Subject: [Asrg] Note: Active harassment

From: Jim Youll <[email-masked]>
Date: Sun, 13 Apr 2003 21:14:20 -0400

I just wanted to point out that, just like the last time I was 
publicly involved in anti-spamming activities, I'm again seeing that 
messages are going out with my address in the From: field and 
wondered if others are experiencing the same.

The last go-round I had to clear out a few hundred-thousand bounces 
and then deal with the people who thought I was actually the source 
of the mail. I hope this isn't the start of something yet again.

In this example, the message below was a porno ad with some nasty 
embedded images, sent to a non-existent address and then "returned" 
to me.

At 19:25 -0400 4/13/03, Mail Delivery System wrote:
>Return-Path: <MAILER-DAEMON>
>Received: from mg2.xecu.net (mg2.xecu.net [216.127.136.223])
>	by aspirin.media.mit.edu (8.12.8p1/8.12.6) with ESMTP id h3DNQJnj024354
>	for <[email-masked]>; Sun, 13 Apr 2003 19:26:19 -0400
>Received: by mg2.xecu.net (Postfix)
>	id 91FCA3926FC; Sun, 13 Apr 2003 19:25:06 -0400 (EDT)
>Date: Sun, 13 Apr 2003 19:25:06 -0400 (EDT)
>From: [email-masked] (Mail Delivery System)
>Subject: Undelivered Mail Returned to Sender
>To: [email-masked]
>MIME-Version: 1.0
>
>This is the Postfix program at host mg2.xecu.net.
>
>I'm sorry to have to inform you that the message returned
>below could not be delivered to one or more destinations.
>
>For further assistance, please send mail to <postmaster>
>
>If you do so, please include this problem report. You can
>delete your own text from the message returned below.
>
>			The Postfix program
>
><[email-masked]>: unknown user: "[email-masked]"
>
>Content-Description: Delivery error report
>Content-Type: message/delivery-status
>
>Reporting-MTA: dns; mg2.xecu.net
>Arrival-Date: Sun, 13 Apr 2003 19:25:06 -0400 (EDT)
>
>Final-Recipient: rfc822; [email-masked]
>Action: failed
>Status: 5.0.0
>Diagnostic-Code: X-Postfix; unknown user: "[email-masked]"
>
>Received: by mg2.xecu.net (Postfix, from userid 1003)
>	id 8ADE23926E5; Sun, 13 Apr 2003 19:25:06 -0400 (EDT)
>Received: from compuserve.com (srge02-2613.resnet.ubc.ca [142.103.51.60])
>	by mg2.xecu.net (Postfix) with SMTP id 80F8C39250A
>	for <[email-masked]>; Sun, 13 Apr 2003 19:25:05 -0400 (EDT)
>Date: Sun, 13 Apr 2003 22:38:40 +0000
>From: [email-masked]
>Subject: Hi, Agriffis, Nasty Girls Getting Down And Dirty!! 
>Username: downonthefarm, Password: horsespunk!!
>To: Agriffis <[email-masked]>
>References: <[email-masked]>
>In-Reply-To: <[email-masked]>
>Message-ID: <[email-masked]>
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: J C Lawrence <[email-masked]>
Date: Sun, 13 Apr 2003 20:56:11 -0700

On Sun, 13 Apr 2003 21:14:20 -0400 
Jim Youll <[email-masked]> wrote:

> messages are going out with my address in the From: field and wondered
> if others are experiencing the same.

Yup.  Its not common with my address, but I've received the better part
of a third of a million bounces in the last year with a From: of
[email-masked].  

  ObNote: I suspect this was not deliberate.  In the same time,
  frequently for the same spam message quite obviously sent in the same
  run I've received a few million bounces at Kanga.Nu for a stable of
  roughly 130 non-existent addresses (it appears to be
  <random_RHS>@kanga.nu).

-- 
J C Lawrence                
---------(*)                Satan, oscillate my metallic sonatas. 
[email-masked]               He lived as a devil, eh?		  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Chris Lewis" <[email-masked]>
Date: Mon, 14 Apr 2003 22:47:02 -0400

Jim Youll wrote:
> I just wanted to point out that, just like the last time I was publicly 
> involved in anti-spamming activities, I'm again seeing that messages are 
> going out with my address in the From: field and wondered if others are 
> experiencing the same.

This is a general problem.

We're seeing thousands of bounces per day right now, with thousands of 
different forged @nortelnetworks.com addresses.

Biggest source is the pillsmedical.net spammer - proxy rape, advertising 
sites in Brazil.  Much of this stuff has URLS with ".bz" site suffixes.