Returned E-Mails!!

[Mayennaise]

I keep getting emails from Mail Demon stating that my outward email  - that I didn't send in the first place -could not be delivered !!

When I have alook at the address I am supposed to have sent it to - it  is no-one I know. There is always an attachementthat I never open but how are these wretched things coming back to me when I never sent them in the first place and more importantly - can I stop them??

Mayo

[Will]

Your address has been 'spoofed' - i.e. listed as the return address for spam e-mails, when the real return address is hidden. Most likely because somebody who had your address in their contact list got infected by a virus or worm. Alternatively, if the so-called returned messages have attachments, they could be viruses themselves, disguised as returned messages from you.

I don't think there is anything you can do, other than ignore the messages and delete them.

[Dick Smith]

I get thousands! I suspect because I have a strong 'web presence' I am collected by assorted Russians etc and sold off on a CD of 1m addresses....

[Ron Avery]

Don't think this has anything to do with spam coming in , if you are getting returned E mails that cannot be delivered then it is your PC that is sending them out, but they won't be in your outbox because you probably have a virus or worm.

 A worm has got into your PC via an E mail and is sending out E mails to any address it can find and also using your PC as a forwarding station for other people's E mails, the fact that these E mails have attachments, which are the worm being transmitted on would suggest that it is indeed a worm in your PC.  Don't be too alarmed, it is relatively harmless although the subject headings of some of the Emails might upset your gran if she gets one.

You need to do a system scan if you have Norton or Macafee AND run something like SPYBOT or EVIDO which can do a free scan, this will detect the worm and delete or quarentine it.

[Nick Trollope]

Not so, Ron. This spoofing is "normal" nowadays, it is used by spammers to overcome blocked senders lists and spam filters. None of these emails originated from the OPs machine. Like Dick my "aplaceinfrance" email address gets 30-ish of these a day (often from large corporates with good spam filtering) - always addressed to a random collection of letters @ aplaceinfranc.....

I occasionally get rude emails from some poor sod who has received the original spam. I tend to send a pro-forma reply saying "it ain't my fault".

Wills explaination is spot on.

Nothing one can do to stop it (the outgoing spamming) and little one can do to filter the returned mail.

[PossumGirl]

If your email address is spoofed, your PC is not sending out the mail, someone else's is.  It's just that your email address is in the "from" field, so the mail comes back to you.  This is a common problem and usually just disappears after awhile.  The good news is that the mails don't contain YOUR IP address, so you won't be blacklisted as a spammer.

PG

[Will]

Not necessarily, Ron - if you compare the complete message headers of one of these and a genuine e-mail that originates from your own computer, you will see that in the genuine e-mail the 'return address' and the 'from' field match: for example, a message from a tiscali.fr address will come via a recognisable server name, such as libertysurf or an IP address that ties in with your ISP. A forged message will show you as the return address, but you will see that the message really came from somewhere else altogether, usually in a completely different country. You need to know what you are looking for, but the difference is usually obvious. Spoofing the return address is very easy, and very common practice, for spammers. The anti-spam programs on most e-mail servers, i.e. the software that sends the messages back to you, is mostly rather crude and looks at the return address field rather than trying to find the genuine source, which means you get the blame rather than the sad person in Brazil who is really sending out the spam. The bad part of this is that your address can get blacklisted rather then the real source of the spam if the detection software is not very sophisticated - large corporate servers are able to work on the real sender's IP address but smaller ones may not.

What Ron describes above does happen of course, but even those of us who have full virus and spyware protection get the same, and in our cases the address is definitely spoofed. A word of warning, though - when the offending e-mail is returned as an attachment, do be very careful about opening it, as it could be a virus. Some misguided sods are sending viruses and worms disguised as returned e-mails.

As Dick says, if your e-mail address has been published on the internet, or if you suspect it has got into the wrong hands, then it could be used as a spoof return address as well as just for receipt of rubbish e-mails. But even if you have been very careful with it, it can still be disseminated through being in the contacts list on somebody else's computer which is infected by certain worms.

[YCCMB]

All of the above has recently happened to me, culminating one weekend during which I received 2500 e-mails in one Sunday (actually, in about 3 hours), all blocked by my spam filter, but clearly as a result of my address having been spoofed. That was about 3 months ago. This week, I sent e-mails to a couple of clients, and received the following, with the e-mails being bounced by their servers:

This is the SMTP Server program at host me.freeserve.com.

I'm sorry to have to inform you that your message could not be

be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can

delete your own text from the attached returned message.

The SMTP Server program

<*********e@cg.***co.uk>: host mx1.a-r.co.uk[213.152.57.59] said: 550

<********e@cg.***co.uk>, Recipient unknown (in reply to RCPT TO

command)

(Obviously, the asterisks are mine! This was the address I was mailing)

I sent the message to my ISP for an explanation, and received the following:

It appears that your email has been blocked by an anti-spam blacklist.

Some ISPs use blacklists managed by third party organisations, for

example Sorbs, SpamHaus and SpamCop, to help reduce the number of spam

messages received by their customer base. Unfortunately spammers use

Orange addresses (and other ISP's) harvested from infected PC's and

other sources as fake return addresses to cloak themselves. Commonly

these are reported as spam.

This then affects all Orange customers.

Orange regularly check all the most common black lists and take all

steps possible to remove our mail servers from the black list in

question. Unfortunately as we are in the hands of third party (and often

voluntary) organisations we cannot supply a fixed date on when this

matter will be resolved.

 

So, there you go. Fortunately, this only seems to be blocking a few of my outgoing messages and I can use hotmail to communicate with anyone whose server won't let me in. However, I was running firewalls, anti-spyware and malware programmes when this happened, and it still happened, so as everyone else has said, it doesn't look like you can stop it.

[Cassis]

Our normandie-chambres.co.uk email has been spoofed this past week.  We're receiving about 50-100 "undeliverable" messages a day - nothing like the scale of Croixblanche's!  Most of them disappear directly into our junk folder, so fortunately the inbox isn't badly affected.  I hope it is just a passing phase, though, as it makes checking the junk folder before cleaning it out a bit of a pain.