Re: Re: Fwd: trouble with "mail is looping" spam

Hi Eric,

Thanks for your reply and the explanation.
We use spamdyke already and would be happy if that solution comes about.
I wonder why spammers aren't exploiting this to generate bounceback  
spam, maybe they just haven't caught on yet...?




Quoting Eric Shubert <[email protected]>:

> I've been seeing several of these lately as well. The problem is  
> that there's a Delivered To: header coming in (before it's actually  
> delivered anywhere), so qmail-send thinks it's already delivered and  
> is in a loop, creates a bounce message, which double-bounces back.  
> At that point, I simply have my mail filter delete them.
>
> I talked with Sam C of spamdyke fame about it, and it appears that a  
> filter could be added to spamdyke to catch these (compare Delivered  
> To: header to recipients). No commitment though when that might be  
> available.
>
> -- 
> -Eric 'shubes'
>
> On 11/04/2012 10:54 AM, Joe @ 3ZZZ wrote:
>> dammit, one more try without "ny lizards" domain...
>> with apologies for the numerous resends, and thanks.
>>
>>
>> ----- Forwarded message from [email protected] -----
>>
>>
>> I realized this probably didn't get through due to the spammy domains in
>> the example, so resending an edited version.
>> tyvmia
>>
>>
>>
>> ----- Forwarded message from [email protected] -----
>>
>> Hi,
>>
>> This is on a server with
>>
>>  netqmail-1.06
>>  qmailadmin-1.2.15
>>  vpopmail - 5.4.30
>>
>> Recently I began noticing many bounce-backs triggered from spam to
>> non-existent addresses on domains with "catch-all" set to deleted, and
>> in the message it says "mail is looping".  Example pasted below.
>>
>> I'm unable to recreate this by sending to these addresses myself, maybe
>> it's the way the "To" addresses are formatted by the spammers?
>>
>> They don't seem to be abusing the bounce-back (yet) but they're coming
>> in pretty often, more than once a minute, and it's generating a lot of
>> junk.  Haven't yet been able to figure out why it's happening or how to
>> stop it from bouncing.
>> Would greatly appreciate suggestions, thank you.
>>
>>
>> ::::::::::::::
>> /var/qmail/queue/mess/7/786699
>> ::::::::::::::
>> Received: (qmail 4726 invoked for bounce); 31 Oct 2012 14:49:21 -0000
>> Date: 31 Oct 2012 14:49:21 -0000
>> From: MAILER-DAEMON@[***REDACTED***].com
>> To: [email protected]
>> Subject: failure notice
>>
>> Hi. This is the qmail-send program at [***REDACTED***].com.
>> I'm afraid I wasn't able to deliver your message to the following
>> addresses.
>> This is a permanent error; I've given up. Sorry it didn't work out.
>>
>> <erin@[***REDACTED***].com>:
>> mail is looping
>>
>> --- Below this line is a copy of the message.
>>
>> Return-Path: <[email protected]>
>> Received: (qmail 4722 invoked by uid 89); 31 Oct 2012 14:49:21 -0000
>> Received: from unknown (HELO norgazdata.com) (176.223.172.3)
>>   by [***REDACTED***].com with SMTP; 31 Oct 2012 14:49:21 -0000
>> Delivered-To: erin@[***REDACTED***].com
>> Received: by 10.223.118.17 with SMTP id t17cs125410faq;
>>         Wed, 31 Oct 2012 07:49:25 -0700
>> Received: by 10.216.220.142 with SMTP id o14mr2820421wep.61.1316443187605;
>>         Wed, 31 Oct 2012 07:49:25 -0700
>> Return-Path: <[email protected]>
>> From: "ChristianMingle.com Dating Offer"
>> <[email protected]>
>> Content-Type: multipart/alternative; boundary=Apple-Mail-3-110609711
>> Subject: Connect with local Christian Singles in our online community
>> Date: Wed, 31 Oct 2012 07:49:25 -0700
>> Message-Id: <[email protected]>
>> To:   <erin@[***REDACTED***].com>
>> Mime-Version: 1.0 (Apple Message framework v1084)
>> X-Mailer: Apple Mail (2.1084)
>> X-AntiAbuse: This header was added to track abuse, please include it
>> with any abuse report
>> X-AntiAbuse: Primary Hostname - SPAM.info
>> X-AntiAbuse: Original Domain - yahoo.com
>> X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
>> X-AntiAbuse: Sender Address Domain - SPAM.info
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> --Apple-Mail-3-110609711
>> Content-Transfer-Encoding: 7bit
>> Content-Type: text/plain;
>>         charset=us-ascii
>>
>> Most recently, it has become common for online dating websites to
>> provide webcam chats between members. In
>> [snip]
>>
>> EOM
>>
>>
>>
>>
>> ----- End forwarded message -----
>>
>>
>>
>>
>>
>>
>>
>>
>> ----- End forwarded message -----
>>
>>
>>
>>
>> 
>>
>>
>
>
>
> !DSPAM:5096bde133991166112062!
>
>





!DSPAM:5096f61e33992529918465!