I'm getting spam from myself
Discussion
My e-mail address was recently spoofed and I had a lot of bounce messages from the victims. Today I'm getting a lot of messages purporting to be from my own domain. Can anyone tell me where it's coming from and how I report it?
Thanks!
Return-Path: <mail@autograph.uk.com>
Received: from mx6.123-reg.co.uk (mx0.123-reg.co.uk [212.67.202.214])
by mail.metronet.co.uk (MetroNet Mail) with ESMTP id 7AD6641453C
for <johnsimpson@metronet.co.uk>; Thu, 14 Jul 2005 09:28:23 +0100 (BST)
Received: from [82.118.104.154] (helo=autograph.uk.com)
by mx6.123-reg.co.uk with esmtp (Exim 3.36 #5)
id 1Dsz4m-0000oF-00
for robert@autograph.uk.com; Thu, 14 Jul 2005 09:28:12 +0100
From: mail@autograph.uk.com
To: robert@autograph.uk.com
Subject: WE HAVE SUSPENDED YOUR ACCOUNT
Thanks!
Return-Path: <mail@autograph.uk.com>
Received: from mx6.123-reg.co.uk (mx0.123-reg.co.uk [212.67.202.214])
by mail.metronet.co.uk (MetroNet Mail) with ESMTP id 7AD6641453C
for <johnsimpson@metronet.co.uk>; Thu, 14 Jul 2005 09:28:23 +0100 (BST)
Received: from [82.118.104.154] (helo=autograph.uk.com)
by mx6.123-reg.co.uk with esmtp (Exim 3.36 #5)
id 1Dsz4m-0000oF-00
for robert@autograph.uk.com; Thu, 14 Jul 2005 09:28:12 +0100
From: mail@autograph.uk.com
To: robert@autograph.uk.com
Subject: WE HAVE SUSPENDED YOUR ACCOUNT
The subject - "We have suspended your account" is usually associated with a virus infected email to be honest, not spam. Viruses always fake sender details so it's not unusual to start getting failures to messages you didn't send.
Most likely someone you have emailed in the past has been infected by a virus.
The bottom-most received header should tell you where the email originated, but it's not guaranteed to be accurate.
It's still perfectly reasonable to report it, but don't expect much to happen when you do. Doesn't mean you shouldn't - I probably would, you never know when you might find an ISP with a social concience who will actually take action! (as in contact the PC owner and tell them they have a virus.)
The IP in question is
82.118.104.154
which gives us:
role: KeConnect Network Operations
address: Westgate House
address: Museum Street
address: Ipswich
address: Suffolk
address: IP1 1HQ
phone: +44 1473 403020
fax-no: +44 1473 400165
e-mail: networks@keme.net
admin-c: BIW1-RIPE
tech-c: BIW1-RIPE
tech-c: GH39-RIPE
tech-c: KFH4-RIPE
nic-hdl: KEME2-RIPE
remarks: KeConnect Network Operations
remarks: Please send abuse notifications to abuse@keme.net
mnt-by: KEME-MNT
source: RIPE # Filtered
Most likely someone you have emailed in the past has been infected by a virus.
The bottom-most received header should tell you where the email originated, but it's not guaranteed to be accurate.
It's still perfectly reasonable to report it, but don't expect much to happen when you do. Doesn't mean you shouldn't - I probably would, you never know when you might find an ISP with a social concience who will actually take action! (as in contact the PC owner and tell them they have a virus.)
The IP in question is
82.118.104.154
which gives us:
role: KeConnect Network Operations
address: Westgate House
address: Museum Street
address: Ipswich
address: Suffolk
address: IP1 1HQ
phone: +44 1473 403020
fax-no: +44 1473 400165
e-mail: networks@keme.net
admin-c: BIW1-RIPE
tech-c: BIW1-RIPE
tech-c: GH39-RIPE
tech-c: KFH4-RIPE
nic-hdl: KEME2-RIPE
remarks: KeConnect Network Operations
remarks: Please send abuse notifications to abuse@keme.net
mnt-by: KEME-MNT
source: RIPE # Filtered
Cheers Dobbo. That's amazingly close to home.... bit of a coincidence perhaps?
Anyway, I've managed to reconfigure my mailbox setting so that anything with a made-up prefix is automatically rejected. Mails passing that test land in Mailwasher which has been brilliant in allowing me to delete virus-laden trash.
Only then do they go to OE.
Anyway, I've managed to reconfigure my mailbox setting so that anything with a made-up prefix is automatically rejected. Mails passing that test land in Mailwasher which has been brilliant in allowing me to delete virus-laden trash.
Only then do they go to OE.
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff



