Re: Fwd: trouble with "mail is looping" spam

I've been seeing several of these lately as well. The problem is that 
there's a Delivered To: header coming in (before it's actually delivered 
anywhere), so qmail-send thinks it's already delivered and is in a loop, 
creates a bounce message, which double-bounces back. At that point, I 
simply have my mail filter delete them.

I talked with Sam C of spamdyke fame about it, and it appears that a 
filter could be added to spamdyke to catch these (compare Delivered To: 
header to recipients). No commitment though when that might be available.

-- 
-Eric 'shubes'

On 11/04/2012 10:54 AM, Joe @ 3ZZZ wrote:
> dammit, one more try without "ny lizards" domain...
> with apologies for the numerous resends, and thanks.
>
>
> ----- Forwarded message from [email protected] -----
>
>
> I realized this probably didn't get through due to the spammy domains in
> the example, so resending an edited version.
> tyvmia
>
>
>
> ----- Forwarded message from [email protected] -----
>
> Hi,
>
> This is on a server with
>
>   netqmail-1.06
>   qmailadmin-1.2.15
>   vpopmail - 5.4.30
>
> Recently I began noticing many bounce-backs triggered from spam to
> non-existent addresses on domains with "catch-all" set to deleted, and
> in the message it says "mail is looping".  Example pasted below.
>
> I'm unable to recreate this by sending to these addresses myself, maybe
> it's the way the "To" addresses are formatted by the spammers?
>
> They don't seem to be abusing the bounce-back (yet) but they're coming
> in pretty often, more than once a minute, and it's generating a lot of
> junk.  Haven't yet been able to figure out why it's happening or how to
> stop it from bouncing.
> Would greatly appreciate suggestions, thank you.
>
>
> ::::::::::::::
> /var/qmail/queue/mess/7/786699
> ::::::::::::::
> Received: (qmail 4726 invoked for bounce); 31 Oct 2012 14:49:21 -0000
> Date: 31 Oct 2012 14:49:21 -0000
> From: MAILER-DAEMON@[***REDACTED***].com
> To: [email protected]
> Subject: failure notice
>
> Hi. This is the qmail-send program at [***REDACTED***].com.
> I'm afraid I wasn't able to deliver your message to the following
> addresses.
> This is a permanent error; I've given up. Sorry it didn't work out.
>
> <erin@[***REDACTED***].com>:
> mail is looping
>
> --- Below this line is a copy of the message.
>
> Return-Path: <[email protected]>
> Received: (qmail 4722 invoked by uid 89); 31 Oct 2012 14:49:21 -0000
> Received: from unknown (HELO norgazdata.com) (176.223.172.3)
>    by [***REDACTED***].com with SMTP; 31 Oct 2012 14:49:21 -0000
> Delivered-To: erin@[***REDACTED***].com
> Received: by 10.223.118.17 with SMTP id t17cs125410faq;
>          Wed, 31 Oct 2012 07:49:25 -0700
> Received: by 10.216.220.142 with SMTP id o14mr2820421wep.61.1316443187605;
>          Wed, 31 Oct 2012 07:49:25 -0700
> Return-Path: <[email protected]>
> From: "ChristianMingle.com Dating Offer"
> <[email protected]>
> Content-Type: multipart/alternative; boundary=Apple-Mail-3-110609711
> Subject: Connect with local Christian Singles in our online community
> Date: Wed, 31 Oct 2012 07:49:25 -0700
> Message-Id: <[email protected]>
> To:   <erin@[***REDACTED***].com>
> Mime-Version: 1.0 (Apple Message framework v1084)
> X-Mailer: Apple Mail (2.1084)
> X-AntiAbuse: This header was added to track abuse, please include it
> with any abuse report
> X-AntiAbuse: Primary Hostname - SPAM.info
> X-AntiAbuse: Original Domain - yahoo.com
> X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
> X-AntiAbuse: Sender Address Domain - SPAM.info
>
>
>
>
>
>
>
>
>
> 
>
> --Apple-Mail-3-110609711
> Content-Transfer-Encoding: 7bit
> Content-Type: text/plain;
>          charset=us-ascii
>
> Most recently, it has become common for online dating websites to
> provide webcam chats between members. In
> [snip]
>
> EOM
>
>
>
>
> ----- End forwarded message -----
>
>
>
>
>
>
>
>
> ----- End forwarded message -----
>
>
>
>
> !DSPAM:509682d733997415513824!
>
>



!DSPAM:5096bde133991166112062!