(Bounced)Reported emails shown as coming from me... why?

[whitewolf]

I hope this is the right section... I did try to search for an answer, but have a hard time getting through a lot of the jargon.

After getting a warning email from AT&T (my ISP) that they received a report of "suspicious activity" coming from my account, I realized I have inadvertently been reporting myself as sending spam. I then recalled seeing an option in my reports to send to abuse[at]att.net. So, obviously, I just need to remember to uncheck this when sending my reports. Which, admittedly, I tend to overlook once in a while when reporting 12+ spams a day, and have received more than one warning from AT&T. It's a wonder my service hasn't been suspended. ;P

Is there another way to prevent this? it sounds like something configuring my mailhost may resolve, but I may be mistaken.

More importantly, I'm curious as to how/why this happens. I've noticed it happens ONLY when I bounce spam emails, so it's as if they're getting the email back and going, "Screw you, we're gonna spoof your ip and resend it"... not personally, obviously, I'm sure it's a bot that does it as it seems to happen almost immediately after the bounce.

If this is the case, this leads me to yet another question... should I even bother bouncing?

[turetzsr]

I hope this is the right section...

...It appears that it is, yes! <Edit> Based on Don's post, above, it appears that it wasn't. Sorry for the earlier misinformation but it appeared to me to be exactly like problems I've had that were fixed by going through the Mailhosts configuration (or getting a SpamCop Deputy to do something "special")!

I did try to search for an answer, but have a hard time getting through a lot of the jargon.

<snip>

...If you hit some "jargon" you don't understand, please check the SpamCop Glossary. If you can't find the explanation there or what is there is still hard to understand, please post a question to the SpamCop Lounge. But from what you wrote after the above, it seems that you found the information you needed, came to exactly the right conclusions and just posted here to confirm your understanding. <big g>

<snip>

I realized I have inadvertently been reporting myself as sending spam. I then recalled seeing an option in my reports to send to abuse[at]att.net. So, obviously, I just need to remember to uncheck this when sending my reports.

...The SpamCop FAQ article that deals with this is the one labeled "Why does SpamCop want to send a report to my own network administrator?" And, yes, unchecking your e-mail provider's address is one very good way of avoiding this problem! <g>

Is there another way to prevent this? it sounds like something configuring my mailhost may resolve, but I may be mistaken.

...No, I think you've hit on exactly the best solution! Please see the SpamCop FAQ article labeled "How do I configure Mailhosts for SpamCop?" and some of the ones immediately below that in the list. Please note, however, that many large e-mail providers will change their "mailhosts" configuration from time to time and therefore completing the SpamCop Mailhosts configuration may not be a permanent, 100% fix (but is very much encouraged, anyway). That just means that you must continue to review carefully all the e-mail addresses to which the SpamCop parser offers to send complaint reports to be sure that neither your e-mail provider nor your ISP is in the list and, if you find that it is, uncheck it!

<snip>should I even bother bouncing?

...No, you should *never* bounce ... but is that really what you mean? Please correct me if I'm wrong but I think what you may have meant when you wrote "bounce" was "report." A bounce is when an e-mail provider rejects an e-mail and sends a notification back to the sender. If one chooses the "To" address of the spam as the "sender" to whom to send the notice, that bounce may itself be spam because the "To" address is very often a forged innocent third party's address. As to whether you should continue reporting, I believe that you generally should report, as SpamCop is pretty good about not sending complaints to spammers or known spam-friendly addresses; however, if you are concerned that an address to which the parser offers to send your report is the spammer or may convey it to the spammer, then uncheck the box. Even unchecking *all* the boxes and submitting will contribute to the statistics that SpamCop uses to decide whether to place an IP address on its blacklist.

[SpamCopAdmin]

>- seeing an option in my reports to send to abuse[at]att.net.

You need to get into your "Preferences" and permanently remove abuse[at]att.net.

>- sounds like something configuring my mailhost may resolve

This has nothing to do with Mailhosts.

>- happens ONLY when I bounce spam emails

You should NEVER bounce spam. The "From" address on spam is always either fake or forged. The bounce only goes to an innocent bystander who didn't send you any email.

- Don D'Minion - SpamCop Admin -

- Service[at]Admin.SpamCop.net -

[whitewolf]

No, you should *never* bounce ... but is that really what you mean? Please correct me if I'm wrong but I think what you may have meant when you wrote "bounce" was "report." A bounce is when an e-mail provider rejects an e-mail and sends a notification back to the sender. If one chooses the "To" address of the spam as the "sender" to whom to send the notice, that bounce may itself be spam because the "To" address is very often a forged innocent third party's address. As to whether you should continue reporting, I believe that you generally should report, as SpamCop is pretty good about not sending complaints to spammers or known spam-friendly addresses; however, if you are concerned that an address to which the parser offers to send your report is the spammer or may convey it to the spammer, then uncheck the box. Even unchecking *all* the boxes and submitting will contribute to the statistics that SpamCop uses to decide whether to place an IP address on its blacklist.

Yes yes, I use Mailwasher so I can actually choose to bounce emails. I assumed bouncing went back to the origin, no matter who they spoofed. I also figured, hey, if it looks like the email address is no longer valid, maybe spam will stop? I guess it's not a good thing. x_x

Thanks so much for all the info!

[turetzsr]

<snip>

This has nothing to do with Mailhosts.

<snip>

... Well, it darned sure looked as if it were! Thanks for the correction, Don! With this post, I am moving this Topic to the more-appropriate "SpamCop Reporting Help" Forum from the "Mailhost Configuration of your Reporting Account" Forum.

[Farelf]

Yes yes, I use Mailwasher so I can actually choose to bounce emails. I assumed bouncing went back to the origin, no matter who they spoofed. I also figured, hey, if it looks like the email address is no longer valid, maybe spam will stop? I guess it's not a good thing. x_x ...

As has been said (learn to trust Don), Mailwasher bouncing is a lousy idea for spam and one decried in these pages since Day 1. It turns YOU into a spammer of innocents - in the case of hard-core spam anyway. In time you even see YOUR address as the alleged sender of the stuff (yes, spammers harvest innocent addresses, as may have happened in your case). MW can only "bounce" to the address given.

[michaelanglo]

The "From" address on spam is always either fake or forged.

Not quite true hence the phase "straight up spam".

I recall spam from 'Christian publishers' and a Brazilian senate candidate.

Maybe five in a thousand

I added these to my personal blacklist as with those which are often forged.