[SC-Help] Re: Loads of spam showing "Delviery Status Notification", "Failure Notice" etc.

[Mike Easter]

rowan wrote:
> I've recently started receiving loads of spam messages which purport
> to be delivery failure messages. They are always addressed to a
> non-existent user at my domain, e.g. ojvnyo@, ejrzx@, rrl@ etc. They
> can have a variety of failure messages, and purport to tell me that a
> message that I sent to an address that I have never sent to in my life
> could not be delivered. The message sometimes contains a load of
> Base64 code, presumably some kind of malware, or a scanned page of
> text. Sometimes there's no obvious payload.

Spending a lot of words trying to describe some mail or spam doesn't
actually sufficiently describe it.

The best way to 'talk about' something spam around here is to show one
or more by posting a tracking URL or 'tracker'.

A tracker looks like:

Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z921452706z5f80c3536f02ccd15f431f0fc87fc372z

You get it by submitting one of those spams you are trying to describe
to the webparser, then copying the tracker, then cancelling the report,
then pasting the tracker in here.

That way anyone can look at the time and say things like, "That's not
actually a delivery status notification - failure, it is a bogus
ne.'  -or-  'Yep that's a DSN failure all right -- a spammer has elected
your address to be the bogus From.'

We can also comment on the reportability of servers which belatedly
bounce spam - or the non-reportability of spam which isn't mailed to
you - or other alternatives.  We can comment on what is the payload
which isn't obvious.  All that stuff.  But not with your description
words which can never be adequate for even remarking on the issue.

> Where are these messages coming from? Why have they suddenly started
> (or at least, suddenly started finding me)? Why are they getting
> through my ISP's spam filter (which is normally very good)? What can I
> do to get rid of them?

Comments after you post a tracker or two.

-- 
Mike Easter
kibitzer, not SC admin