Scenario:

Spamsink email is spoofed in the From field. Email is sent to someone@example.com. Postmaster@example.com replies back to spamsink address saying email was blocked for some SPAM or Virus reason.

This email gets forwarded to my portal address for Spamforce.

What happens?

Well the postmaster shouldn't respond to a msg where the From: and To: fields are the same! ... But yeah it's going to happen .....

Oops, I noticed the problem...

From: tom@example.net
To: dick@example.com

Postmaster@example.com replies back to tom@example.net (the spamtrap).

Regarding bounces, there are legits and there are regularly faked bounces (suggesting that a message was sent by the confused recipient but couldn't be received) which attempts to deceive the recipient into opening the virus attachment. Clearly (and desirably) these would be logged as spam should they hit a spam-sink address.

Unsurprisingly, unwitting recipients are easily fooled by this easy spoof tactic and indeed why it is commonly employed. Furthermore, the deployment of spoofed bounces has largely out-moded this form of interactive server response due to security risks and their regularity, and it's my guess that an increasing proportion of spam sufferers would choose to ignore them anyway.

Bounced message notification could just as equally come from a hacker/spammer (commonly one-and-the same nowadays) with a virus attachment, or from a legitimate source. Also, there are many existing First-Alert faithful who regrettably make little attempt to properly check their messages and just report everything anyway - including all bounced reports.

There are also URLs that simply "black-hole" all misdirected incomings, so bounce reports can not actually be relied upon. Better perhaps to request a read receipt, though I fully accept that this is not perfect or relieble either.

Now should a bounce be reported due to a mistaken quoted "reply-to" address (which would also have to accurately match a spam-sink address or a URL supporting catchall spam reporting), then we do have rear-guard support by way of the First-Alert admins in cases where the message appears to be genuine. Furthermore, for users of Mailwasher choosing to see all bounced messages, it should be possible to filter against a whitelist (Friends list) with the salient characteristics of a bounce message.

Nevertheless, some legitimate bounces might be inadvertently missed by FA admins and logged, though the only result being to block any further bounce messages containing the exact same content until the "logged" duration times out.

Now in the case of Paul's two examples...

If a portal address is deemed to be dirty, does that cause information previously provided by it to be purged?

Sorry for the late reply

There are mechanisms to purge the database of false reports subsequently flagged as legit, as occurs with manual reports from Mailwasher users just reporting everything and causing legitimate messages to slip through the net.

For all reports via the portals, these are all being monitored by FA admins as a rear-guard action, and if there were a significant number of reports arriving via a "dirty" portal this should be quickly identified and the portal suspended or removed.

With more portals reporting spam, the ability to identify "Dirty" portals should improve - particularly where reports are not significantly reflected from other portals in a given time-frame.


Brendan.

Paul,
I have noticed a pattern in the spam I am recieving that attaches a mail worm. Each mail is 76k or 77k in size and carries the same IP address that has been logged in Symantec as an attack on my computer with backdoor trojans and similar nasties. I have a pretty good idea where they are coming from and have sent abuse reports to the ISP only to recieve a less than welcome reply requesting proof of abuse and adding :"For information regarding a customer, please provide us with a subpoena or court
order."
I have roughly 200 of these emails I saved, I sent approx. 50 to abuse@yahoo.com and still have had no reply. I am currently recording them in .jpg format to send to the ISP as proof of abuse originating from that ISP. I figure if I open any more it is just perpetuating more spam to my email address. I dont want to lose my yahoo mail address because I have had it along time. I think this is how many of us in our group are losing our accounts thru yahoo.
Am I going about this correctly or is there another way to handle this kind of harassment?
Almost every one of the mails are labeled mailer-daemon@lalala.com and are spoofed addresses of my family and friends email servers, like it is being spawned from my own address book. I have checked the email headers and they all originate from the same IP address no matter where it claims to come from. It is beginning to look as if my mailbox is being used as a spam spawning hole.
Do you have any suggestions or ideas I overlooked? I'm just not net-literate as to what I should do and then I stumbled onto your question here that is exactly what I'm dealing with.
Thank you,
Geminipussycat