Date: Sun, 24 Jul 2005 10:20:49 -0400 From: Louis LeBlanc <FreeBSD@keyslapper.net> To: freebsd-questions@freebsd.org Subject: Re: [OT Re: SPAM Problem] Message-ID: <20050724142049.GA50696@keyslapper.net> In-Reply-To: <42E2DCAC.3060700@grokking.org> References: <200507231237.44829.bulk_mail@siegel-tech.net> <42E2DCAC.3060700@grokking.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--qDbXVdCdHGoSgWSk
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On 07/23/05 05:11 PM, Greg Maruszeczka sat at the `puter and typed:
> Aaron Siegel wrote:
> > Hello
> >=20
> > This message is off topic but I was not sure were else I can go to get =
help=20
> > with my problem. For the past week I have been receiving messages from=
=20
> > various mail servers which have bounced messages I have not sent but ha=
ve my=20
> > email address as the originator of the bounced message. I believe there=
are=20
> > some SPAMers using my email address on their SPAM. I would really like =
to=20
> > avoid changing my domain name. Has anyone experienced this problem? Is=
there=20
> > something I can do? =20
> >=20
>=20
> It's probably "blowback" resulting from the activities of worm-infected
> windows hosts. Someone you correspond with got infected and the worm
> subsequently propagated itself by picking your name from their address
> book and inserting it into the from: header of the message carrying the
> worm. Then, badly configured MTAs send "helpful" NDRs to the "sender"
> informing them that they're messages couldn't be delivered
>=20
> Pretty routine, really.
Sorry I missed the OP, but this is something pretty much everyone sees
at one time or another. I got to the point where I was receiving
around 200/day before I started seeing myself in Joe-Jobs. Basically,
they want a shot at getting through those servers that simply require
a valid email address in the From: header.
I find it ridiculous that these mail servers simply bounce it to that
address rather than simply interpreting the headers and sending it
back to abuse/postman/admin at the originating relay. This would certainly
bring it to the attention of the very few people with the ability to
stop the email coming.
In the meantime, I'm afraid there's not much you can do unless you
want to track that relay down yourself. Even if you find it, most
times it's out of your reach (different country, etc). And if you do
find it and it's coming from the next town over, it's not like the
authories will want to convict anyone of identity theft - they still
tend to go for the low hanging fruit, so best case scenario is you can
get the ISP to shut them down until they find another provider. Maybe
(big maybe) the ISP will sue them, but you don't get anything for your
effort but the satisfaction that they got burned.
I eventually shut down the domain I was getting so much spam at. I
recently turned it back on after 6 months of downtime and immediately
started getting over 40/day. Looks like some spammers never pare down
the lists they sell. The only thing you can really do is install spam
filters (like ports/mail/p5-Mail-SpamAssassin) so you don't have to
look at it. Just make sure your address isn't whitelisted.
Lou
--=20
Louis LeBlanc FreeBSD-at-keyslapper-DOT-net
Fully Funded Hobbyist, KeySlapper Extrordinaire :)
Please send off-list email to: leblanc at keyslapper d.t net
Key fingerprint =3D C5E7 4762 F071 CE3B ED51 4FB8 AF85 A2FE 80C8 D9A2
I do desire we may be better strangers.
-- William Shakespeare, "As You Like It"
--qDbXVdCdHGoSgWSk
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (FreeBSD)
iD8DBQFC46PBr4Wi/oDI2aIRAgzsAJ40+kGLkRGmbZivIs7lhLXAHD2jwACdFxha
OjABIzYydrlUyEnWwLrhMck=
=GDT+
-----END PGP SIGNATURE-----
--qDbXVdCdHGoSgWSk--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050724142049.GA50696>