Subject: RE: [Asrg] Some data on the validity of MAIL FROM addresses

From: "Eric D. Williams" <[email-masked]>
Date: Tue, 20 May 2003 22:25:58 -0400

I see major bounce back from spammer addresses - forgery? (this is anecdotal) 
To me this is not unusual.

-e

On Monday, May 19, 2003 9:55 AM, Kee Hinckley [SMTP:[email-masked]] 
wrote:
> At 8:25 PM -0700 5/18/03, Scott Nelson wrote:
> >I would expect that /if/ the majority of return addresses are forged,
> >then the spammer would pick the domain at random from their collection
> >of lists.
>
> As I noted in my mail.  This appears to be happening now--although I
> had not seen symptoms of it before.  Is anyone else starting to see
> low-level occasional bounce back from spam?
>
> Prior to that, all of the bounce-back instances I had heard of or
> experienced (and I used to get one or two a week) were major--where
> the entire spam load got sent out with the same return address.
>
>
> --
> Kee Hinckley
> http://www.messagefire.com/          Junk-Free Email Filtering
> http://commons.somewhere.com/buzz/   Writings on Technology and Society
>
> I'm not sure which upsets me more: that people are so unwilling to accept
> responsibility for their own actions, or that they are so eager to regulate
> everyone else's.
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Wed, 21 May 2003 23:47:08 -0400

> > the entire spam load got sent out with the same return address.

Could this be that spammer tactic where they pair names and forge the
From: to appear to be coming from someone they think you might have
whitelisted?

For those wondering what I'm talking about, consider an RFC with two
(or more) authors' and their e-mail addresses in the text. The spammer
culls this info and sends spam to each author forging the other author
as the From:. So their target lists start to become pairs of addresses
to use as the From/To (one assumes they're usually symmetrical) rather
than just single address. Another example might be forging the From:
to be [email-masked] and sending that to addresses culled from this
list.

This has definitely been going on, although not a lot. In my
experience the victim knew immediately just where the other half of
the pair came from (e.g., a co-author or similar.)

So perhaps the above was just a bad pairing, the other half no longer
is at that address etc.?

Anyhow, even not, informational for someone here no doubt.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 23 May 2003 17:29:45 -0400

>From: to appear to be coming from someone they think you might have

I've seen pairing, although it could just be pairing by domain, 
rather than a database of pairs.

The other thing I've noticed is spam coming in for several users at a 
host, with the subject customized for one of them.  So the spammer is 
doing some limited amount of per-user customization, but rather than 
send 10 messages to a single server, they are sending one message to 
all recipients at that server.  Only one of the recipients gets the 
correct customization.

What I find particularly intriguing about the above was that the 
recipients were per mail *server*, not domain.  In other words, I 
would get a single spam message with multiple recipients, one of whom 
was at hinckley.com, and another at somewhere.com.  The only 
relationship being that they share the same mail server.  So someone 
is pre-sorting their spam database by MX records, and then doing 
form-based mailings to the first recipient for the given MX.  A 
compromise between speed and attractiveness of the message.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society