Taking the Blame

spammers using my domain in reply-to address

[mimerim]

spammers are using my domain as their reply to email address. consequently, i'm receiving the bounce-backs on bad addresses as well as complaints from people thinking i'm the spammer.

i'm not sure if the addresses the spammers are using are being harvested or guessed because they are general addresses such as [e-mail] and [e-mail].

has anyone else experienced this? is there anything i can do?

[dmorison]

has anyone else experienced this?

Yes. It's called being "Joe Jobbed". I think because the first documented case of a spammer doing this happened to a guy called Joe.

is there anything i can do?

Very little i'm afraid.

I have put a message in the whois record of the domain that is used stating:

If you are investigating SPAM, please see [mydomain.com...]

On that page is something along the lines of the following:

Recently, a spate of UCE (Unsolicited Commercial Email) messages, or "SPAM", generally advertising herbal health products have been delivered to numerous recipients, with a from or reply-to address containing [e-mail].

Please understand that the from or reply-to addresses contained within a SPAM email are meaningless. They are not required by the Internet's email delivery systems, and are routinely forged by the spammer, not so much in order to conceal their identity (since you have to be able to buy a product from them), but to avoid the huge number of delivery-failure reports and abuse complaints which, in this case, are now instead swamping my email account.

If you are interested in tracking the perpetrator of any SPAM email you have received, the Internet search engine Google can help you find a number of resources with information about finding out who has really sent you SPAM. Try this search.

I mean you can go investigating if you want, but I doubt you'll get very far. Just hope that whoever is doing this is going through domains (so as not to annoy any one domain owner too much) rather than sticking with one.

Welcome to the club :)

[mimerim]

phooey. :/
but thanks. do you mind if i copy that message for use on my site?

... nevermind, i wrote my own. thanks for the inspiration though. :)

[dmorison]

No worries - the main reason I posted the whole text was so that people could use it if they want.

[bird]

This kind of text has actually become rather pointless by now. If you have a domain that gets spam sent to, then it also gets used in the fake return addresses. Some outfits will just randomly rotate usernames and domains.

I used to be worried about that prospect as well, but over the last few months I have seen more than a thousand spam bounces arrive, and not a single complaint (just one person trying to "unsubscribe"). Either people just don't care to complain anymore, or everybody has realized that the From: address is meaningless. It will be interesting to see what the new legislation in the US will have for an effect on that.

[cornwall]

>>I used to be worried about that prospect as well, but over the last few months I have seen more than a thousand spam bounces arrive, and not a single complaint <<

That is about the sum total of it. I have been through the same thing too. When one of my email addresses was being "rotated" by the spammers, I got the round 1000 bounced back (think they were viruses to boot)

As with Bird, I got very little response from the world at large - in my case I got one not exactly complaint, but a very polite email asking if it really was me spamming!

So bottom line, keep your head down for a couple of days and uit will go away eventually

[keyplyr]

Shortly after moving my site to a new host 2 years ago (they were real new also) a SPAMMER used my_domain.com as their From address. One of the irritated recipients used SpamCop to automate a complaint to my host, resulting in an overly zealous tech wiping my site from their server - without even as much as a notification. Took 4 days to get my site back up and instead of an apology (for unknown lost revenue, reputation, etc) all I got was a lecture on SPAM. I don't know if they ever did understand that I was not the perpetrator.

[annej]

I'm so relieved to see this is a common problem. I notified my host company that is was being done with my domain name and was told there wasn't much I could do about it. At least they know it isn't me doing the spamming. It's frustrating to have to just let it go though. Even if people don't complain it hurts my good name. <sigh>

[dragonlady7]

[belps.freewebsites.com...]

The really, really amusing saga of a webmaster whose domain was forged, who tracked down the spammers, found their personal computers, copied their hard drives, and posted their ICQ logs and embarrassing nude self-portraits (and home addresses) on his website.

Amusing. Almost but not quite wrong, but funny nevertheless. I found it when I was in the midst of a spam deluge and the revenge fantasies kept me going until I could kill that email address and start over. :-)

I can't offer any help, but there's some amusement, at least.

[aroach]

I am having this probelm too. It's so bad that I'm getting hundreds of bounced mails a day and have been put on some of the blacklists even though I have never sent a piece of spam in my life.

How does one add a message to the whois information?

[dmorison]

How does one add a message to the whois information?

You just have to make it part of either the registrant name or address. You should be able to do this through the registrar (or re-seller) with whom you registered your domain name.

eg:

Registrant:

If you are investigating SPAM, please see [megacorp.com...]
Megacorp Inc.
One Big Avenue
Big Town