Comments on: Stopping Spoofing Spammers

Question: Stopping Spoofing Spammers

Hackworth — Sat, 17 Jan 2004 13:00:33 -0800

Anyone care to drop some knowledge about stopping spammers from spoofing your address? [more]

So, a company I do consulting work for seems to have a problem with a spammer spoofing their email address in either the "from" or the "reply to" field of their spam, as evidenced by the large amount of bounced mail they seem to be receiving. I'm pretty sure it's not a virus or trojan, as I spent a good amount of time scrubbing their computers for culprits, and have found nothing. What can you do in this situation? If we are able to track them down, could we file in small claims court?

By: fvw

fvw — Sat, 17 Jan 2004 13:10:32 -0800

They're probably operating from some east asian country, or from a proxy there. Rather little you can do, but is it a big problem? They usually use addresses at your domain that don't exist, and even if they do, filtering out the spam bounces isn't that hard. Your ISP might get a few abuse reports from misguided people thinking the spam is coming from you, but any halfway competent ISP will see it's just a few spoof headers.

In the long run, SPF might save us all.

By: adamrice

adamrice — Sat, 17 Jan 2004 13:16:19 -0800

It's worth mentioning that there are viruses that spoof your e-mail address from someone else's infected machine--if that machine has your address in its address book, you're fair game.

Some of these virus do mashup addresses, such as bobsaccount@alicesdomain.com

By: Zonker

Zonker — Sat, 17 Jan 2004 14:38:34 -0800

Much of this spam is sent through Asian relays, but that doesn't mean it's coming from Asia. The vast majority of it is originated by one of a fairly small number of U.S.-based spammers. If your client and its problem are both big enough, it may be worth suing them here in the U.S. Check out ROSKO for a good source of leads, or search the news.admin.net-abuse.email forum ("nanae") on Usenet (Google Groups is a good place to search it) for names that appear in the spam.

And like fvw said, use SPF.

By: wendell

wendell — Sat, 17 Jan 2004 14:43:43 -0800

I was personally surprised to find somebody had done this to my Yahoo Mail account, dumping several hundred rejection notices in my regular inbox and bulk box over a couple days. I notified the authoritative Yahoos (just to make sure they didn't blame me for sending out Paris Hilton Porn Spam) more than a month ago, it went away, and then it has come back in small bunches of 10-25 every few days. If the Yahoos can't (or won't) get a handle on the problem, who will?

I'll take some SPF-400 in a cocoa butter base, please...

By: Hackworth

Hackworth — Sun, 18 Jan 2004 11:49:29 -0800

well, crap.