Search Index

Kryten - Get that spammer!

Sam Spade

Obfuscated URL`s

A lot of spam includes pointers to web sites. Often the URL is obfuscated in a variety of ways - by using %-encoded characters, bogus authentication information, IP addresses written in strange ways. This tool will decode any legal URL, showing you how it was obfuscated, what the real URL looks like and who hosts the web site

Safe web browser

This is a secure webbrowser. It doesn't pass any information about you, it won't accept cookies, it won't run any JavaScript, any ActiveX or Java applets. It won't even reveal the IP address you're connecting from. Enter a URL, such as http://samspade.org/ssw/ into the box and hit the Browse-button. You'll see the raw http response from the server. Any links, redirects or frames in the original webpage will be shown as active links. Some interesting constructs in the web page will be highlighted. The downsides are that some (but very few) web sites will refuse to show you any content without a cookie - and there's no way to accept a cookie, the HTML isn't parsed particularly carefully, so some links may not be active, and authentication isn't supported yet

Reverse DNS

enter anything like www.whatever.com, whatever.com, or an IP address, but nót http://www.whatever.com

This tool checks the reverse DNS for the 256 addresses surrounding the one you're looking at. It shows the hostname claimed for each address (if any) and checks for forged and bogus reverse DNS (if reverse DNS gives a hostname which doesn't exist, it's considered bogus. If the hostname does exist, but doesn't resolve to the original IP address it's considered forged)

Traceroute

enter anything like www.whatever.com, whatever.com, or an IP address, but nót http://www.whatever.com

Traceroute shows the route packets take from the host (samspade.org) to the host you're looking at. Each hop shows the hostname (or the IP address if there's no reverse DNS), the IP address of the system, the AS number of the system, and the round-trip time from samspade.org to the system. The AS number identifies the owner of the network neighbourhood the system is in. Following the AS number link will give contact information for the owner of that block of addresses - the system itself may be a customer of the block owner

Whois

enter anything like http://www.whatever.com, www.whatever.com, whatever.com, but nót an IP address (except for Assigned IP addresses - whois.arin.net)

The whois tool asks a question to a whois server. You usually need to pick the right whois server to ask your question: whois.nic.fr only knows about french domains, and whois.internic.net knows just com, net, org, edu, and gov domains, a larger list of WHOIS servers can be found here

Dejanews author search

enter full name or e-mail adress

This is just a canned search of the dejanews database of the past several years of usenet posts. All dejanews disclaimers apply (specifically the dejanews search engine sometimes has a bad day, and finds posts by an author in groups they've never posted too - if the post itself doesn't show up, it didn't really happen. Also anything posted with an 'X-No-Archive: yes' header will not be listed at dejanews, nor will cancels, most usenet spam and some binaries. Posts are sometimes forged, either as random vandalism or targetted harassment. Treat the results from this search with some caution)

Third-party relay

enter anything like whatever.com, but nót http://www.whatever.com, www.whatever.com, or an IP address

This tool will attempt to send e-mail from samspade.org, to a server and back to samspade.org. This tries to check whether the server may have relayed an e-mail you've received, or whether it must have been sent by an authorised user. Don't use this tool on a server unless you administer the server, or have received e-mail you suspect may have been relayed through that server without permission

Blackhole list check

enter anything like www.whatever.com, whatever.com, but nót http://www.whatever.com, or an IP address

This queries several blackhole lists to see if the server is listed . 'MAPS Realtime Blackhole List' is a conservative list, containing sites that are actively supporting UBE senders or are aggressively indifferent to doing so. 'MAPS Dialup Users List' is a list of addresses belonging to dynamically allocated dialup modem pools. Blocking e-mail sent directly from these users blocks a lot of senders of UBE, and affects almost no legitimate users. 'Open Relay B System', the short answer: "ORBS is a database of open mail relays, accessable via DNS lookup". Not the whole truth, but a good first approximation

DNS query

enter anything like whatever.com, but nót http://www.whatever.com, or www.whatever.com

This tool lets you ask the domain name system about a domain name or IP address. Some useful queries are: MX (the servers that handle e-mail for the domain), NS (the authorative nameservers for the domain), SOA (who is responsible for the zones DNS configuration, or, in the case of an IP address, who's responsible for reverse DNS), ANY (all information known about a domain by the Sam Spade nameserver, this isn't all information about the domain. If you're looking for a specific record type, query that type specifically )