'Undeliverable' spam?

[randomnut]

Hi,

We seem to be getting a huge amount of 'undeliverable email' spam recently. As it comes through as an undeliverable, it doesn't have anything in the 'internet headers'.

I've checked the clients for mailer worms etc, where would this be coming from? Some examples below

From: System Administrator

Sent: 15 April 2008 04:48

To: [email protected] **bear in mind this is NOT our domain***

Subject: Undeliverable: Check my new photos :))

Your message did not reach some or all of the intended recipients.

Subject: Check my new photos :))

Sent: 15/04/2008 03:00

The following recipient(s) could not be reached:

[email protected] on 15/04/2008 04:48

The e-mail system was unable to deliver the message, but did not report a specific reason. Check the address and try again. If it still fails, contact your system administrator.

< ironport4.terra.cl #5.0.0 smtp; 5.1.0 - Unknown address error 550-'RCPT TO:<[email protected]> User unknown' (delivery attempts: 0)>

From: [email protected]

[mailto:[email protected]]

Sent: 14 April 2008 19:54

To: *name edited*

Subject: failure notice

Hi. This is the qmail-send program at www.dunham-bush.com.cn.

I'm afraid I wasn't able to deliver your message to the following addresses.

This is a permanent error; I've given up. Sorry it didn't work out.

<[email protected]>:

Sorry, no mailbox here by that name. vpopmail (#5.1.1)

--- Below this line is a copy of the message.

Return-Path: **email edited**

Received: (qmail 31177 invoked from network); 15 Apr 2008 02:53:38 +0800

Received: from unknown (HELO 190-48-57-116.speedy.com.ar) (190.48.57.116)

by 222.135.187.29 with SMTP; 15 Apr 2008 02:53:38 +0800

Message-ID: <000801c89e64$07b06824$65e8b799@tnuehc>

From: "Julia S." name edited as it was our domain, but not 'julia s'

To: <[email protected]>

Subject: Check my new photos :))

Date: Mon, 14 Apr 2008 17:35:17 +0000

MIME-Version: 1.0

Content-Type: text/plain;

charset="iso-8859-1"

Content-Transfer-Encoding: 7bit

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2900.3138

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198

Hello!

remember me?..

new fotos(archived) you asked

:))

kiss, Julia S.

What is the best way to stop these kind of emails? We are using Symantec Mail Security for SMTP v5 as our spam filter. thanks

[+BudMan MVC]

Is this you? (HELO 190-48-57-116.speedy.com.ar) (190.48.57.116)

If not then you did not send it.. Spammers do NOT use their own legit address, they make them up, they use one from a list. So if you are [email protected] and I send a email to [email protected] and SAY its from "[email protected]" When that message can not be delivered to [email protected]

The gmails servers send it back where?? You guessed it [email protected] so you get a kickback saying your mail could not be delivered.

Its called backscatter

http://www.spamresource.com/2007/02/backsc...-i-stop-it.html

Backscatter: What is it? How do I stop it?

[randomnut]

Thanks very much budman, it looks like we need to enable recipient filtering in exchange.

[CreightonB]

Ya, its anouying as hell. I've also heard it called RDNS spam and spam bouncing.

[randomnut]

Is it also a good idea to have 'Sender ID validation" set to "Delete. The message will be accepted and deleted, no NDR will be sent back to the sender"?

Would this cause any problems?

Any other exchange settings that can be enabled to help alleviate this problem?

thanks

[Trajik 2600]

Additionally to randomnut - if you're going to enable recipient filtering, you should also enable tarpitting so that valid email addresses cannot be harvested from your mail server. A quick Google for Exchange tarpitting should help you out.

@CreightonB - close - it's Reverse NDR spamming. As in "non-delivery report".

HTH!

[CreightonB]

Oh ya! Dur, ndr =] I hadn't had to deal with it in a long time.

[randomnut]

Thanks very much for your input everyone. So the plan of action is:

Enable recipient filtering

Enable tarpitting

reboot

Anything else that will help? With those 2 it should help reduce NDR spam?

thanks

EDIT: Also, will tarpitting interfere with the 3rd party spam filtering we're using?

Edited April 15, 2008 by randomnut

[neurotronix]

randomnut~

Hello. I'm new here.

Did you implement those 'things,' and did they work out?

I'm getting bombarded every other minute, or so and really would hate to have to change my email (as suggested by our IT guys).

[randomnut]

Hey neurotronix,

Yes I implemented several things which seems to have sorted the problem out:

- enabled recipient filtering in exchange

- enabled tarpitting

- added the zen.spamhaus.org list to exchange to help drop known spam if it gets past the spam filter

- set our spam filter to have LDAP connectivity with our domain controller and not to pass any mail to people not in ADUC

Now we have a lot fewer emails getting through. Hope it helps.