Mailing List Archive: Qmail: users

receive spam mail when replying to qmail list

Index | Next | Previous | View Threaded

mbhangui at gmail

Feb 5, 2010, 8:05 PM

Post #1 of 6 (1212 views)
Permalink

receive spam mail when replying to qmail list

I am not sure who can address this. Whenever I reply to anyone on this
list, I get a autoreply which is a spam mail from some server in
Russia. The From header is actually the recipient of a genuine mail to
which I have replied to. Looks like some bot is subscribed to the
qmail mailing list.

This mail is a nuisance.

The headers are as below.

Received: by 10.142.48.18 with SMTP id v18cs145612wfv;
Fri, 5 Feb 2010 19:50:47 -0800 (PST)
Received: by 10.87.21.22 with SMTP id y22mr416266fgi.52.1265428246699;
Fri, 05 Feb 2010 19:50:46 -0800 (PST)
Return-Path: <ibrahim.harrani [at] gmail>
Received: from mail2.ks.pochta.ru (mail2.ks.pochta.ru [82.204.219.198])
by mx.google.com with ESMTP id 12si166472fgg.27.2010.02.05.19.50.46;
Fri, 05 Feb 2010 19:50:46 -0800 (PST)
Received-SPF: neutral (google.com: 82.204.219.198 is neither permitted
nor denied by domain of ibrahim.harrani [at] gmail)
client-ip=82.204.219.198;
Authentication-Results: mx.google.com; spf=neutral (google.com:
82.204.219.198 is neither permitted nor denied by domain of
ibrahim.harrani [at] gmail) smtp.mail=ibrahim.harrani [at] gmail
Message-Id: <4b6ce716.0c07560a.46a2.ffff96fcSMTPIN_ADDED [at] mx>
Received: from [82.204.219.57] (port=42614 helo=pochta.ru)
by mail2.ks.pochta.ru ( sendmail 8.13.3/8.13.1) with smtp id 1Ndbgz-0008QJ-OK
for mbhangui [at] gmail; Sat, 06 Feb 2010 06:50:45 +0300
Received: from stoneport.crypto.rites.uic.edu[131.193.36.27], helo
stoneport.crypto.rites.uic.edu by mx2.ks.pochta.ru with POCHTA.RU SMTP
SERVER Sat, 06 Feb 2010 06:50:45 +0300 envelope-from
qmail-return-138812-valilqpro=pochta.ru [at] list for
valilqpro [at] pochta
Received: (qmail 53018 invoked by uid 1004); 6 Feb 2010 04:02:04 -0000
Received: (qmail 52091 invoked from network); 6 Feb 2010 04:00:22 -0000
Received: from mail-yx0-f197.google.com (209.85.210.197) by cr.yp.to
with SMTP; 6 Feb 2010 04:00:22 -0000
Received: by yxe35 with SMTP id 35so4503349yxe.2 for
<qmail [at] list>; Fri, 05 Feb 2010 19:48:48 -0800 (PST)
Received: by 10.151.25.6 with SMTP id c6mr5420174ybj.51.1265428127751;
Fri, 05 Feb 2010 19:48:47 -0800 (PST)
Received: from ?192.168.2.115? ([125.22.193.162]) by mx.google.com
with ESMTPS id 22sm667062yxe.57.2010.02.05.19.48.45
(version=TLSv1/SSLv3 cipher=RC4-MD5); Fri, 05 Feb 2010 19:48:47 -0800
(PST)
Content-Type: text/plain; charset="koi8-r"
From: Ibrahim Harrani <ibrahim.harrani [at] gmail>
To: Manvendra Bhangui <mbhangui [at] gmail>
Subject: Re:Re: the mix of postfix and qmail
X-Autoreply: Yes
Date: Sat, 06 Feb 2010 06:50:45 +0300
X-SpamTest-Envelope-From: ibrahim.harrani [at] gmail
X-SpamTest-Group-ID: 00000000
X-SpamTest-Info: Profiles 12051 [Feb 6 2010]
X-SpamTest-Info: {received from trusted relay: common white list}
X-SpamTest-Method: white ip list
X-SpamTest-Rate: 0
X-SpamTest-Status: Trusted
X-SpamTest-Status-Extended: trusted
X-SpamTest-Version: SMTP-Filter Version 3.0.0 [0278], KAS30/Release

--
Regards Manvendra - http://www.indimail.org
Sent from Chennai, TN, India

slayer at letinet

Feb 6, 2010, 1:02 AM

Post #2 of 6 (1158 views)
Permalink

Re: receive spam mail when replying to qmail list [In reply to]

Manvendra Bhangui wrote:
> I am not sure who can address this. Whenever I reply to anyone on this
> list, I get a autoreply which is a spam mail from some server in
> Russia. The From header is actually the recipient of a genuine mail to
> which I have replied to. Looks like some bot is subscribed to the
> qmail mailing list.

Hello Manvendra!

You can write petition to Russian government, and ask to
make autoreplies illegal.

--
Best, Roman.

qmail at bruger

Feb 6, 2010, 7:22 AM

Post #3 of 6 (1154 views)
Permalink

Re: receive spam mail when replying to qmail list [In reply to]

Hi Manvendra,

I believe this thing, whatever it is, is pretending to be sending /
replying via the qmail list, right ?
-I got some of these too, but if it replies to the qmail list,
everyone would get them all the time, and it would loop on its own
messages.
I believe that someone subscribed their spam-bot to the list, and it
harvest the email addresses that way.
That's why I made a special POP-address for this list.
Right now, something just tried to connect from IP 201.20.1.5,
mail.letti.com.br, sender=(secure at letti com br), to send mail to my
list mail address, but for some reason, I didn't get anything (without
a filter). I believe that's the guy.
This could be someone running a mail server on windows, which is
infected by a spammer-virus, yes?
letti.com.br seems to have hosting services and mail services, so
something might have gone wrong there unintendedly.
-Is this where you get your 'replies' from ?

Love,
Jens

On 6. Feb, 2010, at 05:05, Manvendra Bhangui wrote:

> I am not sure who can address this. Whenever I reply to anyone on this
> list, I get a autoreply which is a spam mail from some server in
> Russia. The From header is actually the recipient of a genuine mail to
> which I have replied to. Looks like some bot is subscribed to the
> qmail mailing list.

mbhangui at gmail

Feb 6, 2010, 10:31 AM

Post #4 of 6 (1153 views)
Permalink

Re: receive spam mail when replying to qmail list [In reply to]

On Sat, Feb 6, 2010 at 8:52 PM, Jens Bauer <qmail [at] bruger> wrote:
> I believe this thing, whatever it is, is pretending to be sending / replying
> via the qmail list, right ?
When it replies, it takes the To: header and makes it the From, and
the From: header it makes it the To: header. As soon i am done with
replying to you in this mail, I am going to get a mail from this
server with the From: substituted with your email address. (i.e. I am
going to get a mail from Jens Bauer)

> -I got some of these too, but if it replies to the qmail list, everyone
> would get them all the time, and it would loop on its own messages.
This will not happen as the mail is always addressed to the person who
sends a mail to the qmail mailing list.

> I believe that someone subscribed their spam-bot to the list, and it harvest
> the email addresses that way.

Yes. This is a bot. But from what I can make out from the spelling, is
that the url seems to be some dating site.

> That's why I made a special POP-address for this list.
> Right now, something just tried to connect from IP 201.20.1.5,
> mail.letti.com.br, sender=(secure at letti com br), to send mail to my list
> mail address, but for some reason, I didn't get anything (without a filter).
> I believe that's the guy.
> This could be someone running a mail server on windows, which is infected by
> a spammer-virus, yes?
> letti.com.br seems to have hosting services and mail services, so something
> might have gone wrong there unintendedly.
> -Is this where you get your 'replies' from ?
>
letti.com.br is the other one which I have been ignoring for quite some time.

hugo.monteiro at fct

Feb 6, 2010, 10:40 AM

Post #5 of 6 (1150 views)
Permalink

Re: receive spam mail when replying to qmail list [In reply to]

On 02/06/2010 06:31 PM, Manvendra Bhangui wrote:
>
> letti.com.br is the other one which I have been ignoring for quite some time.
>
>

That letti.com.br is a stupid anti-spam callback system that someone
subscribing this list uses, and that doesn't know the difference between
messages originating in mailing lists and regular email.

R's,

Hugo Monteiro.

--
fct.unl.pt:~# cat .signature

Hugo Monteiro
Email : hugo.monteiro [at] fct
Telefone : +351 212948300 Ext.15307
Web : http://hmonteiro.net

Divis�o de Inform�tica
Faculdade de Ci�ncias e Tecnologia da
Universidade Nova de Lisboa
Quinta da Torre 2829-516 Caparica Portugal
Telefone: +351 212948596 Fax: +351 212948548
www.ci.fct.unl.pt apoio [at] fct

fct.unl.pt:~# _

jms1 at jms1

Feb 11, 2010, 7:38 AM

Post #6 of 6 (1036 views)
Permalink

Re: receive spam mail when replying to qmail list [In reply to]

On 2010-02-06, at 1022, Jens Bauer wrote:
>
> I believe this thing, whatever it is, is pretending to be sending / replying via the qmail list, right ?
> -I got some of these too, but if it replies to the qmail list, everyone would get them all the time, and it would loop on its own messages.

i've also been getting them, from 82.204.219.198. my guess is their "valilqpro [at] pochta" auto-responder is smart enough not to respond to its own messages. i dealt with it by adding this line to my qmail-smtpd service's tcpserver access control file:

82.204.219.198:allow,RBLSMTPD="-Please remove your valilqpro [at] pochta auto-responder from djb's qmail list."

i'm also doing the same for 165.69.4.4 with their classified [at] thecouriermail auto-responder.

i don't know if anybody other than djb has moderator access for this list, but i wish somebody would just remove these addresses already.

----------------------------------------------------------------
| John M. Simpson --- KG4ZOW --- Programmer At Large |
| http://www.jms1.net/ <jms1 [at] jms1> |
----------------------------------------------------------------
| http://video.google.com/videoplay?docid=-1656880303867390173 |
----------------------------------------------------------------

Attachments:

PGP.sig (0.19 KB)

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads