Dealing with 'undeliverable mail returns'.

[pauladev]

Recently I have received a huge number of 'undeliverable mail' returns to two of my domain addresses, but all returned to random letters[at]thedomain which I use, rather than to the usual mailbox address. I assume this means that someone is sending out huge amounts of spam and quoting my domain as a return address ie hijacking it.

The questions I have are: a) What did I do to attract this attention? These are small personal mail domains. Anyone can find a domain name and then how is it possible to use this as a return address, or make it look as if mail is coming from this domain?

b)What can I do about it? I use Mailwasher Pro, and cannot think of a way to configure a rule so that all these returns are automatically deleted and do not have to be manually viewed and deleted by me.

c) The logical end to this is that my domain names will be blacklisted by someone else for apparently sending this drivel. How can I prevent this?

I did search this forum for similar but couldn't locate the subject so grateful for some explanation and pointers.

Paul

[Wazoo]

No idea how you "could find nothing" nothing on this subject. Zillions of posts exist.

On the other hand, this was posted into the section identified as the How to use ... place for tutorials, instructions, etc .... SpamCop Discussion > Discussions & Observations > How to use .... > SpamCop Forum

I see nothing in this post about How to Use the SpamCop.net Forum .. so moving it to the Lounge area, where in fact, you should be able to find many other existing Topics and Discussions started by ther folks having the same question/problem.

Magic words include ....

Misdirected Bounces

Forged From: / Reply-To: addresses

Catch-All account

SpamCop FAQ here even includes an entry titled Why am I getting all these Bounces?

[pauladev]

No idea how you "could find nothing" nothing on this subject. Zillions of posts exist.

Sorry about that - I probably didn't choose the exact search term that would succeed. It's so hard to think of the correct 'Magic words' this early in the year! And I naively used the incorrect forum because I thought I wanted to find out 'How to' deal with the problem. My fault for not digesting the terms of use of the 'How to use..' forum. I guess you can tell from the number of posts I have made that I am still a tadpole.

Thank you for pointing me to the correct posts, and while there were not 'zillions', there were certainly more than enough for me to read in several long sessions at the computer. I have most of the answers I wanted, although being a beginner, I still can't understand the way to create a 'rule' that will stop this type of returned mail reaching my mailwasher screen without auto-deleting.

I particularly was attracted to the entry which finally sorted out a simple reply to add when returning these 'undeliverables' at http://forum.spamcop.net/forums/index.php?...amp;#entry40286

Please excuse my ignorance on technical matters - I only want to reduce spam, but since I have been reporting it has increased 100 fold!

[StevenUnderwood]

Sorry about that - I probably didn't choose the exact search term that would succeed. (I just tried entering 'Why am I getting all these Bounces?' in the FAQ Forum with no result!) It's so hard to think of the correct 'Magic words' this early in the year! And I naively used the incorrect forum because I thought I wanted to find out 'How to' deal with the problem. My fault for not digesting the terms of use of the 'How to use..' forum. I guess you can tell from the number of posts I have made that I am still a tadpole.

Thank you for this reply in particular. This is the type of information (why you chose a specific forum, etc.) we keep trying to collect to improve these forums.

[mieu11]

Hi

I apologise in advance if this is the wrong place to post this question - but I am new here. I run an online lingerie boutique and in the last couple of weeks I have received literally hundreds of returned emails via my "catchall address" that have my domain name with what looks like a randomly generated set of letters in front of the domain name, for instance... gzqvjd[at]ever-so-sexy.com <gzqvjd[at]ever-so-sexy.com>

I thought I would report it to spamcop but then I thought what if spamcop thought it was me sending this rubbish so I stopped at that point and logged on here. Here (at the bottom) is a copy of the source data of one of these emails but not being an expert on these things, I am not at all sure if it can be seen in this source that I did not send the email and I do not want to report myself for something I did not do.

Can anyone please advise if I should report this and if anything can be done to stop these mails because by the number of returns received I am guessing that the guilty party is flooding other email boxes with rubbish that looks like it come from me.

Thanks in advance for any help.

Mieu

Received-SPF: Neutral (lsean.ezweb.ne.jp: 194.25.143.139 is neither permitted nor denied by domain of ever-so-sexy.com) client-ip=194.25.143.139; envelope-from=<gzqvjd[at]ever-so-sexy.com>; helo=gvokzg;

Received: from gvokzg (unknown [194.25.143.139])

by lsean.ezweb.ne.jp (EZweb Mail) with SMTP id AA9BE4D

for <ninorover[at]ezweb.ne.jp>; Sat, 6 Jan 2007 01:06:16 +0900 (JST)

Received: from eeu ([211.59.189.51])

by gvokzg (8.13.1/8.13.1) with SMTP id l05GAUR7017178;

Fri, 5 Jan 2007 17:10:30 +0100

Message-ID: <459E7777.2040903[at]ever-so-sexy.com>

Date: Fri, 5 Jan 2007 17:06:15 +0100

From: Emilia Lane <gzqvjd[at]ever-so-sexy.com>

User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)

MIME-Version: 1.0

To: ninorover[at]ezweb.ne.jp

Subject: platitude anyway

Content-Type: multipart/related;

boundary="------------060604060103060504080701"

X-SPF-AUTH: Neutral (lsean.ezweb.ne.jp: 194.25.143.139 is neither permitted nor denied by domain of ever-so-sexy.com) client-ip=194.25.143.139; envelope-from=<gzqvjd[at]ever-so-sexy.com>; helo=gvokzg; domain=ever-so-sexy.com; txt=v=spf1 ; auth=v1;

--------------060604060103060504080701

Content-Type: text/html; charset=ISO-8859-1

Content-Transfer-Encoding: 7bit

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>

<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">

</head>

<body bgcolor="#ffffff" text="#000000">

<img alt="lecturer" src="cid:part1.02030604.05000506[at]ever-so-sexy.com"

height="309" width="455"><br>

She had a long list of things to purchase, ranging from candy to socks

to the newest addition of Strange Creatures You Never Knew Existed.<br>

i don't know that im ready to go back to tallahassee and the daily

grind. See also: Questions to ask to check comprehension; tips to help

struggling readers; excellent tips and strategies to support readers.

Our teachers hate the schedule, but what can they do? and i want my

actions to be apperciated the way i apperciate everyone elses doings. I

did end up saying something to both those girls. Like September 12,

October 17, or even August 23, I'm probably not going to forget it

without some massive head trauma.<br>

a super dry spoof of american idol.<br>

Reconnect a bit to friends who I've had all along but am not able to see

often enough. He finishes up with the band December 31st.

entryHeaderSubject, . de repente vino una sirvienta y se resbalo y callo

entre los bazos de fernando y lety vio esto y se puso celosa! We ended

up at a river, sitting on a gigantic bridge.<br>

tal and amy spent new years with us, even though we both had to work.

I'll just need a notebook. It ain't perfect, but it's how I roll. When

are you both free?<br>

</body>

</html>

--------------060604060103060504080701

Content-Type: image/gif;

name="snobby.gif"

Content-Transfer-Encoding: base64

Content-ID: <part1.02030604.05000506[at]ever-so-sexy.com>

Content-Disposition: inline;

filename="snobby.gif"

R0lGODdhxwFqAfUTAAUnCSskDTYZHQcMPvpvfUfRqXWzrrGMkdaKqkbUxYTkkGGikYxghr/97XuJ

<snipped>

2LzHU03OpEFRiEVcsoFRX51XvS1dgrXcnvnaxjXdkAFcyAXdfvjHlpFZYBiig10Q0LRW2P2GzHHK

erUdkKVW3P3MIAAAOw==

--------------060604060103060504080701--

[Wazoo]

I apologise in advance if this is the wrong place to post this question - but I am new here. I run an online lingerie boutique and in the last couple of weeks I have received literally hundreds of returned emails via my "catchall address" that have my domain name with what looks like a randomly generated set of letters in front of the domain name, for instance... gzqvjd[at]ever-so-sexy.com <gzqvjd[at]ever-so-sexy.com>

I thought I would report it to spamcop but then I thought what if spamcop thought it was me sending this rubbish so I stopped at that point and logged on here. Here (at the bottom) is a copy of the source data of one of these emails but not being an expert on these things, I am not at all sure if it can be seen in this source that I did not send the email and I do not want to report myself for something I did not do.

Due to the 'content', the 'new user' description, etc. ... merged this 'new' Topic into another also recently opened up .... as seen in the above, the post was edited quite a bit to remove the un-needed data 'here' ...

As far as Reporting, please see the SpamCop FAQ here for the link to Rules, Everyone read .. yes, Mis-Directed spam is reportable. However, the parsing & reporting results and the reports that go out are part of your responsibility .... specifically, SpamCop.net would not report you/your ISP ... if that were to actually happen, it would be because you chose to select thos reports to go out to that address ... which would mean that you hadn't actually checked the results and noticed that something had gone wrong in the parsing process.

PM sent to advise of the move/merge of this 'new' post .....

[pauladev]

Thank you for this reply in particular.

I tried to follow the suggestion of reporting misdirected spam, and also attached this note to a reply:-

"You have sent me a spam because my email address was forged by a spammer in the return path. Please do not send me spam. I report all spam to Spamcop.

Here is a useful link that your postmaster might find enlightening;

http://www.spamcop.net/fom-serve/cache/329...l#bounces"

However I have been unable to deliver even ONE of these replies which are all bounced back to me immediately. Today the situation is worse and I have had about 50 'returned undeliverable etc mails to random addresses at my domain names. All are coming back from odd ISP's that I have never heard of, so maybe the Big Boys are dealing with this correctly. Is there anything else I can do to prevent the mail coming into my Mailwasher page. I asked for some clue as to appropriate filters, so as the genuine mail to my main address gets through, and the asxnhu[at]domainname.com does not. Any suggestions?

[StevenUnderwood]

However I have been unable to deliver even ONE of these replies which are all bounced back to me immediately. Today the situation is worse and I have had about 50 'returned undeliverable etc mails to random addresses at my domain names. All are coming back from odd ISP's that I have never heard of, so maybe the Big Boys are dealing with this correctly. Is there anything else I can do to prevent the mail coming into my Mailwasher page. I asked for some clue as to appropriate filters, so as the genuine mail to my main address gets through, and the asxnhu[at]domainname.com does not. Any suggestions?

How are you preparing these reports? Are you using spamcop to send them?

[Wazoo]

First item (also relating to a new Topic at Change Name of "How To" Forum? ..) Does the current display help?

Second item .... I believe that the SpamCop.net functions and actions need to be separated out from the MailWasher actions involved in this discussion.

MailWasher has a 'bounce' finction that has lng been described as simply "bad" ..... for a number of reasons.

MaulWasher has also added a "report to/via SpamCop.net' function along the way. There are configuration issues involved, user actions involved, etc. that would need to be described/defined if they are going to be included in this "try to fix the problem" sequence. And to the best of my knowledge, none of the Moderators use MailWasher .. it is known that there are a number of folks that do (evidenced by queries from folks trying to get it to work) ... but again, this is really a separate finction from the services provided directly by SpamCop.net ....

However I have been unable to deliver even ONE of these replies which are all bounced back to me immediately.

Ths item, for example, has a bit of mystery about it. A 'bounce' from the SpamCop.net reporting system doesn't sound correct at all, so the appearance is that the 'immediate bounce' is actually something caused by a MailWasher function/action .... but ???? working in the blind here ...

Today the situation is worse and I have had about 50 'returned undeliverable etc mails to random addresses at my domain names.

Not to go in the wrong direction, but 50 bad e-mails would be almost a blessing to some, where a lot of folks talk about the thousands of bad e-mails coming in .... but, you have said nothing yet about your handling of the apparent 'catch-all' account configuration of your incoming InBox/e-mail server ....

[2bits]

Please excuse my ignorance on technical matters - I only want to reduce spam, but since I have been reporting it has increased 100 fold!

That's the same as for me.

spam was an irritation , 4-5 per day, but since using Spamcop and reporting spam the volume has increased dramatically and the type has changed.

It has now mostly changed from pills & patches junk to non delivered mail with a random 3-4 character ' name' [at]mydomain

So the 'mail from' address has been forged

In my case I can simply bulk delete or reject the junk 'undeliverables' but is there a benefit in reporting it as it does take time ?

and is there a benefit in reporting when you see an IP 'already sent to relay testers' or is that causing unwanted work for a network support guy

and a query - does mail get put into 'Held mail' when it includes an IP 'already sent to relay testers'

Finally - does reporting spam cause more spam ? Not believing in coincidence it would appear to.

I might stop reporting and see what happens

[pauladev]

Not to go in the wrong direction, but 50 bad e-mails would be almost a blessing to some, where a lot of folks talk about the thousands of bad e-mails coming in .... but, you have said nothing yet about your handling of the apparent 'catch-all' account configuration of your incoming InBox/e-mail server ....

You've lost me there - 'Catch-all'!!! I am tending in the direction of 2bits and giving up Spamcop - it costs me far more time and stress than simply filtering or bouncing everything from Mailwasher, which I rate as a really excellent program. I may let you know (under a pseudonym) if ceasing to report to Spamcop results in less spam!!

[StevenUnderwood]

You've lost me there - 'Catch-all'!!! I am tending in the direction of 2bits and giving up Spamcop - it costs me far more time and stress than simply filtering or bouncing everything from Mailwasher, which I rate as a really excellent program. I may let you know (under a pseudonym) if ceasing to report to Spamcop results in less spam!!

A catch all means anything[at]yourdomain ends up being delivered. You may or may not have one.

Please be careful with mailwasher's bounce function. If you use it, you are effectively spamming the people whose addresses are forged in the sending information of the messages you bounce, including spamtrap addresses (causing listings around the internet). Those bounces are also reportable through spamcop and could get your IP on the scbl. It will be causing the same problem for someone else that started this thread, misdirected non-deliverable messages.

[pauladev]

A catch all means anything[at]yourdomain ends up being delivered. You may or may not have one.

Please be careful with mailwasher's bounce function. If you use it, you are effectively spamming the people whose addresses are forged in the sending information of the messages you bounce, including spamtrap addresses (causing listings around the internet). Those bounces are also reportable through spamcop and could get your IP on the scbl. It will be causing the same problem for someone else that started this thread, misdirected non-deliverable messages.

Thanks for the clarification - I hadn't realised the implications of bouncing mail in this fashion, as until I started getting this problem, I was not aware which addresses were innocent.

BTW I still can't understand WHY people go to such lengths to annoy others, when there doesn't seem to be any possibility of financial gain, and the time and trouble to do this must be considerable. Is it a modern take on graffiti?

[StevenUnderwood]

BTW I still can't understand WHY people go to such lengths to annoy others, when there doesn't seem to be any possibility of financial gain, and the time and trouble to do this must be considerable. Is it a modern take on graffiti?

You would think there is no financial gain, but someone is likely making money, otherwise, it would seem the cycle would end. If a spammer gets even one person to order something, that is likely enough profit (probably no product is shipped, and the majority of the bandwidth is stolen meaning little output) to keep going. You send out enough messages, sooner or later you will find someone willing to "take a chance".

[2bits]

I am tending in the direction of 2bits and giving up Spamcop

I didn't think I said I was giving up Spamcop just reporting

I think the Spamcop idea is great !!

Yes there's a but..

Its a learning curve thing

On the preferences tab on http://mailsc.spamcop.net under ' Report Handing Options ' then ' spam munging '

it's clear that spammers CAN get your address when you report spam.

Newbies like me need to realise the implications of reporting spam, and maybe have it spelt out, else its a steep curve with possibly more spam on the route.

What about making the default reporting options 'safer' ?

I've just changed my reporting settings so will see what happens next..

I'm probably still on the curve.... and not giving up

[StevenUnderwood]

What about making the default reporting options 'safer' ?

I've just changed my reporting settings so will see what happens next..

spam Munging

Obscure identifying information

Leave spam copies intact

Become a "mole" - Don't even send reports (mostly pointless)

When I signed up several years ago, the default was Obscure identifying information.

Out of interest, what did you set your reporting settings to?

FYI, I have left the setting as unmunged for the last few years with no marked increase or decrease in the amount of spam received. That number is constantly rising and falling both on the accounts I report and those I delete.

[2bits]

spam Munging

Obscure identifying information

Leave spam copies intact

Become a "mole" - Don't even send reports (mostly pointless)

When I signed up several years ago, the default was Obscure identifying information.

Out of interest, what did you set your reporting settings to?

FYI, I have left the setting as unmunged for the last few years with no marked increase or decrease in the amount of spam received. That number is constantly rising and falling both on the accounts I report and those I delete.

I went underground ..

So will find out what I get there.

I did smile at the ' sending reports . ( mostly pointless.) '

Is it meant to read that way ? and is it true ?

It was also the para two down that I read twice or more

'It has become painfully obvious that spammers are able to identify your email address by using tracking codes - even after SpamCop's attempts to munge them. It has also become plain that even the largest and most well-respected ISPs forward complaints intact to the accused. '

[StevenUnderwood]

I did smile at the ' sending reports . ( mostly pointless.) '

Is it meant to read that way ? and is it true ?

It was also the para two down that I read twice or more

'It has become painfully obvious that spammers are able to identify your email address by using tracking codes - even after SpamCop's attempts to munge them. It has also become plain that even the largest and most well-respected ISPs forward complaints intact to the accused. '

Yes, it is meant as read. The last line in the paragraph is the last offical word I have seen. "These reports are not emailed and are not available to anyone but SpamCop administrators and will not be shared (except as aggregate counts)."

[Miss Betsy]

You've lost me there - 'Catch-all'!!! I am tending in the direction of 2bits and giving up Spamcop - it costs me far more time and stress than simply filtering or bouncing everything from Mailwasher, which I rate as a really excellent program. I may let you know (under a pseudonym) if ceasing to report to Spamcop results in less spam!!

DO NOT BOUNCE from Mailwasher!!!!! You are then adding to the spam problem for others.

Catch-all is an account on your domain where all emails go whether valid or not. Most people have found that the overwhelming majority of the emails coming to the catchall account are spam and that mistyped email addresses are not worth contending with the spam. I am not sure but I think that if you turn off the catchall, mistyped addresses are rejected at the server (or can't be sent - that's true for me, anyway).

There is a topic where several people experimented with reporting and not reporting to see if it made a difference. IIRC, there were no conclusive results. Summary of unscientific opinions on why spam increases and decreases and subject lines change: spam comes in waves; once your email address is picked up by a spammer, it is added to other spammer lists; spammers both remove and add email addresses from spamcop reports to lists and unscientifically, it seems to even out - you get removed from some, but added to about as many others.

Again, DO NOT BOUNCE from Mailwasher!!!! You become part of the spam problem for others.

Miss Betsy

I didn't think I said I was giving up Spamcop just reporting

I think the Spamcop idea is great !!

Yes there's a but..

I<snip>

If you have a spamcop email account, it is to your advantage to report spam (and not as a mole). You can tweak your filtering so that almost all spam goes to held mail. Also, reporting as many of the most recent spam (either those that get by spamassassin or in your held mail folder) as is convenient for you is the most beneficial reporting for everyone.

If you don't have a spamcop email account, the reporting of the most recent is still beneficial to those who do use the spamcop blocklist (including all those who use Mailwasher).

Miss Betsy

[2bits]

If you have a spamcop email account, it is to your advantage to report spam (and not as a mole). You can tweak your filtering so that almost all spam goes to held mail. Also, reporting as many of the most recent spam (either those that get by spamassassin or in your held mail folder) as is convenient for you is the most beneficial reporting for everyone.

As a newbie it would be nice if you can suggest ideas on how to tweak my filtering as I have looked and not yet worked it out.

But as far as reporting is concerned, as a mole I understand Spamcop still gets the benefit of having spam that gets through the spam filters reported to them but the ISP just doesn't get told.

Again as Spamcop says in the reporting preferences setup

'It has also become plain that even the largest and most well-respected ISPs forward complaints intact to the accused.'

And I think it is for this reason that since starting using Spamcop and reporting that my spam has increased and I was spending LOTS more time dealing with it.

I started using Spamcop to reduce spam and that just wasn't happening.

[Miss Betsy]

As a newbie it would be nice if you can suggest ideas on how to tweak my filtering as I have looked and not yet worked it out.

But as far as reporting is concerned, as a mole I understand Spamcop still gets the benefit of having spam that gets through the spam filters reported to them but the ISP just doesn't get told.

<snip>

I don't have a spamcop email account - if you want to learn about tweaking filters, I think there might be something in the 'How to' or 'Instruction' forum. You might also look in the email help forum.

Mole reports don't go anywhere. At one time, I think they did contribute to the blocklist, I don't think they do any more. They are counted and if anyone uses that statistic, I am not aware of it. The only thing I know is that a couple of ISPs came to the forum to ask what the aggregate reports meant and how to turn them off.

And I think it is for this reason that since starting using Spamcop and reporting that my spam has increased and I was spending LOTS more time dealing with it.

I started using Spamcop to reduce spam and that just wasn't happening.

Once your email address is on spammers' lists, there is no way to reduce spam. One can filter it (that's the purpose of the spamcop email account). There are lots of filters around. Some people swear by Mailwasher (but if you do use Mailwasher, do NOT use the bounce function).

If you are able to, the best way to get rid of spam is to create a new email address with numeric characters in it so that the dictionary spammers don't get it - 2bits is good; 2b1t5 is better, and then be very careful who it is sent to. It would be best to even avoid friends who don't understand about viruses. I am positive that I am getting spam now because of a round of a virus. My email address is not published anywhere on the web. I don't use it to purchase items. And the spam started right after the viruses.

You only need to spend as much time as you want to in reporting. Reporting does not reduce spam. It is the addition of that IP address to the spamcop blocklist that filters the spam to held meail that reduces the spam you see in your inbox.

Miss Betsy

[combi]

Hi,

Our domain (combitel.com.au) is being faked to send spam and we are receiving bounce backs. One of the IP addresses reported to us by a spam filter tunrs out to be reserved by the IANA for future use and another one, which appears in an e-mail header comes up as DoD network Information Centre after a whois search.

Please help me stop this.

Thanks

[Farelf]

Moved from reporting help (since SC reporting does not appear to be the issue), merged with existing topic and PM sent.

Welcome combi - could you review the previous posts in this topic, the suggested FAQs and so on, and get back with any further questions/comments you might have? "We" can't make the misdirected bounces go away but there are people "here" who have been in your situation and may be able to offer suggestions if the previous posts and stock resources don't quite fit your situation.

[2bits]

Once your email address is on spammers' lists, there is no way to reduce spam.

Since stopping reporting spam , except to spamcop, undeliverable mail spam has reduced dramatically.

As it only started after I stated reporting so it seems to at least contribute as cause and effect.

I don't need to change addresses as the spam has mostly been coming to the catchall account. It just the domain that's forged, mostly they don't have a correct address, just 3-4 characters[at]mydomain

I understand about IP addresses and blocking which is why I carried on reporting to spamcop

Also got a mail back from an mail administrator who Spamcop mailed about possible spam based on a report.

It seems this was a false positive and that their addy had been forged. At least I think its real mail but so many forgeries not sure

Does anyone know if its any use feeding this back to spamcop and how?

[Miss Betsy]

Since stopping reporting spam , except to spamcop, undeliverable mail spam has reduced dramatically.

As it only started after I stated reporting so it seems to at least contribute as cause and effect.

As I said, there is no way to state scientifically that reporting makes a difference. The reason that the undeliveralbe mail spam has reduced dramatically could very well be that the spammer has started using some other domain in the forged return - usually NDRs don't last very long.

I don't need to change addresses as the spam has mostly been coming to the catchall account. It just the domain that's forged, mostly they don't have a correct address, just 3-4 characters[at]mydomain

That's why many people have turned off the catchall account - another one of those good ideas that have been spoiled by the spammer.

I understand about IP addresses and blocking which is why I carried on reporting to spamcop

Also got a mail back from an mail administrator who Spamcop mailed about possible spam based on a report.

It seems this was a false positive and that their addy had been forged. At least I think its real mail but so many forgeries not sure

Does anyone know if its any use feeding this back to spamcop and how?

If you got an answer back from an admin, then you should not report it. Supposedly there is no way that the source IP can be forged and 'addys' are not reported. You can tell from the headers whether the report was sent to the report address or not. You can 'report' it to spamcop and then read the technical details, and then cancel the report so the report is not sent to find out who sent it. Or post it here and let another poster tell you what they think it says.

Miss Betsy