I've been receiving quite a few 'failed mail' reports for message i've never sent. I saw alot of this a year or two ago. As best as i could tell then, some form of 'malware' was harvesting my e-mail address from an infected PC's address book[s]. I then had my e-mail address intermittently blocked by a several ISPs. The problem mostly went away on its own, albeit i did report the problem to a couple of ISPs.
I'm seeing similar reports in the past week or so. Also, no headers have been provided, so i can't diagnose this on my own right now. I also go copies of a couple of my own postings, and the 'From:' line in my message was "amsat-bb-bounces@amsat.org [mailto:amsat-bb-bounces@amsat.org]" (as i read the AMSAT-BB on-line due to its volume). I suspect the malware is thus also sending infected e-mail using 'amsat-bb-bounces@amsat.org' and perhaps your ISP, legitimately on auto-pilot, is blocking messages from this Sender. The fix to this will probably vary from ISP to ISP.
This is not a pretty picture and i see no easy fixes.
-- KD6PAG (Networking Old-Timer, Satellite QRPer)
[Note: If i'm in your address book, please replace 'qsl.net' with 'amsat.org'.
I never send unsolicited binary attachments, and so if you receive anything purportedly from kd6pag@qsl.net that isn't signed with my callsign, then it probably isn't from me. There's a new worm/virus out there that appears to be sending infected messages with addresses it finds in their hosts' address books. If you getting strange 'failed mail' messages, that's what going on.]
On Oct 20, 2006, at 9:51 PM, John Mock KD6PAG wrote:
I'm seeing similar reports in the past week or so. Also, no headers have been provided, so i can't diagnose this on my own right now. I also go copies of a couple of my own postings, and the 'From:' line in my message was "amsat-bb-bounces@amsat.org [mailto:amsat-bb- bounces@amsat.org]" (as i read the AMSAT-BB on-line due to its volume). I suspect the malware is thus also sending infected e-mail using 'amsat-bb- bounces@amsat.org' and perhaps your ISP, legitimately on auto-pilot, is blocking messages from this Sender. The fix to this will probably vary from ISP to ISP.
Generally, most spam prevention tools ignore any email address they find inside a spam message, since they are so easily forged. Typically, you look at the IP address the spam was sent to your systems from, since you trust your own systems to correctly report the incoming IP address. What is probably happening is that the mail forwarding service for callsign@amsat.org is forwarding along spam that was sent to various ham's aliases. The ISPs look at the IP address the spam is arriving from, and when a certain threshold is reached, starts blocking all email from that IP address, assuming it's all spam. If both the forwarding service and the mailing list are sent from the same AMSAT machine, both will get blocked.
Bob N2KGO
participants (2)
-
John Mock KD6PAG -
Robert Snyder