TECHWISE : Nigerian Gold & Viagra

New Zealand Management, Nov 1, 2006 by Mark Evans

To: Bob Smith

From: Mariam Ajao Omotoriola

Dear friend,

I am sorry to encroach in your privacy, please permits me to introduce you to my good self.

My name is called Mariam Ajao Omotoriola.

I loss both parents in a plane crash on the 4th of May 2006. My late father was Area Manager of petroleum pipeline marketing cooperation (PPMC) in Nigeria.

My fathers' personal lawyer, Thomas Emoson SNR, told us to understand my late father has US$3.2 million in a finance house in London. As my fathers attorney he can make claims of the fund. But we will have to look for an honest, God-fearing foreigner who will act as my fathers partner in business so as to make claims of the fund.

That is the reason why I decided to seek for your assistance and cooperation. When I receive your positive response, I will inform my fathers lawyer so he can explain what is expected of you in this matter. I await your swift response.

Regards,

Mariam Ajao

To: Mariam Ajao Omotriola

From: Bob Smith

Dear Mariam

Perfect timing! I received an offer last week for a truckload of Viagra real cheap. But unfortunately I've no money, as I'd invested my life savings in a plot of land on the moon. I got a great deal on it from a web-based realtor!

If can lay our hands on this $3.2 million I think we can corner the Australasian Viagra market. This god-fearing man looks forward to your early reply.

Regards,

Bob Smith

Sick of spam and phishing emails? There's no perfect anti-spam solution but here are some simple ways to limit the amount of spam you get. First up, prevent spammers getting your email address in the first place. Never list your email address on your website. Spammers use "bots" to crawl websites harvesting email addresses. So use a "contact us" web form instead. Or an "obfusticator" that makes your email address human-readable but difficult for harvesters to be able to gather. A good one is at

automaticlabs.com/products/enkoderform .

Use disposable email addresses. Set up a Gmail or Hotmail account and forward emails to your real account. Use these disposable email addresses when filling out forms, surveys or subscriptions to email newsletters. When spam to that address gets too much, throw it away and get a new one.

Don't reply to spam. Sometimes spammers offer the ability to opt out of emails. Don't be fooled. It's probably a trick to check their email got through. Replying sets you up for lots more of the same. Legitimate email senders may offer opt-outs too - but ensure you know who's sent the email before you respond.

Be careful of HTML emails. They can contain linked images. Opening or previewing the message causes the images to be downloaded from the spammer's server - indicating they've reached a live target. If you can tell from the address and/or the subject it's a spam - delete it, don't open it. And never click on a link in a spam email - that's just encouragement.

Use services such as Spamcop ( spamcop.net ) to report spam. If you are technically inclined - or sufficiently infuriated - learn to read the headers on your messages www.stopspam.org/email/headers.html gives a tutorial) so you understand how spammers forge emails and how to report them to their ISP. Report spam to your ISP too - try forwarding it to abuse@yourisp.

There are two approaches your administrator can take to prevent spam. Firstly, stopping spam being delivered to your server in the first place. Servers can usually be set up to use real-time black- lists (RBLs) - lists of suspect mail servers. Often these are compromised machines - such as insecure servers or virus-infected machines. Some common RBLs include Spamhaus (spamhaus.org), Open Relay Database (ordb.org), DSBL (dsbl.org) and SORBS www.sorbs.net.

If you use RBLs to block mail, return a non-delivery-report (NDR) informing the sender why their email was blocked and provide a link to the RBL so they can check why their server is listed and get it delisted. Also provide a disposable email address that the sender can use to contact you if they think they have been incorrectly blocked - that way you won't miss important legitimate emails.

The second approach is to filter incoming email using a software package or service. Generally, this uses a statistical rating (Bayesian analysis) to detect and flag likely spam.

There are commercial packages (such as MailMarshall) or services (such as Death2Spam). Or you can use an open-source package such as SpamAssassin.

Email flagged as spam can be diverted to a spam folder which you can check periodically to ensure that no good messages have been incorrectly flagged. Be careful if your filter adds a tag - eg [Spam] - to your subject line. Don't reply to customers' emails that have been incorrectly flagged as spam without removing the [Spam] tag first. It's not good for customer relations.

For more information check out spamhelp.org or samspade.org.

Mark Evans runs Techtelligence, a consultancy specialising in ICT, internet and media strategy, research and communications. mark@techtelligence.co.nz