Forum Moderators: phranque

Message Too Old, No Replies

Spammers testing my addresses

         

kapow

11:22 am on Feb 10, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I'm seeing a new kind of spam (new to me). It looks like someone is testing for bounce-backs. I get an email with just something like this in the subject:

test f0h1jtri2k5rer489klkhd0r3uil9854gfhii14tgjk2o58ybfw4uo8lmbc2sae4h8ngfju3kncsd5yh

Anyone else seeing this?
Is it bounce tests?
Can they be stopped?

Visit Thailand

11:26 am on Feb 10, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Yep seen about five of these today. Didn't open it in case it was some form of strange new virus.

Conard

12:40 pm on Feb 10, 2003 (gmt 0)

10+ Year Member



I have had several of these in the last couple of days. I bounced them all back.

Marketing Guy

12:54 pm on Feb 10, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I got an email from another webmaster recently telling me about the sins of spamming and to not send him anymore emails.

Not only dont i spam, but i dont have a mailing list and have never sent out any mass mailing in my life! :)

I assume its possible for others to send emails that appear to be from my address, or has my address as the reply to.

Is it possible to prevent this?

Scott

bird

1:02 pm on Feb 10, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



There are two possibilities:

Either a professional spammer is trying to verify your address. In practise, however, I don't think a pro would do this without including some kind of message, be it to actually advertize something, or to inform you that you have now "opted-in" by not unsubscribing.

The other thing to remember is that most "self-service spammers" are terminally stupid. It seems quite likely to me that those messages are simply the result of someone not understanding the super-duper mail blaster software they just bought. Fortunately, most of those software packages generate messages with a characteristic "footprint" in the headers, so they can be bounced without even looking at the content.

curlykarl

1:04 pm on Feb 10, 2003 (gmt 0)

10+ Year Member



Top this one :)

I use multiple domain names but all the emails goto one address.

I have been receiving emails from some spam head from me to me?

I have reported him to his ISP but since I have done that the spam is getting worse, so far today I have had 23 spam emails all from the same nob head, it is sending me wild

but what else can I do?

Zero

CK

bird

1:04 pm on Feb 10, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I assume its possible for others to send emails that appear to be from my address, or has my address as the reply to.

Yes, that's trivial to do.

Is it possible to prevent this?

No, at least not on a technical level. If you have proof of the identity of the real sender, you could try to sue them...

kapow

1:07 pm on Feb 10, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



> they can be bounced without even looking at the content.

HOW DO YOU DO THAT?
I would really like to bounce the 30 other spams I get every day too. We are talking about making it look like your email address is not active right?

I don't bother with the unsubscribe link because it either tells the real spammers I am alive and well or the mail system is down (or was never up).

bird

1:17 pm on Feb 10, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



> they can be bounced without even looking at the content.

HOW DO YOU DO THAT?

You don't expect me to post information here that would help the spammers improve their software, do you? ;)

You'll have to study those headers for a while, and then dip into the relevant RFCs. A basic understanding of statistics also helps. Mix this with lists of well known domain names and IPs, and you'll end up with a very reliable custom spam filter.

Of course, if you're running Windows only, things get a little harder. In that case, I'd recommend another approach, such as checking out spambayes [spambayes.sourceforge.net]. That seems to be the most reliable content based spam filter I am aware of.

curlykarl

1:18 pm on Feb 10, 2003 (gmt 0)

10+ Year Member



[webmasterworld.com...]

Mailwasher

gypsychild

3:02 pm on Feb 10, 2003 (gmt 0)

10+ Year Member



I've been getting the e-mails too - sales@, webmaster@, support@ - basically, anything-you-care-to-name@. None of the addresses correspond with those on my site and some I've never encountered before, so I'm rather inclined to think they may be bounce tests.

I've recently been looking into bouncing back unwanted e-mails and read conflicting reports on whether this is actually effective in reducing/stopping this type of mail.

Receptional Andy

3:06 pm on Feb 10, 2003 (gmt 0)



My guess is the messages are tests of how to get around spam filters using unique text strings in each email. And it got past my 3 stage filtering system.
Curses! Time to add stage 4 I guess...

Receptional Andy

3:31 pm on Feb 19, 2003 (gmt 0)



I'm now getting a new breed of these - subject is random, body text is <random number>test, no replay, please<random number>
It's really infuriating. From the look of the email headers its the same system as the ones mentioned above. Strange though, it appears to get bounced around a host of different free email providers before arriving to me. Latest one from hotmail -> eudora mail -> GMX, then to me.

Anyone else seeing these? If so, any blocking tips?

Marketing Guy

4:20 pm on Feb 19, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I got 2 of those messages today.

In two accounts - webmaster@mydomain.com and webmaster@myotherdomain.com.

Presumeably they are going to create a list of addresses that dont bounce back.

Im not that technical, but would this work:

Create a custom message to appear like (or be identical to) the bounce back message that they would recieve if the email address wasnt active?

That way it could be sent out manaually (or perhaps automatically in some cases) and fool spammers to thinking that the email address was no existent.

I assume that spammers wont manually check bounce backs (too many of them).

Any thoughts?

Scott

Receptional Andy

4:29 pm on Feb 19, 2003 (gmt 0)



Some email services let you bounce a message just by clicking a button. For my home emails I use fastmail.fm which has this feature and I thoroughly recommend.

However, at work I don't have this facility, and your idea is a good one. Basically just compose an undelivered message and send it as the reply?
I guess we could just copy and an existing bounce and reply that way?

I think it would work in most cases, not least for for this reason - not all mail servers process bounces the same way, and so any good spammer would have a system that looks for certain text strings (like 'mail returned' in the emails so as not to be left with loads of useless addresses - you get these in legit emailing software too.

I guess this would have to be done manually though, I'm using Outlook so unless I could get a 'bounce plugin' to add this option to the menu it would be tricky.

The message headers might present a problem. I will have a look at some genuine bounce emails and see how easy they would be to recreate and get back to you. In the meantime, any other spam-fighting suggestions would be apprciated.

These types of messages are pretty damn hard to block with filtering/rules as they come from yahoo addresses and don't have any real unique text to look for.

kapow

1:48 pm on Feb 20, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



From stuff I read here I have just started using 'mail washer' see mailwasher.net.

- You see a list of all mail sitting in your mailbox before you collect it and you can select the emails you want to: bounce and delete.

- It then deletes those emails and sends a bounce.

- Then you collect the remaining mail.

- Mail washer is a separate application (not a plugin) so it doesn't matter what mail client / account you use.

I've only been testing it for a week but is seems really good. And its free :) . I think my spam has reduced already.

bird

7:07 pm on Feb 20, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Strange though, it appears to get bounced around a host of different free email providers before arriving to me. Latest one from hotmail -> eudora mail -> GMX, then to me.

Those headers are fake, and easy to detect automatically. I don't think you'll ever see a legitimate message that lists more than two different popular mail services in its "Received:" headers (or maybe three, if it went through yahoo groups in between).

Receptional Andy

9:42 am on Feb 21, 2003 (gmt 0)



Thanks Bird. I knew the headers were faked (IPs didn't match hostnames) but I guess I wasn't thinking hard enough to realise this was useful ;)

werty

5:49 am on Feb 26, 2003 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



I just used this<edit mail washer> for a catch all on my domain...it has only been up for 10 days maybe and 459 spams...terrible.

i need to turn the catch all feature off on this account