|
02-01-2007, 20:57
|
#1 | |||
|
Long Island Iced Tea
Join Date: Sep 2006
Location: Brighton, UK
Posts: 285
|
Is it spam?
Someone has suggested that signing up to the website I run has resulted in his e-mail receiving spam, I have asked the Administrator Team to change their passwords and check their machines (only way I can think of that you could "use" phpBB to get e-mail addresses). I have checked the hosting and removed everything that isn't used at the moment, and checked the login log for my web host in case something was in there.
I asked the person in question to send me the "spam" and this is what I got back: Quote:
Quote:
Quote:
Does anyone know enough about this stuff to explain how this could happen? |
|||
|
|
|
02-01-2007, 21:40
|
#2 |
|
Preparing more tumbleweed
Join Date: Jun 2006
Location: Hawaii
Posts: 6,038
|
If I'm reading those right whats happened is someone is spoofing his address as a source of spam. What he's seeing are the bouncebacks from other e-mail servers rejecting the e-mails.
The first one is where someone has it setup to only allow e-mails from people that will click on the link first to confirm they are a valid user (that beats most bots that get used to send spam as they ignore any replies.) In this case the e-mail has attempted to go to r.choueiri@chlfirm.com The second one is another bounceback as a consequence of trying to be sent to an invalid address. The third one is possibly tied in with the first, I'm not quite certain what the implications are there. I'm going to make a fair stab at the domain being one like my freeserve one, where you've got an infinite number of e-mail addresses theoretically, taking the form: whatever-you-chose@username.isp.co.uk As is a huge flaw and well known about in the ISP (and thus these services are not offered to new users), as soon as a spammer trawls your domain from anywhere, then they'll send it as if coming from anything before the @ symbol. Currently on my home's freeserve account we're getting between 600 - 800 e-mails all sent from addresses we don't use. Hence I've stopped using it too as its too much hassle trawling through the spam. There is nothing that can be done, and I'd argue its highly unlikely its come from having signed up to your server, its something completely unavoidable for him. Spoofing an address for e-mails is simple. I can very easily connect to any mail server and send a message pertaining to be from any e-mail address under the sun, even using basic command line instructions: telnet mail.domainname.co.uk 25 HELO anotherdomainname.co.uk RCPT TO: <destinationaddress@domainname.co.uk> MAIL FROM: <madeupaddress@domainname.co.uk> DATA Its really that simple. No checking is done (unless the ISP uses Sender Mail Verification, something more and more prevelant)
__________________
Mal: Define "interesting"? Wash: "Oh, God, oh, God, we're all gonna die"? |
|
|
|
|
02-01-2007, 21:47
|
#3 | |
|
Long Island Iced Tea
Join Date: Sep 2006
Location: Brighton, UK
Posts: 285
|
Quote:
 My main problem now is that he claims that the account was spam free before he signed up. And there is no way that I can prove that it wasn't. Thanks Garp |
|
|
|
|
|
02-01-2007, 23:07
|
#4 | |
|
Screaming Orgasm
Join Date: Jul 2006
Location: Newbury
Posts: 15,194
|
Quote:
Some ISPs do still give out anything@your-domain email addresses. The problem isn't that spammers can use these as fake From: addresses (they can do that anyway - just pick any old domain and use info@, sales@, webmaster@, admin@ and so forth), the problem is that ISPs that offer these set up the default email account as a catch-all (so anything unrecognised goes there), and don't provide a means of stopping such emails. My PlusNet account has this problem. Fortunately spammers have (so far) confined themselves to two addresses and I've had them both black holed (set up so that anything sent there just goes directly into the bin without ever touching the real email account). Last edited by Mark; 02-01-2007 at 23:09. |
|
|
|
|
|
03-01-2007, 08:39
|
#5 | |
|
Long Island Iced Tea
Join Date: Sep 2006
Location: Brighton, UK
Posts: 285
|
Quote:
If it was in his signature he has removed it since. He dosn't seem to be pushing the matter. |
|
|
|
|
 |
| Thread Tools | |
| Display Modes | |
|
|
Linear Mode
