You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Dennis German <DG...@Real-World-Systems.com> on 2009/08/01 14:19:24 UTC
blacklisting a forger
I have received many emails in the last hour which were undeliverable,
NOT sent by me.
It seems someone is forging usernames in my domain Real-World-Systems.com
as the "from:" and the "return-path:" .
Received-From-MTA: dns;triband-mum-59.184.51.13.mtnl.net.in
I have sent a message to abuse@mntl.net.in and helpdesk@mtnl.net.in but
no response.
How does an MTA get blacklisted??
Re: blacklisting a forger
Posted by mouss <mo...@ml.netoyen.net>.
Terry Carmen a écrit :
>> On Sat, 1 Aug 2009 19:33:40 -0400
>> "Terry Carmen" <te...@cnysupport.com> wrote:
>>
>>> The backscatter would not have been received, since the sender is on
>>> a number of RBLs.
>> It's the IP address of the botnet PC that's on the RBLs, the backscatter
>> doesn't come from there, it comes from the recipients of the spam.
>>
>> See: http://en.wikipedia.org/wiki/Backscatter_(e-mail)
>
> Regardless of whether or not the message was backscatter, The sending system
> (triband-mum-59.184.51.13.mtnl.net.in) is blacklisted,
>
- bot at triband-* sent junk to silly.server.example.
- silly.server.example didn't reject it. instead it bounced it to OP
- the bounce includes infos about which host sent the original junk to
silly.server.example, and this is triband-*
so for OP, this is backscatter, and RBL/DNSBL is of no help.
Re: blacklisting a forger
Posted by Magnus Holmgren <ho...@lysator.liu.se>.
On söndagen den 2 augusti 2009, RW wrote:
> On Sat, 1 Aug 2009 21:34:04 -0400
>
> "Terry Carmen" <te...@cnysupport.com> wrote:
> > > Of course it's blacklisted, but would you care to explain how
> > > rejecting mail from 59.184.51.13 helps, when the backscatter
> > > doesn't come from there?
> >
> > According to the OP, that's the IP he received the message from.
>
> No, he quoted the following:
>
> Received-From-MTA: dns;triband-mum-59.184.51.13.mtnl.net.in
>
> as I already said: "Received-From-MTA is a standard DSN field set by
> the MTA generating the DSN."
So it might perhaps be worthwhile to extract that field and test it against
some RBLs?
--
Magnus Holmgren holmgren@lysator.liu.se
(No Cc of list mail needed, thanks)
Re: blacklisting a forger
Posted by RW <rw...@googlemail.com>.
On Sat, 1 Aug 2009 21:34:04 -0400
"Terry Carmen" <te...@cnysupport.com> wrote:
>
> > Of course it's blacklisted, but would you care to explain how
> > rejecting mail from 59.184.51.13 helps, when the backscatter
> > doesn't come from there?
>
> According to the OP, that's the IP he received the message from.
No, he quoted the following:
Received-From-MTA: dns;triband-mum-59.184.51.13.mtnl.net.in
as I already said: "Received-From-MTA is a standard DSN field set by
the MTA generating the DSN."
The DSN could have come from anywhere *except*
triband-mum-59.184.51.13.mtnl.net.in
Re: blacklisting a forger
Posted by RW <rw...@googlemail.com>.
On Sat, 1 Aug 2009 20:44:27 -0400
"Terry Carmen" <te...@cnysupport.com> wrote:
>
> > On Sat, 1 Aug 2009 19:33:40 -0400
> > "Terry Carmen" <te...@cnysupport.com> wrote:
> >
> >> The backscatter would not have been received, since the sender is
> >> on a number of RBLs.
> >
> > It's the IP address of the botnet PC that's on the RBLs, the
> > backscatter doesn't come from there, it comes from the recipients
> > of the spam.
> >
> > See: http://en.wikipedia.org/wiki/Backscatter_(e-mail)
>
> Regardless of whether or not the message was backscatter, The sending
> system (triband-mum-59.184.51.13.mtnl.net.in) is blacklisted,
Of course it's blacklisted, but would you care to explain how rejecting
mail from 59.184.51.13 helps, when the backscatter doesn't come from
there?
Re: blacklisting a forger
Posted by Terry Carmen <te...@cnysupport.com>.
> On Sat, 1 Aug 2009 19:33:40 -0400
> "Terry Carmen" <te...@cnysupport.com> wrote:
>
>> The backscatter would not have been received, since the sender is on
>> a number of RBLs.
>
> It's the IP address of the botnet PC that's on the RBLs, the backscatter
> doesn't come from there, it comes from the recipients of the spam.
>
> See: http://en.wikipedia.org/wiki/Backscatter_(e-mail)
Regardless of whether or not the message was backscatter, The sending system
(triband-mum-59.184.51.13.mtnl.net.in) is blacklisted,
Terry
Re: blacklisting a forger
Posted by RW <rw...@googlemail.com>.
On Sat, 1 Aug 2009 19:33:40 -0400
"Terry Carmen" <te...@cnysupport.com> wrote:
> The backscatter would not have been received, since the sender is on
> a number of RBLs.
It's the IP address of the botnet PC that's on the RBLs, the backscatter
doesn't come from there, it comes from the recipients of the spam.
See: http://en.wikipedia.org/wiki/Backscatter_(e-mail)
Re: blacklisting a forger
Posted by Terry Carmen <te...@cnysupport.com>.
> On Sat, 1 Aug 2009 11:04:35 -0400
> "Terry Carmen" <te...@cnysupport.com> wrote:
>
>>
>> > On Sat, 1 Aug 2009 10:02:54 -0400
>> > "Terry Carmen" <te...@cnysupport.com> wrote:
>> >
>> >>
>> >> > I have received many emails in the last hour which were
>> >> > undeliverable, NOT sent by me.
>> >> > It seems someone is forging usernames in my domain
>> >> > Real-World-Systems.com as the "from:" and the "return-path:" .
>> >> >
>> >> > Received-From-MTA: dns;triband-mum-59.184.51.13.mtnl.net.in
>> >> >
>> >> >
>> >> > I have sent a message to abuse@mntl.net.in and
>> >> > helpdesk@mtnl.net.in but no response.
>> >> >
>> >> > How does an MTA get blacklisted??
>> >>
>> >> You'll probably never get a response, and even if you do, nothing
>> >> will happen.
>> >>
>> >> The easiest thing to do is configure your mail server use an RBL,
>> >> which would have stopped this before you received it.
>> >
>> > No it wouldn't. triband-mum-59.184.51.13.mtnl.net.in is almost
>> > certainly an infected PC, and the backscatter is coming from
>> > third-party servers.
>>
>>
>> The IP address is listed on almost two dozen RBLs.
>
> sure, but the original poster wrote:
>
> "I have received many emails in the last hour which were
> undeliverable, NOT sent by me. It seems someone is forging usernames in
> my domain"
The backscatter would not have been received, since the sender is on a number
of RBLs.
Terry
>
> In other words he is receiving backscatter. And Received-From-MTA
> is a standard DSN field set by the MTA generating the DSN.
>
--
CNY Support, LLC
Web. Database. Business
http://www.cnysupport.com
Re: blacklisting a forger
Posted by RW <rw...@googlemail.com>.
On Sat, 1 Aug 2009 11:04:35 -0400
"Terry Carmen" <te...@cnysupport.com> wrote:
>
> > On Sat, 1 Aug 2009 10:02:54 -0400
> > "Terry Carmen" <te...@cnysupport.com> wrote:
> >
> >>
> >> > I have received many emails in the last hour which were
> >> > undeliverable, NOT sent by me.
> >> > It seems someone is forging usernames in my domain
> >> > Real-World-Systems.com as the "from:" and the "return-path:" .
> >> >
> >> > Received-From-MTA: dns;triband-mum-59.184.51.13.mtnl.net.in
> >> >
> >> >
> >> > I have sent a message to abuse@mntl.net.in and
> >> > helpdesk@mtnl.net.in but no response.
> >> >
> >> > How does an MTA get blacklisted??
> >>
> >> You'll probably never get a response, and even if you do, nothing
> >> will happen.
> >>
> >> The easiest thing to do is configure your mail server use an RBL,
> >> which would have stopped this before you received it.
> >
> > No it wouldn't. triband-mum-59.184.51.13.mtnl.net.in is almost
> > certainly an infected PC, and the backscatter is coming from
> > third-party servers.
>
>
> The IP address is listed on almost two dozen RBLs.
sure, but the original poster wrote:
"I have received many emails in the last hour which were
undeliverable, NOT sent by me. It seems someone is forging usernames in
my domain"
In other words he is receiving backscatter. And Received-From-MTA
is a standard DSN field set by the MTA generating the DSN.
Re: blacklisting a forger
Posted by Terry Carmen <te...@cnysupport.com>.
> On Sat, 1 Aug 2009 10:02:54 -0400
> "Terry Carmen" <te...@cnysupport.com> wrote:
>
>>
>> > I have received many emails in the last hour which were
>> > undeliverable, NOT sent by me.
>> > It seems someone is forging usernames in my domain
>> > Real-World-Systems.com as the "from:" and the "return-path:" .
>> >
>> > Received-From-MTA: dns;triband-mum-59.184.51.13.mtnl.net.in
>> >
>> >
>> > I have sent a message to abuse@mntl.net.in and helpdesk@mtnl.net.in
>> > but no response.
>> >
>> > How does an MTA get blacklisted??
>>
>> You'll probably never get a response, and even if you do, nothing
>> will happen.
>>
>> The easiest thing to do is configure your mail server use an RBL,
>> which would have stopped this before you received it.
>
> No it wouldn't. triband-mum-59.184.51.13.mtnl.net.in is almost
> certainly an infected PC, and the backscatter is coming from
> third-party servers.
The IP address is listed on almost two dozen RBLs.
Terry'
Re: blacklisting a forger
Posted by RW <rw...@googlemail.com>.
On Sat, 1 Aug 2009 10:02:54 -0400
"Terry Carmen" <te...@cnysupport.com> wrote:
>
> > I have received many emails in the last hour which were
> > undeliverable, NOT sent by me.
> > It seems someone is forging usernames in my domain
> > Real-World-Systems.com as the "from:" and the "return-path:" .
> >
> > Received-From-MTA: dns;triband-mum-59.184.51.13.mtnl.net.in
> >
> >
> > I have sent a message to abuse@mntl.net.in and helpdesk@mtnl.net.in
> > but no response.
> >
> > How does an MTA get blacklisted??
>
> You'll probably never get a response, and even if you do, nothing
> will happen.
>
> The easiest thing to do is configure your mail server use an RBL,
> which would have stopped this before you received it.
No it wouldn't. triband-mum-59.184.51.13.mtnl.net.in is almost
certainly an infected PC, and the backscatter is coming from
third-party servers.
Re: blacklisting a forger
Posted by Terry Carmen <te...@cnysupport.com>.
> I have received many emails in the last hour which were undeliverable,
> NOT sent by me.
> It seems someone is forging usernames in my domain Real-World-Systems.com
> as the "from:" and the "return-path:" .
>
> Received-From-MTA: dns;triband-mum-59.184.51.13.mtnl.net.in
>
>
> I have sent a message to abuse@mntl.net.in and helpdesk@mtnl.net.in but
> no response.
>
> How does an MTA get blacklisted??
You'll probably never get a response, and even if you do, nothing will happen.
The easiest thing to do is configure your mail server use an RBL, which would
have stopped this before you received it.
http://www.mxtoolbox.com/blacklists.aspx
Terry
Re: blacklisting a forger
Posted by Benny Pedersen <me...@junc.org>.
On Sat, August 1, 2009 14:19, Dennis German wrote:
> I have received many emails in the last hour which were undeliverable,
> NOT sent by me.
backscattering, block this ip, and send a mail to the postmaster, whois ip might say what email
there system accept non existsing users, or some other bad lda that bounce when mta have
accepted it
> It seems someone is forging usernames in my domain Real-World-Systems.com
> as the "from:" and the "return-path:" .
http://old.openspf.org/wizard.html?mydomain=Real-World-Systems.com&submit=Go!
change all to -all (softfail vs fail)
also see the later part for how to add zones to bind/djbdns
> Received-From-MTA: dns;triband-mum-59.184.51.13.mtnl.net.in
> I have sent a message to abuse@mntl.net.in and helpdesk@mtnl.net.in but
> no response.
block the client ip then
check that the ip is not in dnswl or dnsbl lists already
> How does an MTA get blacklisted??
start accepting emails and setup sieve to reject (dovecot sieve have this bug)
temporary i have disabled reject in my sieve to not do this
--
xpoint