Re: E-mail abuse report (was: [mv] your imaging supplies)

[OTR Comm <otrcomm**NO_SPAM**@wildapache.net>]

******    message to minivend-users from OTR Comm <otrcomm**NO_SPAM**@wildapache.net>     ******

Hello,

The spam bots harvest the From: addresses in a mailing list like this
one.

Then the spam mailers will forge the address of the mailing list, in
this case minivend-users@minivend.com, and send the mail with the forged
address.

What I do now, is change my email address when I send to mailing list. 
If you look at the full header on this message, you will see that it
came from OTR Comm <otrcomm**NO_SPAM**@wildapache.net>.  When the spam
bots harvest this address and send to it, the message that they send is
rejected as user-unknown.  Unfortunately, this increases the traffic on
the Web, but hey, I do not like the spam.

Also, unfortunately I did not do this soon enough, and get quit a bit of
spam from forged minivend-users@minivend.com addresses.

What I do in these cases is change my mail filter in procmail to block
out the entire IP block where the spam came from in the first place.  I
also have a email scanning system on my main mail server that catches
incoming viruses, so if I want to block out these IP blocks from my
entire system, then I add them to a growing list of IP blocks in the
virus scanner.

If you would like a copy of the virus scanner, I make it available at no
cost.

Thanks,
Murrah Boswell

Jens Link wrote:
> 
> ******    message to minivend-users from Jens Link <jenslink@gmx.de>     ******
> 
> Hi,
> 
> the following unsolicited junk e-mail (included below)
> was sent to me - apparently from your host. Please stop this
> practice, as it is an abuse of the Internet mail system!
> 
> regads
> 
> Jens Link
> --
> Hi! I'm a .signature virus! Copy me into your ~/.signature to help me spread
>  If you dont know what ~/.signature means , dont get your panties in a
>                knot, you already have a WinSBuLcOkWss virus.!
> 
> --------------------original--message--follows---------------------
> >From owner-minivend-users@minivend.com  Sun May  7 14:20:34 2000
> Return-Path: <owner-minivend-users@minivend.com>
> Received: from localhost (IDENT:jens@localhost.localdomain [127.0.0.1])
>         by linux.e.ruhr.de (8.9.3/8.9.3) with ESMTP id OAA01081
>         for <jens@localhost>; Sun, 7 May 2000 14:20:33 -0600
> X-Flags: 0000
> Delivered-To: GMX delivery to jenslink@gmx.de
> Received: from pop.gmx.de
>         by localhost with POP3 (fetchmail-5.1.0)
>         for jens@localhost (single-drop); Sun, 07 May 2000 14:20:33 -0600 (MDT)
> Received: (qmail 23314 invoked by uid 0); 7 May 2000 19:10:32 -0000
> Received: from ns.minivend.com (HELO mail.minivend.com) (199.6.32.160)
>   by mx4.gmx.net with SMTP; 7 May 2000 19:10:32 -0000
> Received: (from majordomo@localhost)
>         by mail.minivend.com (8.9.3/8.9.3) id OAA13558
>         for minivend-users-list; Sun, 7 May 2000 14:57:54 -0400
> X-Authentication-Warning: ns.minivend.com: majordomo set sender to owner-minivend-users@minivend.com using -f
> Received: from unknown (01-050.011.popsite.net [216.126.168.50])
>         by mail.minivend.com (8.9.3/8.9.3) with SMTP id OAA13550;
>         Sun, 7 May 2000 14:57:43 -0400
> From: bench1@indyracers.com
> Subject: [mv] your imaging supplies
> Date: Sun, 7 May 2000 00:43:54
> X-Gnus-Mail-Source: file:/var/spool/mail/jens
> Message-Id: <201.766673.145343@>
> Sender: owner-minivend-users@minivend.com
> Precedence: bulk
> Reply-To: minivend-users@minivend.com
> To: jenslink@gmx.de
> X-UIDL: 74b3106b81bd994ac0f98e33e2b55d1f
> Lines: 188
> 
> ******    message to minivend-users from bench1@indyracers.com     ******
> 
> BENCHMARK SUPPLY
> 5334 LAKE VIEW CLUB
> [Note: rest of original removed for brevity]
> -
> To unsubscribe from the list, DO NOT REPLY to this message.  Instead, send
> email with 'UNSUBSCRIBE minivend-users' in the body to Majordomo@minivend.com.
> Archive of past messages: http://www.minivend.com/minivend/minivend-list

-- 
Remove the **NO_SPAM** to reply via email.
-
To unsubscribe from the list, DO NOT REPLY to this message.  Instead, send
email with 'UNSUBSCRIBE minivend-users' in the body to Majordomo@minivend.com.
Archive of past messages: http://www.minivend.com/minivend/minivend-list