🚀 go-pugleaf

Gordon Laurie <gordon@glaurie.demon.co.uk> wrote:

> Has anyone else been getting strange e-mails like this one?
> 
> >From: RSerr55702 <RSerr55702@aol.com>
> >Date: Thu, 8 Jan 1998 14:16:19 EST
> >To: Gordon@glaurie.demon.co.uk
> >Subject: ty
> >Organization: AOL (http://www.aol.com)
> 
> >I'm very excited to try this out. Thank you very much. If I could help you
> >with anything...
> 
> >rserr624@earthlink.net
> 
> I'm wondering if it's some new way of spammers trying to find genuine
> e-mail addresses. My theory goes that you get this crap message (I've had 2
> or 3 in the past few days), then you reply to it along the lines of "Sorry,
> don't know what you're talking about........" and then the spamming
> b'stards have you down as a "live" address.
> 
> Any comments? I'm I just getting more paranoid in my old age. 

This is, I'm told, something that spammers do.  Apparently, if you reply
to a bit of spam asking to be taken off the mailing list (as they
suggest you might like to do), the sole effect is to have you listed as
a genuine live address, which they can then sell for more money.

What I'd like to know is how to forge a bounce messsage.

Rowland.

-- 
Remove the animal for my email address:   rebecca@astrid.dog.u-net.com
Sorry - the spam got to me.          
PGP pub key A680B89D; fingerprint: F5605EAE F56F2C0B 818F3319 5227767F
                                   What?  Don't ask me - I don't know.

In article <B0DC2A59966823A0F2@0.0.0.0>,
gordon@glaurie.demon.co.uk (Gordon Laurie) wrote:

> Has anyone else been getting strange e-mails like this one?
> 
> >From: RSerr55702 <RSerr55702@aol.com>
> >Date: Thu, 8 Jan 1998 14:16:19 EST
> >To: Gordon@glaurie.demon.co.uk
> >Subject: ty
> >Organization: AOL (http://www.aol.com)
> 
> >I'm very excited to try this out. Thank you very much. If I could help you
> >with anything...
> 
> >rserr624@earthlink.net
> 
> I'm wondering if it's some new way of spammers trying to find genuine
> e-mail addresses. [snip]

My conclusion, too.  I got almost identical to Gordon's.

> I'm I just getting more paranoid in my old age.

Nice to see you're coming to your senses.

Simon.
-- 
Simon Slavin -- Computer Contractor. | If I ran usenet, the timestamp for
   http://www.hearsay.demon.co.uk    | anything posted between 2am and 5am
 Check email address for UBE-guard.  | would *blink*. -- Nancy Lebovitz
My s/ware deletes unread >3 UBEs/day.| Junk email not welcome at this site.

Steve Firth <filter@firthcom.demon.co.uk> wrote:

> Rebecca and Rowland <real-address-in-sig@flurbletigibbet.rhubarb.foobar>
> wrote:
> 
> > What I'd like to know is how to forge a bounce messsage.
> 
> Don't bother, use SIMS or AIMS and bounce them all properly.

Unfortunately SIMS can't be used with a Demon account to bounce mail
based on bad MAIL FROM addresses. The punts do *not* like being cut off
at this stage and the result is that SIMS will bounce all remaining
messages from that connection. Bouncing at RCPT TO is fine and gets rid
of the two-thirds of my junk which is badly addressed. (Usually the same
junk to three different addresses, so I get just one copy.)

By the way, no prizes for guessing that Demon blame Stalker for this and
the reply from the SIMS mailing list blames Demon... Not that I've had
any reply at all from Stalker themselves, despite e-mailing them.

Chris.

Steve Firth <filter@firthcom.demon.co.uk> wrote:

> Rebecca and Rowland <real-address-in-sig@flurbletigibbet.rhubarb.foobar>
> wrote:
> 
> > What I'd like to know is how to forge a bounce messsage.
> 
> Don't bother, use SIMS or AIMS and bounce them all properly.

I'd love to - can you explain what either of these are?

Rowland.

-- 
Remove the animal for my email address:   rebecca@astrid.dog.u-net.com
Sorry - the spam got to me.          
PGP pub key A680B89D; fingerprint: F5605EAE F56F2C0B 818F3319 5227767F
                                   What?  Don't ask me - I don't know.

In article <1d2q21l.123y7jp1ohvr9nN@p43.nas2.is4.u-net.net>,
real-address-in-sig@flurbletigibbet.rhubarb.foobar (Rebecca and wrote:

>Subject: Re: New Spam tactic?
>From: real-address-in-sig@flurbletigibbet.rhubarb.foobar (Rebecca and Rowland)
>Organization: The Pietertje Geeltje van der Sluis fan club
>Date: Mon, 12 Jan 1998 22:34:01 +0000
>Newsgroups: demon.tech.mac
>
>Steve Firth <filter@firthcom.demon.co.uk> wrote:
>
>> Rebecca and Rowland <real-address-in-sig@flurbletigibbet.rhubarb.foobar>
>> wrote:
>> 
>> > What I'd like to know is how to forge a bounce messsage.
>> 
>> Don't bother, use SIMS or AIMS and bounce them all properly.
>
>I'd love to - can you explain what either of these are?
>


Sims - Stalker Internet Mail Server

AIMS - Apple Internet Mail Server, now called Eudora Internet Mail Server

both are SMTP mail servers for the Mac.

Peter.

Steve Firth <filter@firthcom.demon.co.uk> wrote:

[snip really useful description]

Thanks :-)  (and thanks to Peter Gradwell too)

> However as Chris Bennett pointed out,
> the mechanism used by SIMS doesn't get on well with the punts. However
> if you have a leased line connection and don't use the punts then it
> works just fine.

Erm, what are these punts? (if you'll excuse my ignorance again)

> Try http://www.stalker.com/ to get a copy of SIMS, I think the other
> should be on the Qualcomm site.

Righto - thanks.

Rowland.

-- 
Remove the animal for my email address:   rebecca@astrid.dog.u-net.com
Sorry - the spam got to me.          
PGP pub key A680B89D; fingerprint: F5605EAE F56F2C0B 818F3319 5227767F
                                   What?  Don't ask me - I don't know.

In article <1d2mawd.pidohm5shlrkN@p23.nas1.is4.u-net.net>,
real-address-in-sig@flurbletigibbet.rhubarb.foobar (Rebecca and wrote:

>Subject: Re: New Spam tactic?
>From: Rebecca and Rowland
>Organization: The Pietertje Geeltje van der Sluis fan club
>Date: Sat, 10 Jan 1998 02:56:13 +0000
>Newsgroups: demon.tech.mac
>
>Gordon Laurie <gordon@glaurie.demon.co.uk> wrote:
>
>> Has anyone else been getting strange e-mails like this one?
>> 
>> >From: RSerr55702 <RSerr55702@aol.com>
>> >Date: Thu, 8 Jan 1998 14:16:19 EST
>> >To: Gordon@glaurie.demon.co.uk
>> >Subject: ty
>> >Organization: AOL (http://www.aol.com)
>> 
>> >I'm very excited to try this out. Thank you very much. If I could help you
>> >with anything...
>> 
>> >rserr624@earthlink.net
>> 
>> I'm wondering if it's some new way of spammers trying to find genuine
>> e-mail addresses. My theory goes that you get this crap message (I've had 2
>> or 3 in the past few days), then you reply to it along the lines of "Sorry,
>> don't know what you're talking about........" and then the spamming
>> b'stards have you down as a "live" address.
>> 
>> Any comments? I'm I just getting more paranoid in my old age. 
>
>This is, I'm told, something that spammers do.  Apparently, if you reply
>to a bit of spam asking to be taken off the mailing list (as they
>suggest you might like to do), the sole effect is to have you listed as
>a genuine live address, which they can then sell for more money.
>
>What I'd like to know is how to forge a bounce messsage.
>
>Rowland.

Sure, I knew about the "remove" message getting you a ton of spam in
exchange, but these messages don't mention a mailing list at all, so it's
either genuine messages (which I really doubt) or else the spammy scumbags
have a new way of acquiring live e-addresses.

Apparently they can forge the senders address too. Not much point in
sending to AOL complaining about it either.


Gordon


One of these days I'm going to think of a decent sig line

In article <1d2rphs.1gm1bu3d2ln6dN@firthcom.demon.co.uk>,
filter@firthcom.demon.co.uk (Steve Firth) wrote:

> Rebecca and Rowland <real-address-in-sig@flurbletigibbet.rhubarb.foobar>
> wrote:
> 
> > I'd love to - can you explain what either of these are?
> 
> SIMS = Stalker Internet Mail Server
> AIMS = Apple      (ditto)
> 
> AIMS is now EIMS, I think but I'm having trouble remembering what the
> 'E' stands for is it Eudora? Both are Mac implementations of SMTP/POP3
> servers which support multiple clients from one host. The nice trick is
> that you can turn usernames on and off individually so that <hint> if
> someone posts a reply to filter@firthcom it is bounced with a NO SUCH
> USER reply.

Minor explanation appropriate: the mail wont be bounced back
immediately, it'll be bounced back when you haven't picked-up
any mail addressed to that person for 14 days.  You can actually
make POP3 mail software pick up only mail with the right user-
name by telling it to log into
                username+nodename@pop3.demon.co.uk
instead of               nodename@pop3.demon.co.uk.

This will have the same result: you only get mail addressed to
you and the rest gets bounced after 14 days of inactivity.

Of course, since most junk-emailers disguise the originating
address, it'll be bounced back to the wrong address.  I think.

BTW, if you use any of these methods, be aware that you are
/required/ to pay attention to mail addressed to
postmaster@your.site.  If mail to postmaster bounces it means
that there's something seriously wrong with the site.

Simon.
-- 
Simon Slavin -- Computer Contractor. | If I ran usenet, the timestamp for
   http://www.hearsay.demon.co.uk    | anything posted between 2am and 5am
 Check email address for UBE-guard.  | would *blink*. -- Nancy Lebovitz
My s/ware deletes unread >3 UBEs/day.| Junk email not welcome at this site.

slavins@hearsay.demon.nojunk.co.uk (Simon Slavin) wrote:

>BTW, if you use any of these methods, be aware that you are
>/required/ to pay attention to mail addressed to
>postmaster@your.site.

Also webmaster@ if you have a website.

Ben

-- 
Ben Lovejoy             | For special addresses
ben@lovejoy.demon.co.uk | (auto-responder, etc):
www.lovejoy.demon.co.uk | autoresponder@lovejoy.demon.co.uk

In article <1d2trln.rye7skojpr19N@p11.nas2.is3.u-net.net>,
real-address-in-sig@flurbletigibbet.rhubarb.foobar (Rebecca and wrote:

> Erm, what are these punts?

They're the machines which try to send you mail using SMTP.  Demon
calls them things like 'punt1.demon.co.uk'.

There's a description of how Demon's SMTP setup (including the punts)
works on my web site.

Simon.
-- 
Simon Slavin -- Computer Contractor. | If I ran usenet, the timestamp for
   http://www.hearsay.demon.co.uk    | anything posted between 2am and 5am
 Check email address for UBE-guard.  | would *blink*. -- Nancy Lebovitz
My s/ware deletes unread >3 UBEs/day.| Junk email not welcome at this site.

>Steve Firth <filter@firthcom.demon.co.uk> wrote:
>
>> Rebecca and Rowland <real-address-in-sig@flurbletigibbet.rhubarb.foobar>
>> wrote:
>> 
>> > What I'd like to know is how to forge a bounce messsage.
>> 
>> Don't bother, use SIMS or AIMS and bounce them all properly.

SIMS 1.6 is incredibly effective at bouncing spam (it even does a verify on
the sender's address), it cut my spam from 15-20 a day down to practically
nothing. Unfortunately for Demon customers it also cuts down drastically on
our normal mail too (as poined out by Chris Bennett) by bouncing any
further mail items Demon's relays send in the same stream as the spam item.

This is a problem limited to Demon and centers around the need for a reset
(RSET) command to be issued by Demon's server when a MAIL FROM command
fails during a transaction involving multiple mail items, as stated in RFC
281. 

Basically Demon doesn't send a RSET when a MAIL FROM fails, instead Demon's
server presents another MAIL FROM which puts the receiving server (SIMS)
out of sequence so SIMS sends an error (500 Unknown Command), to which
Demon's server responds with yet another MAIL FROM and so it continues
until all further mail in that transaction is bounced. Demon say according
to RFC 281 a RSET is not needed - presumably as a MAIL FROM can act as a
RSET, but Stalker say NOT in the case of multiple items in a transaction.

RFC 281 seems to be ambiguous on this so who knows.

_________________________________________________________________________
  Steve Linford                                steve [at] ultradesign.com
  UltraDesign Technology Ltd.                  http://www.ultradesign.com