Spammers forged my address - help unbury me from bounces?

[Kirk Strauser]

At 2003-05-29T13:57:10Z, Peter Elsner <peter at servplex.com> writes:

> This sounds like a dictionary attack.  They simply put your domain in and
> run through hundreds of names and prepend it to your domain.  One or more
> is bound to go through...

I think you misread it a bit.  They were sending out hundreds of thousands
of emails to *other* mailservers with forged headers like:

  From: Michelle at honeypot.net

The problem wasn't that they were sending all of the messages to *me*; I
would've shut that down in a heartbeat.  The real issue was that the all of
the addresses they tried to send to that weren't reachable bounced, and
since my domain was in the From: line, I was being deluged with tens of
thousands of bounce messages from thousands of MXes around the world.

Now I have thousands of lines in my maillog like:

    May 29 09:38:04 kanga sm-mta[13551]: h4TEc2DY013551: ruleset=check_rcpt, arg1=<Michelle at honeypot.net>, relay=ns2.computerland.pl [62.89.69.3], reject=550 5.0.0 <Michelle at honeypot.net>... This account was spoofed by some jackass spammer.It doesn't exist.
    May 29 09:38:04 kanga sm-mta[13551]: h4TEc2DY013551: from=<>, size=3804, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=ns2.computerland.pl [62.89.69.3]
    May 29 09:38:05 kanga sm-mta[13551]: h4TEc2DZ013551: ruleset=check_rcpt, arg1=<Michelle at honeypot.net>, relay=ns2.computerland.pl [62.89.69.3], reject=550 5.0.0 <Michelle at honeypot.net>... This account was spoofed by some jackass spammer.It doesn't exist.
    May 29 09:38:05 kanga sm-mta[13551]: h4TEc2DZ013551: from=<>, size=3804, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=ns2.computerland.pl [62.89.69.3]
    May 29 09:38:14 kanga sm-mta[13559]: h4TEcDDY013559: ruleset=check_rcpt, arg1=<Erin at honeypot.net>, relay=demrel02.henkel.de [193.96.101.29], reject=550 5.0.0 <Erin at honeypot.net>... This account was spoofed by some jackass spammer.It doesn't exist.
    May 29 09:38:14 kanga sm-mta[13559]: h4TEcDDY013559: from=<>, size=4096, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=demrel02.henkel.de [193.96.101.29]

but at least I'm not spending my disk or bandwidth to process those bounce
messages - I only have a waste a single TCP connection.
-- 
Kirk Strauser
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 188 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20030529/d05fc884/attachment.bin