Injection Point (of spam mail)
The
injection point of
spam mail is the location on the network at which the spam leaves the direct control of the spammer and is passed to an "outside"
mail host over which the spammer has no control. The term is sometimes used in discussions of spam analysis and tracing, as for example in
http://forum.spamcop.net/forums/index.php?s=&showtopic=7127&view=findpost&p=48648∞.
The following two examples cover all but a tiny number of e-mail spams sent these days:
- If the spammer is using an open-relay mail host (i.e., an MTA that accepts mail from anyone for delivery to anyone else), then the IP address of this mail host is considered to be the injection point.
- If the spammer is using direct-to-MX mailing (which bypasses most intermediate relay hosts), then the injection point would be the IP address of the mail exchanger host that serves the recipient.
The significance of the injection point is that it represents the line of demarcation between the realm of the spammer and the rest of the world. The machine or address that initiated the transfer of the spam mail to the injection point is considered to be the
source of the spam by most well-informed spam-analysis tools (such as
SpamCop). The operator of this machine or address is considered to be responsible for having sent the spam, or else for having negligently allowed it to be sent by others.
In the relatively rare event that the spammer sends his mail "normally" (that is, through an outgoing MTA belonging to a service to which he subscribes, and not via the abusive techniques described above), then it is somewhat less clear where the injection point might lie. However, most spam analysts consider the outgoing MTA used by the spammer to be on the "spam" side of the injection point, since this host is part of the spammer's operation for which he has paid or over which he has control.
References:
http://forum.spamcop.net/forums/index.php?s=&showtopic=9621&view=findpost&p=65838∞
CategorySpamCopGlossaryWikiI
CategorySpamCopReporting
There are no comments on this page. [Add comment]