Re: Loads of spam showing "Delviery Status Notification", "Failure Notice" etc.
Herbert Eppel <[email protected]> Fri, 28 Apr 2006 12:50:04 +0100
| Newsgroups | gmane.mail.spam.spamcop.help |
|---|---|
| Organization | SpamCop |
| Message-ID | <[email protected]> |
On 16.04.2006 18:02 UK Time, Mike Easter wrote: > rowan wrote: >> I've recently started receiving loads of spam messages which purport >> to be delivery failure messages. They are always addressed to a >> non-existent user at my domain, e.g. ojvnyo@, ejrzx@, rrl@ etc. They >> can have a variety of failure messages, and purport to tell me that a >> message that I sent to an address that I have never sent to in my life >> could not be delivered. The message sometimes contains a load of >> Base64 code, presumably some kind of malware, or a scanned page of >> text. Sometimes there's no obvious payload. > > Spending a lot of words trying to describe some mail or spam doesn't > actually sufficiently describe it. > > The best way to 'talk about' something spam around here is to show one > or more by posting a tracking URL or 'tracker'. > > A tracker looks like: > > Here is your TRACKING URL - it may be saved for future reference: > http://www.spamcop.net/sc?id=z921452706z5f80c3536f02ccd15f431f0fc87fc372z > > You get it by submitting one of those spams you are trying to describe > to the webparser, then copying the tracker, then cancelling the report, > then pasting the tracker in here. > > That way anyone can look at the time and say things like, "That's not > actually a delivery status notification - failure, it is a bogus > ne.' -or- 'Yep that's a DSN failure all right -- a spammer has elected > your address to be the bogus From.' > > We can also comment on the reportability of servers which belatedly > bounce spam - or the non-reportability of spam which isn't mailed to > you - or other alternatives. We can comment on what is the payload > which isn't obvious. All that stuff. But not with your description > words which can never be adequate for even remarking on the issue. > >> Where are these messages coming from? Why have they suddenly started >> (or at least, suddenly started finding me)? Why are they getting >> through my ISP's spam filter (which is normally very good)? What can I >> do to get rid of them? > > Comments after you post a tracker or two. Hi, I have the same problem as the one reported by Rowan on 16 April, and I would like to get to the bottom of it, but I'm not quite sure how to create a tracker. Mike said "You get it by submitting one of those spams you are trying to describe to the webparser", but I'm not sure where I can find this webparser and how exactly I can submit messages. Can you help? Thank you. Herbert Eppel -- www.HETranslation.co.uk