• The Securities Exchange Commission (SEC) can bring Federal action against spammers who advertise investments or securities (such as stocks and bonds) in their spams. Forward to enforcement@sec.gov
• The North American Securities Administrators Association also wants to know about securities spam. Forward to cyberfraud@nasaa.org.
• Spam that appears to offer medicine illegally should be forwarded to the U.S. Food and Drug Administration at otcfraud@cder.fda.gov.

Report them to a Mail Abuse Blacklist
If you are still not satisfied with the punishment you have dished out upon the spammer, you can send them to the "black hole." Make note of all the emails you received from the spammer, every complaint you have filed, and any responses you have received and submit them to a mail abuse blacklisting service such as the Mail Abuse Prevention System. From here you will be given instructions for submitting the spammer to their Realtime Blackhole List (RBL). These lists are composed of sites known to send spam or harbour spammers. They are used by many ISPs to automatically block any emails coming from sites on the list. When a spammer's site is blacklisted by such a large number of ISPs the effectiveness of their spamming campaign is drastically reduced.