Need "Techie Help!" Our business is getting sex e-mails..

[KoKo]

We can't figure out why. We have "Zone Alarm, Spybot, Adaware." But lately we are getting these weird e-mails asking for sex. We have two offices. Use a T-1 line and one office and a "wireless connection" at the other.

We have four partners and two different addresses but now BOTH addresses are getting these "sex e-mails and some weird spam about sex."

Is this coming from one of our partners? How do we find out who is sending the stuff. Is there a way to check the domain to find out where it comes from.

We are too afraid to try to click on anything and just delete them, but some DU'ers have said there's a site called "whosit" or something that lets you check out e-mail domains. How do I do this and keep my computer secure. We are not good at tech...but thought we had protected ourselves.

Is anyone else having this problem who has a small business? It's awful and it's only been happening the last three months... :shrug:

[Viva_La_Revolution]

1. We've been getting a lot of them too...

Block sender is not helping, and neither is adding them to the junk-mail list.

[progressoid]

2. Zone Alarm has a tracking tool but that is for internet attacks to your

system I think - not emails.

[Az]

3. Some possible explanations

First of all those programs will do nothing to stop spam. They are designed to stop hackers and other directly invasive attacks.

As to how such spam can be coming your way. Do you have a website? Do you list your email addresses anywhere? If so then crawlers may be targetting your by going through your website and pulling the email address off it.

It could be someone has put your email address in a spam bot maliciaously.

As to finding out where they are coming from its probably not possible with a simple search. Most spammers do an adequate job of covering their trail. At best you will find a victim of theirs who's server they have hacked to bounce their email off of. They certainly do not want you tracking them back to their lair.

Your best bet is to use your email client to filter the source out. If you are using an ISP for the business ask them about filters as well. There are many known spam filters the ISP can provide to block more than you could manage with the built in blockers.

[KoKo]

4. One connection comes from Time/Warner/Roadrunner other is Verizon.

We are picking this up from both of them recently. We've had the Time/Warner for about a year and the Verizon less than a year. It all started with both the last three months.

I need to check our Web Page, though. That was just revised in the last month and is an International Web Page because of the clients we have.

Maybe "that's" the culpret....our Web Page.. but how does one block a "Webpage" from spam to the clients e-mail addresses? :shrug: Do we need to bring a "consultant" in?

[Az]

9. Its not easy

Well actually it is easy but its not practicel. On a business web page you want it to be easy for a perspective client to simply click on the link to send an email. Unfortunately this same convienience works for the spammers. They merely send crawlers all over the net looking at web pages for anything that looks like an email address. The easy way to beat this is to put something fake in your email that is readily recognised by a human but not by an automated process. Ie [e-mail]. This enables a real person to edit out the extra bit but the automated system will send the spam into the ether.

[Zing Zing Zingbah]

16. Maybe it is the time-warner...

I have Road Runner which was through time-warner (now it's called Brighthouse Networks over here) and I'm always getting those sort of emails in my roadrunner email box. I don't have that problem with other email services I've used.

[democracyindanger]

5. whois.net

http://www.whois.net/

Will help you find out information from the sending domains, but dollars to doughnuts they're coming from another country.

[KoKo]

6. Yes...thinking it could be our website with international link. Maybe

that's how they got us. Can our website developer put a Block on? I don't know why he didn't tell us about this when we revised it. :shrug:

[Az]

12. Your internet provider has access to many tools to block spammers

Ask them what programs they have. If they implement the block you will never see the majority of spam heading your way. A few will get through. But the obnoxious porn ads are easy to block from a server level.

[Strawman]

7. This product works pretty well at filtering spam at our work

http://www.sunbeltsoftware.com/product.cfm?id=930

And we have a guy there who's a porn freak with the one of the worlds most guessable email addresses. It probably quarantines about 500 spam emails a day for him alone.

[mahatmakanejeeves]

8. Whois

Try:

http://samspade.org/t/

http://www.geektools.com/
http://www.geektools.com/whois.php

use the format "democraticunderground.com"
not "http://www.democraticunderground.com/discuss/duboard.php"
without the quotes

[Az]

10. Unfortunately all Samspade and any other lookup tools will tell you

Is who they victimized and hijacked. The actual spammer is far removed from the actual address you can pick up in a header.

[mahatmakanejeeves]

13. hijack, trojan, etc.

Yeah, you're right. At least the OP can alert the abuse desk at the oufit whose servers have been hijacked, so they can work on the problem.

Best I can come up with right now.

[KoKo]

11. Thanks...will check it out..., why do I need to leave out the quotes,

though? :shrug:

[mahatmakanejeeves]

14. that's the way it works

Don't use the http; don't use the www, etc.

[Az]

15. Characters mean things to computers

The quotes are typically used for google style searches. In the context of a whois search it is going to not bother parsing special characters out. Its going to read whatever you type in as the target.

As to http:// thats not actually part of the sites address. http:// is information for your browser. It tells it what sort of connection it is. http:// tells it its a web page using HTML. ftp:// tells it its a file transfer page.

When you are using whois or any other such tool it just wants the name that DNS translates to an IP number. Anything extra will just confuse it.

[Liberal In Texas]

17. Excuse...?? You're getting spam sex E-mails?

Is that it?