Welcome to the MacNN Forums.

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

You are here: MacNN Forums > Community > MacNN Lounge > hundreds of "failed" email messages...

hundreds of "failed" email messages...
Thread Tools
krx
Dedicated MacNNer
Join Date: Aug 2005
Location: Chicago
Status: Offline
Reply With Quote
Oct 15, 2008, 09:47 AM
 
Found about 200 "undelivered" and "failed" email message reports this morning. Apparently someone is using my address to spam. Can anyone tell me how to stop this?

Not sure this was the right forum for this question so feel free to move it if there is a better place for the question.

Thanks!
     
Laminar
Posting Junkie
Join Date: Apr 2007
Location: Iowa, how long can this be? Does it really ruin the left column spacing?
Status: Offline
Reply With Quote
Oct 15, 2008, 09:50 AM
 
What's your email provider? The first thing to do is to change your password to something more secure, but providers don't require authentication to send mail.
     
krx  (op)
Dedicated MacNNer
Join Date: Aug 2005
Location: Chicago
Status: Offline
Reply With Quote
Oct 15, 2008, 09:54 AM
 
I use Eudora through the University I'm at. I'll change my password right now.
     
Big Mac
Clinically Insane
Join Date: Oct 2000
Location: Los Angeles
Status: Offline
Reply With Quote
Oct 15, 2008, 09:54 AM
 
It sounds like you're experiencing back-scatter, in which spam bounces are directed to what is claimed to be the sender, i.e. you. There isn't that much that can be done because you don't know the source of the original messages. If you have admin access to your mail server I suppose you could filter it out on the server side. Perhaps your web host or ISP can help.
Originally Posted by Laminar View Post
What's your email provider? The first thing to do is to change your password to something more secure, but providers don't require authentication to send mail.
I don't think krx's account privileges are being used to send spam. If that were the case the remedy would be a lot easier. Rather, I think this is back-scatter, which is harder to deal with.

"The natural progress of things is for liberty to yield and government to gain ground." TJ
     
angelmb
Addicted to MacNN
Join Date: Oct 2001
Location: Automatic
Status: Offline
Reply With Quote
Oct 15, 2008, 09:58 AM
 
But… I guess whoever could be doing such nasty thing would need to know your password in order to use your e-mail account?, or your user account password for that matter, what if you start by getting new passwords?

On a slightly related note, I have the suspect that some e-mails I sent doesn't reach its destination, and due to e-mail etiquette I wonder what I would do… to send another e-mail just asking 'hey did you get my e-mail regarding yadda yadda…' sounds kind of lame.

sorry: people gave good advice about the password thing while I was writing my own reply…
     
turtle777
Clinically Insane
Join Date: Jun 2001
Location: planning a comeback !
Status: Offline
Reply With Quote
Oct 15, 2008, 10:02 AM
 
Create a rule that sends all emails containing your email address and something like "delivery failed" in the subject to trash.

It might catch some legitimate ones as well though.

There is *NO WAY* to keep anybody from putting your address in the "from" field of teir email client.

-t
     
turtle777
Clinically Insane
Join Date: Jun 2001
Location: planning a comeback !
Status: Offline
Reply With Quote
Oct 15, 2008, 10:03 AM
 
Originally Posted by krx View Post
I use Eudora through the University I'm at. I'll change my password right now.
Your password has nothing to do with it.

Nobody hacked your email account.

-t
     
turtle777
Clinically Insane
Join Date: Jun 2001
Location: planning a comeback !
Status: Offline
Reply With Quote
Oct 15, 2008, 10:05 AM
 
Originally Posted by angelmb View Post
But… I guess whoever could be doing such nasty thing would need to know your password in order to use your e-mail account?, or your user account password for that matter, what if you start by getting new passwords?

On a slightly related note, I have the suspect that some e-mails I sent doesn't reach its destination, and due to e-mail etiquette I wonder what I would do… to send another e-mail just asking 'hey did you get my e-mail regarding yadda yadda…' sounds kind of lame.

sorry: people gave good advice about the password thing while I was writing my own reply…
What are you talking about ?

Since when would I need your password to set up my Mail client with your email address as "sent from" ?

-t
     
Big Mac
Clinically Insane
Join Date: Oct 2000
Location: Los Angeles
Status: Offline
Reply With Quote
Oct 15, 2008, 10:05 AM
 
Again, I'm pretty sure his SMTP access hasn't been hacked.

"The natural progress of things is for liberty to yield and government to gain ground." TJ
     
krx  (op)
Dedicated MacNNer
Join Date: Aug 2005
Location: Chicago
Status: Offline
Reply With Quote
Oct 15, 2008, 10:13 AM
 
Apart from the flood of undelivered messages, it doesn't sound like it's a huge cause for concern. I guess I was worrying about getting blacklisted as a spammer, or having my account restricted, or whatever.

So some loser just puts my address in the "from" field to get thru spam detectors?
     
Big Mac
Clinically Insane
Join Date: Oct 2000
Location: Los Angeles
Status: Offline
Reply With Quote
Oct 15, 2008, 10:21 AM
 
Sounds like that's what happened. Do you have a well known address?

"The natural progress of things is for liberty to yield and government to gain ground." TJ
     
krx  (op)
Dedicated MacNNer
Join Date: Aug 2005
Location: Chicago
Status: Offline
Reply With Quote
Oct 15, 2008, 10:24 AM
 
I've been using it forever but outside of my personal/professional network not well known. Maybe the .edu TLD helps get the scammer thru filters?
     
krx  (op)
Dedicated MacNNer
Join Date: Aug 2005
Location: Chicago
Status: Offline
Reply With Quote
Oct 15, 2008, 10:27 AM
 
This has happened before but on a much smaller scale. It always stops after a day or two ... so hopefully this one will too.
     
krx  (op)
Dedicated MacNNer
Join Date: Aug 2005
Location: Chicago
Status: Offline
Reply With Quote
Oct 15, 2008, 10:38 AM
 
This was the message in one of the returned mail replies, translated from Dutch...

Dear Sir / Madam,

The message you are trying to send to an employee of the Province of Buenos Aires, contains a virus and is protected with a password. The message is for this reason not delivered to the consignee.
     
krx  (op)
Dedicated MacNNer
Join Date: Aug 2005
Location: Chicago
Status: Offline
Reply With Quote
Oct 15, 2008, 10:46 AM
 
I just checked several returned messages and they are from different made up names along w/my email address. I assume this confirms the "back-scatter" theory.

In case anyone's interested, here is the content of the message being sent out by the spammer, translated from Italian...

Supply of labor: Habitats =
Property and Service Inc.
= 20
International companies working in the area of goods =
buildings urgently seeking representatives of the territory fixed =
Italian national. We are looking for people ages 18 to 70 years for =
Work simple treatment of incoming orders and conduct =
obligations not difficult to manage.
You do not have to be a professional and have specialized =
education correspondent. You do not have to have either =
work experience in the field, all things necessary to =
work son = CF:
= 20
learn to follow instructions received be working =
the computer user experience working with MS Word =
experience working with MS Excel access the Internet = 20
This work perfectly appropriate for students, women =
children, pensioners and people seeking employment =
Partially. You must have only 2-3 hours free during the day, =
perform your duties working.

= 20
= 20
All candidates will be selected at the base of tests =
contest. To leave your curriculum vitae write =
e at:
resume07.habitats @ gmail.com
= 20
= 20
Your application will be processed and examined within 24-48 hours.
     
Doofy
Clinically Insane
Join Date: Jul 2005
Location: Vacation.
Status: Offline
Reply With Quote
Oct 15, 2008, 11:56 AM
 
Yep, it's back-scatter.

You can set a filter up to cope with this. As Turty suggested earlier but in order to prevent it from killing any legit bounces you need to pop something from your outgoing message ID line in there (as all legit bounces should have a reference to this line).

For example:

KILL
subject contains "failed delivery"
UNLESS
message content contains "Message-Id: <*@forums.macnn.com>"

This would kill back-scatter going to the NN server. Your message IDs will be different, so you'll have to send a mail to yourself and check the long headers.

Examples:

Message-Id: <bunch of variable [email protected]>
Don't kill "Message-Id: <*@forums.macnn.com>"

Message-Id: <bunch of variable [email protected]>
Don't kill "Message-Id: <*@*.giganews.com>"

Hope this helps.
Been inclined to wander... off the beaten track.
That's where there's thunder... and the wind shouts back.
     
angelmb
Addicted to MacNN
Join Date: Oct 2001
Location: Automatic
Status: Offline
Reply With Quote
Oct 15, 2008, 01:55 PM
 
Originally Posted by turtle777 View Post
What are you talking about ?

Since when would I need your password to set up my Mail client with your email address as "sent from" ?

-t
Is that easy? no need of any sort of verification?, I guess I need to start using PGP keys with my mail… 
     
starman
Clinically Insane
Join Date: Jun 2000
Location: Union County, NJ
Status: Offline
Reply With Quote
Oct 15, 2008, 03:26 PM
 
I'll confirm what turtle said. Nobody hacked your account, they just used your email address and a server that allows someone to use an arbitrary address.

EDIT: I think I posted here that it happened to me about a year ago or so. People are dicks. What can you do?

Home - Twitter - Sig Wall-Retired - Flickr
     
turtle777
Clinically Insane
Join Date: Jun 2001
Location: planning a comeback !
Status: Offline
Reply With Quote
Oct 15, 2008, 03:28 PM
 
Originally Posted by angelmb View Post
Is that easy? no need of any sort of verification?, I guess I need to start using PGP keys with my mail… 


Won't work either. There is NOTHING you can do to prevent back scatter, short of some really smart filtering that would take into consideration previous sent emails and flag their content as HAM.

-t
     
Dave N
Dedicated MacNNer
Join Date: Oct 2002
Location: Illinois, USA
Status: Offline
Reply With Quote
Oct 15, 2008, 03:33 PM
 
We've been experiencing this at the university where I work. In the cases I've heard about, the spammers only use your address for a day or so and then move on. It happened to me and I just had to delete the returned emails for about two days, then it was over. I shudder to think of the 1000's of people on the receiving end of the spam who are now really pissed at me...
     
Doofy
Clinically Insane
Join Date: Jul 2005
Location: Vacation.
Status: Offline
Reply With Quote
Oct 15, 2008, 03:34 PM
 
Originally Posted by turtle777 View Post


Won't work either. There is NOTHING you can do to prevent back scatter
I've just told you how to filter back-scatter.
Been inclined to wander... off the beaten track.
That's where there's thunder... and the wind shouts back.
     
imitchellg5
Posting Junkie
Join Date: Jan 2006
Location: Colorado
Status: Offline
Reply With Quote
Oct 15, 2008, 04:09 PM
 
Email FAIL.
     
Laminar
Posting Junkie
Join Date: Apr 2007
Location: Iowa, how long can this be? Does it really ruin the left column spacing?
Status: Offline
Reply With Quote
Oct 15, 2008, 04:42 PM
 
Is anyone else getting tired of the word "fail?"
     
brassplayersrock²
Addicted to MacNN
Join Date: Mar 2006
Location: California
Status: Offline
Reply With Quote
Oct 15, 2008, 05:30 PM
 
and the "word" email

it's e-mail that little - is important people!
IMPORTANT!
     
turtle777
Clinically Insane
Join Date: Jun 2001
Location: planning a comeback !
Status: Offline
Reply With Quote
Oct 15, 2008, 05:31 PM
 
The constant use of fail is an EPIC FAIL.

-t
     
turtle777
Clinically Insane
Join Date: Jun 2001
Location: planning a comeback !
Status: Offline
Reply With Quote
Oct 15, 2008, 05:31 PM
 
Originally Posted by brassplayersrock² View Post
and the "word" email

it's e-mail that little - is important people!
Why not eMail or EMAIL ?

iMail ?

Actually, scratch all that. We should call the OP's issue

f-mail

-t
     
Doofy
Clinically Insane
Join Date: Jul 2005
Location: Vacation.
Status: Offline
Reply With Quote
Oct 15, 2008, 06:00 PM
 
"Failed" email messages? That's nearly "Femail messages". Which is almost "Female messages". Which is a good thing. Unless they're threatening your bunnies. Bunny hotpot and what not.
Been inclined to wander... off the beaten track.
That's where there's thunder... and the wind shouts back.
     
brassplayersrock²
Addicted to MacNN
Join Date: Mar 2006
Location: California
Status: Offline
Reply With Quote
Oct 15, 2008, 06:03 PM
 
     
torsoboy
Mac Elite
Join Date: Mar 2003
Status: Offline
Reply With Quote
Oct 16, 2008, 02:16 AM
 
Originally Posted by brassplayersrock² View Post
and the "word" email

it's e-mail that little - is important people!
IMPORTANT!
It is called "email", no dash included.

Gmail is described as "A Google approach to email." on the gmail main page. When I am on excite.com it says "Check Email". Yahoo says "Sign in to preview your email here.", etc. There is no "-" in email, so you might want to take that one off your list of gripes.
     
angelmb
Addicted to MacNN
Join Date: Oct 2001
Location: Automatic
Status: Offline
Reply With Quote
Oct 16, 2008, 02:44 AM
 
Originally Posted by turtle777 View Post


Won't work either. There is NOTHING you can do to prevent back scatter, short of some really smart filtering that would take into consideration previous sent emails and flag their content as HAM.

-t
So what about the mail headers… they aren't show up as genuine ones, are they?

What a mess.
     
turtle777
Clinically Insane
Join Date: Jun 2001
Location: planning a comeback !
Status: Offline
Reply With Quote
Oct 16, 2008, 10:28 AM
 
Originally Posted by angelmb View Post
So what about the mail headers… they aren't show up as genuine ones, are they?

What a mess.
The email headers of the returned emails ARE genuine. They are really caused by the receiving email server not being able to process the email, and then returning it.

-t
     
brassplayersrock²
Addicted to MacNN
Join Date: Mar 2006
Location: California
Status: Offline
Reply With Quote
Oct 16, 2008, 04:58 PM
 
Originally Posted by torsoboy View Post
It is called "email", no dash included.

Gmail is described as "A Google approach to email." on the gmail main page. When I am on excite.com it says "Check Email". Yahoo says "Sign in to preview your email here.", etc. There is no "-" in email, so you might want to take that one off your list of gripes.


http://www.merriam-webster.com/dicti...electronicmail
and linked from that page
http://www.merriam-webster.com/dictionary/e-mail
( Last edited by brassplayersrock²; Oct 16, 2008 at 05:50 PM. )
     
ApeInTheShell
Senior User
Join Date: Dec 2002
Location: aurora
Status: Offline
Reply With Quote
Oct 17, 2008, 09:23 PM
 
I think have the same problem on my mac mini. The iPod touch receives email fine though.

I also know different countries do not use but rather electronic mail or computer mail. Can't confirm it I just remember seeing it in a French magazne article online.
     
turtle777
Clinically Insane
Join Date: Jun 2001
Location: planning a comeback !
Status: Offline
Reply With Quote
Oct 18, 2008, 01:24 AM
 
Originally Posted by ApeInTheShell View Post
I think have the same problem on my mac mini. The iPod touch receives email fine though.

I also know different countries do not use but rather electronic mail or computer mail. Can't confirm it I just remember seeing it in a French magazne article online.


-t
     
brassplayersrock²
Addicted to MacNN
Join Date: Mar 2006
Location: California
Status: Offline
Reply With Quote
Oct 18, 2008, 01:28 AM
 
ditto
     
   
Thread Tools
 
Forum Links
Forum Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Top
Privacy Policy
All times are GMT -4. The time now is 10:51 AM.
All contents of these forums © 1995-2017 MacNN. All rights reserved.
Branding + Design: www.gesamtbild.com
vBulletin v.3.8.8 © 2000-2017, Jelsoft Enterprises Ltd.,