Think someone is spoofing my email to send spam?

dragon · 31-05-2005, 16:13

I think someone might have spoofed my domain email account to send spam

as i sometimes get messsages back from servers saying deilvery failed blah blah

i know its not a virus or anything on my pc as its not coming from my ip or even though my mailserver i believe someone is spoofing my address in the from field

here is part of a header which i found in the supposed bounced email.

Code:

Received: (qmail 15610 invoked from network); 22 May 2005 14:30:25 -0000
Received: from insmtp21.bt.net (217.35.209.185)
  by server-2.tower-68.messagelabs.com with SMTP; 22 May 2005 14:30:25 -0000
Received: from [81.139.199.245] (helo=mrcjcv.uk)
	by insmtp21.bt.net with smtp (Exim 3.36 #1)
	id 1DZrOz-0001gN-00; Sun, 22 May 2005 15:26:01 +0100
From: myemail@fbdragon.co.uk
To: server@miller.co.uk
Date: Sun, 22 May 2005 12:37:24 UTC
Subject: Du wirst zum Sklaven gemacht!!!
Importance: Normal
X-Priority: 3 (Normal)
MIME-Version: 1.0

And here is the start of the header

Code:

From - Sun May 22 18:37:13 2005
X-Account-Key: account3
X-UIDL: 98f4044a827f0885346e5c0fd523ea7a
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path: <>
Envelope-to: Myaddy@fbdragon.co.uk
Delivery-date: Sun, 22 May 2005 10:46:09 -0400
Received: from mail by server1.2k-hosting.com with spam-scanned (Exim 4.42)
	id 1DZriS-00042R-9C
	for Myaddy@fbdragon.co.uk; Sun, 22 May 2005 10:46:09 -0400
Received: from mail68.messagelabs.com ([193.109.255.67])
	by server1.2k-hosting.com with smtp (Exim 4.42)
	id 1DZriS-00042N-2E
	for myaddy@fbdragon.co.uk; Sun, 22 May 2005 10:46:08 -0400
X-VirusChecked: Checked
X-StarScan-Version: 5.4.15; banners=.,-,-
Received: (qmail 15640 invoked for bounce); 22 May 2005 14:30:26 -0000
Date: 22 May 2005 14:30:26 -0000
From: MAILER-DAEMON@messagelabs.com
To: myaddy@fbdragon.co.uk
Subject: failure notice
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on 
	server1.2k-hosting.com
X-Spam-Level: 
X-Spam-Status: No, score=0.2 required=5.0 tests=NO_REAL_NAME autolearn=no 
	version=3.0.1
Message-Id: <E1DZriS-00042R-9C@server1.2k-hosting.com>

This is the mail delivery agent at messagelabs.com.
I was not able to deliver your message to the following addresses.

<mail.miller@btinternet.com>:
195.50.106.135 failed after I sent the message.
Remote host said: 501 Malformed message [#5.16.1] (X-SpamOriginallyTo:=52)


--- Below this line is a copy of the message.

MovedGoalPosts · 31-05-2005, 16:26

I see this sort of message quite a lot on our work servers.

Chances are your email addy has been stored in an outlook type address book on some numpty's PC. That numpty doesn't have adequate protection from viruses and thus that PC is sending out emails using various addys that it can find in the address book.

Equally if your email addy is listed on any websites, it can have been scanned by the spoofers.

There is no easy solution, as far as I am aware, other than the keep yourself protected, and hope that others will realise the need for protection too.

dragon · 31-05-2005, 16:28

are antispam filters smart enough to relise that its not really coming from that address.

id hate to get it on spam blacklists because i know those emails didn't originate from me.

Stuart · 31-05-2005, 16:46

Well, it appears to have originated from a BTOpenWorld ADSL address. Do you know anyone with BT?

fragless · 31-05-2005, 22:48

This is becoming more and more common, and it appears lately we have seen a spate of BT IP's sending out spam and spoofing other email address's.

The following may help?

http://spf.pobox.com/

simbr · 01-06-2005, 02:57

I get.. a lot of these. Some spammer seems to get his kicks out of generating random.names@mydomain.com and since I have a catch-all, all the bounces come to me.