im imagine this is common but why?

abatis · 2012-07-08, 01:09 AM

it seems the more i regularly submit, the more random emails that make absolutely no sense to a human being i get. i imagine most of you know the type of emails i get but for example:

Subject:
Delivery Notification: Delivery has failed
From:
"PITT.EDU Postmaster" <postmaster@pitt.edu> (Add as Preferred Sender)
Date: Sat, Jul 07, 2012 12:23 pm
To: TaniaB1AA5@paysites4free.com
This report relates to a message you sent with the following header fields:

Message-id: <20120712221544.4309D838EB871D741179@BASEL-PC>
Date: Thu, 12 Jul 2012 22:15:44 +0300
From: Alonzo <TaniaB1AA5@paysites4free.com>
To: surveys <surveys@oafa.pitt.edu>
Subject: Newsletter

Your message cannot be delivered to the following recipients:

Recipient address: surveys@oafa.pitt.edu
Reason: Remote SMTP server has rejected address
Diagnostic code: smtp;550 5.1.1 User unknown
Remote system: dns;pitt-ht-03.cssd.pitt.edu (TCP|136.142.11.140|46384|136.142.251.60|25)

Attachments Size Action(s) Send To

untitled-[2]
1 k Download

untitled-[3]
1 k Download

:::::
yeah it looks like a failed send notice, but i never sent them anything. i actually dont ever send any email from this account, its only used for submissions at this time. so why or what the point is idk.
its whatever, 'mark as spam and move on'

just thought id see if anyone knows anything?

oh , and the to address: TaniaB1AA5@paysites4free.com, doesn't exist. lol. idiots.
-abatis

javbucks · 2012-07-08, 02:27 AM

My guess is

Spammer sends random emails to your and other addys.
If they receive a bounced message back then they know that inbox is invalid?

I'm guessing you read this message on a catch-all address?

mOrrI · 2012-07-08, 11:25 AM

It's the spam working...

that email address was probably grabbed from some harvesting bot...
And now... there you go... fresh spam emails...

Bill · 2012-07-08, 07:29 PM

I get that kind of thing often enough - spammers spoofing addresses.

It is a bit nervewracking.

cd34 · 2012-07-08, 10:14 PM

It is called joe-jobbing. Basically your email address + perhaps your address book may have been leaked. By using your domain in the return address, they hope that the 'open' rate will be higher - it is if they happen to get your address book. Even if not, any bounces don't go back to them, but to you.

The easiest way to prevent this is to avoid using wildcard emails, i.e. anything@domain.com forwards through to your main mailbox.

Setting up your email to answer only to webmaster@ or even disabling email on domains that will never send mail cuts down on it. Using SPF records can also prevent some of this - it seems that most spammers aren't using SPF-enabled domains as often as they use domains without, and they don't appear to be touching DKIM enabled domains (Microsoft's key-based signature system).

abatis · 2012-07-09, 10:29 AM

oh, yeah, it is a ca account, thanks for the feedback everyone.

-abatis

Charlie · 2012-07-09, 03:38 PM

what's wrong with a ca account?

cd34 · 2012-07-09, 07:45 PM

Quote:

Originally Posted by Charlie

what's wrong with a ca account?

catch-all

Bill · 2012-07-09, 08:38 PM

what are the chances, Chris, that someone has somehow gotten into the mail servers and is using them to send spam?

Thats always my concern when I get these bounces - could it be that I got hacked or exploited?

I turned off the mail service on a domain - and was still getting the bounces.

I also worry someone will complain about my domain to the blacklists.

Is there an easy way to tell from the bounce that it's a spoof?

Charlie · 2012-07-10, 08:10 AM

Quote:

Originally Posted by cd34

catch-all

Thought you meant California. Thanks. LOL

2012-07-08, 01:09 AM	#1
abatis A boy without mischief is like a bowling ball without a liquid center Join Date: Jul 2007 Posts: 431	im imagine this is common but why? it seems the more i regularly submit, the more random emails that make absolutely no sense to a human being i get. i imagine most of you know the type of emails i get but for example: Subject: Delivery Notification: Delivery has failed From: "PITT.EDU Postmaster" <postmaster@pitt.edu> (Add as Preferred Sender) Date: Sat, Jul 07, 2012 12:23 pm To: TaniaB1AA5@paysites4free.com This report relates to a message you sent with the following header fields: Message-id: <20120712221544.4309D838EB871D741179@BASEL-PC> Date: Thu, 12 Jul 2012 22:15:44 +0300 From: Alonzo <TaniaB1AA5@paysites4free.com> To: surveys <surveys@oafa.pitt.edu> Subject: Newsletter Your message cannot be delivered to the following recipients: Recipient address: surveys@oafa.pitt.edu Reason: Remote SMTP server has rejected address Diagnostic code: smtp;550 5.1.1 User unknown Remote system: dns;pitt-ht-03.cssd.pitt.edu (TCP\|136.142.11.140\|46384\|136.142.251.60\|25) Attachments Size Action(s) Send To untitled-[2] 1 k Download untitled-[3] 1 k Download ::::: yeah it looks like a failed send notice, but i never sent them anything. i actually dont ever send any email from this account, its only used for submissions at this time. so why or what the point is idk. its whatever, 'mark as spam and move on' just thought id see if anyone knows anything? oh , and the to address: TaniaB1AA5@paysites4free.com, doesn't exist. lol. idiots. -abatis __________________ Free/Trial Join Sponsors Paysite Trials

2012-07-08, 02:27 AM	#2
javbucks You can now put whatever you want in this space :) Join Date: Oct 2011 Posts: 544	My guess is Spammer sends random emails to your and other addys. If they receive a bounced message back then they know that inbox is invalid? I'm guessing you read this message on a catch-all address? __________________ JAVBucks -The best place to convert your asian niche traffic!

2012-07-08, 11:25 AM	#3
mOrrI You can now put whatever you want in this space :) Join Date: Feb 2004 Location: Portugal Posts: 1,083	It's the spam working... that email address was probably grabbed from some harvesting bot... And now... there you go... fresh spam emails... __________________

2012-07-08, 10:14 PM	#5
cd34 a.k.a. Sparky Join Date: Sep 2004 Location: West Palm Beach, FL, USA Posts: 2,396	It is called joe-jobbing. Basically your email address + perhaps your address book may have been leaked. By using your domain in the return address, they hope that the 'open' rate will be higher - it is if they happen to get your address book. Even if not, any bounces don't go back to them, but to you. The easiest way to prevent this is to avoid using wildcard emails, i.e. anything@domain.com forwards through to your main mailbox. Setting up your email to answer only to webmaster@ or even disabling email on domains that will never send mail cuts down on it. Using SPF records can also prevent some of this - it seems that most spammers aren't using SPF-enabled domains as often as they use domains without, and they don't appear to be touching DKIM enabled domains (Microsoft's key-based signature system). __________________ SnapReplay.com a different way to share photos - iPhone & Android

2012-07-09, 10:29 AM	#6
abatis A boy without mischief is like a bowling ball without a liquid center Join Date: Jul 2007 Posts: 431	oh, yeah, it is a ca account, thanks for the feedback everyone. -abatis __________________ Free/Trial Join Sponsors Paysite Trials

2012-07-08, 07:29 PM	#4
Bill Selling porn allows me to stay in a constant state of Bliss - ain't that a trip! Join Date: Apr 2003 Posts: 3,914	I get that kind of thing often enough - spammers spoofing addresses. It is a bit nervewracking.

2012-07-09, 03:38 PM	#7
Charlie Oh! I haven't changed since high school and suddenly I am uncool Join Date: Sep 2007 Posts: 251	what's wrong with a ca account? __________________ Trade Some Links/Swap Some Traffic thanks

2012-07-09, 08:38 PM	#9
Bill Selling porn allows me to stay in a constant state of Bliss - ain't that a trip! Join Date: Apr 2003 Posts: 3,914	what are the chances, Chris, that someone has somehow gotten into the mail servers and is using them to send spam? Thats always my concern when I get these bounces - could it be that I got hacked or exploited? I turned off the mail service on a domain - and was still getting the bounces. I also worry someone will complain about my domain to the blacklists. Is there an easy way to tell from the bounce that it's a spoof?