On comparing the emails, the body content is basically the same. One interesting email header was this

which is not the usual form of the "Message-ID:" header of course. Also noticed one header that doesn't usually appear in emails ..

If you're using Outlook or OUtlook Express, do the following:

Right click the title of the email in the inbox list.

Hit properties.

Go to the Details tab I believe it is, or its a button in some cases.

You'll see an info box with a bunch of gobbledygook in it. That information is where you can get some very interesting information. There you'll notice ip addresses(sometimes displayed with dashes instead of dots), those ip addresses are usually very hard to spoof, but their domain names sometimes don't match up. If that happens, you can bet you now have the ip address of the spammer. To make sure someone hasn't managed to spoof the ip as well, try doing an ip lookup at networksolutions.com or some place that lets you get info on ip addresses. You can then either create a rule to block this ip in your firewall, email client, or call up your mail server to have that ip blocked at the server. If you notice a number of emails all having the same first three sets but different final sets, such as 123.456.1.1 123.456.1.2 123.456.3, then you can block the entire range by having your mail server block out 123.456.1

Thanks, but I deliberately don't use M$ email clients, because there are so many worms, trojans, etc, that are specifically written for M$ email clients, like Outlook,etc. I use Pegasus Mail.

Thanks for the other info, possibly Pegasus has a log, I know the anti-viris tool I use (AVG) keeps a fairly detailed log. In this situation, I can't understand how finding the (correct) IP, and then banning it, even in the email client, will stop the spam, because it all gets delivered to my ISP. At that 'stage', it is too late to close the door. I don't like spam filters, because they can cause legitimate emails to be deleted/lost, I even do have Spam Assasin which I could use, because before the emails hit my ISP, they go through a web server.

I have asked my host about the CPanel feature "Box Trapper", which is basically a white list. They stated in the past, that it had problems, but if it gets going again, that would be ideal really, because it is built into the email server.

There are another 2 this morning, the IP's have always been in different 'blocks', here is the Spamcop report for the 3 yesterday ............

Here is an IP from one yesterday .....

The sub-domain or even the domain don't exist (why would I be surprised), the IP does resolve, but it could be spoofed, as the 'From:' and 'Return-path:' would also be spoofed.

Some news about what SpamCop are ding to cobat spam ....

Thanks for your help,

J

Fighting spam gets very tiring.
I prefer signing up to different places with different email addresses and then just abandoning the spammed ones.

I have a domain name dedicated to this.

Bob: I always wondered who owned kamakazi-spam-fighter....

Yes, good idea. When Yahoo increased their email boxes to 1GB it was a bit annoying, as there is one Yahoo address I have (that spammers have gleaned from yahoo groups,etc) that I wish the box was only about 10 Mb, then if a spammer tries, it bounces back.

I (sort of) do that. Would you mind explaining the method, or if you don't want it public, can you PM me with the details.

At present, I never use my ISP email address, because I never want to have to go through the process of changing everything, if I change ISP's. All I do is to use a domain, and have the emails fowarded to different boxes at the ISP.