Strange returned emails - virus?

[sjp63]

Ive had half a dozen "returned emails" that were sent to addresses ive never heard of recently. My virus protection is bang up to date McAfee and ive scanned but nothing found. The email was sent from/returned to a variation of my email address, so instead of [e-mail] it was [e-mail]. Who or what is IKB???!!!!!

[percy flage]

I get the same. Something to do with the mail harvesting bots that trawl websites. Not viral, AFAIK.

[touching cloth]

Had this a few times, simply spam being sent as if from your address(es), not hard to do and does not mean your pc has been hacked, merely that someone has your email address and has basically put it in the from box. You can probably expect a bit of a deluge for a few days and then it should die off again.

[mikef]

This was the reason I left demon. Instead of using the normal email format [e-mail] like everyone else, they use [e-mail]. Guys, if everyone else does it the other way, it's for a reason. When a spammer picks up on your domain name, a common technique is to generate thousands of "likely" usernames then blast all of those against the domain. Guess where they get delivered to...

[Tripps]

Some of these are clever messages to get past spam filters, on an Exchange based system they appear as delivery error messages which cannot be junk mail filtered, thus I guess they think someone is more likely to investigate or read the message.

[Leftie]

I have had a few like that and the recipient was [e-mail] as I ecall. No idea who it might be. Just a ploy to get me to open them I thought.

[rebelstar]

mikef said:

This was the reason I left demon. Instead of using the normal email format [e-mail] like everyone else, they use [e-mail]. Guys, if everyone else does it the other way, it's for a reason. When a spammer picks up on your domain name, a common technique is to generate thousands of "likely" usernames then blast all of those against the domain. Guess where they get delivered to...

Actually I find it a really good way to deal with spam. Every time I sign up to a new website I use a different name so I can identify where the spam is coming from.

[__LEE__]

sjp63 said:

Ive had half a dozen "returned emails" that were sent to addresses ive never heard of recently. My virus protection is bang up to date McAfee and ive scanned but nothing found. The email was sent from/returned to a variation of my email address, so instead of [e-mail] it was [e-mail]. Who or what is IKB???!!!!!

This is normally caused by someone spoofing your email address. I.e. They send an email from an open relay somewhere pretending to be you and then when the email hits an exchange server or the like but the address is not valid on their domain the exchange server produces an NDR (Non delivery report) and sends it back to the sender which in their case
is you.

An example:

I find a unprotected (open relay) exchange server and mass send out emails pretending to be you i.e. sent from [e-mail] using one of the mass mailer programs. The email then hits a random address on someone elses domain i.e. [e-mail] but that email address does not exist so the server on the other side generates a non delivery report which gets sent to the sender i.e. [e-mail] which then gets delivered to you.

Can you copy the text from one of the emails into a post so we can prove this is the case?

[Scraggles]

get lots of them, they all get bounced and deleted

got a main email address - [e-mail] and [e-mail] - get all manner of names and usernames that do reach me, but as not the one I use, they are ignored

[glassman]

I'm yet to meet a computer hacker / internet criminal / email fraudster. The day I get to see one, I have a couple of years worth of:

PEOPLE LIKE THAT P1551NG ME OFF ENOUGH TO WANT TO TORTURE THEM WITH A PAIR OF PLIERS AND A BLOW TORCH!

Thank you

[sjp63]

This is what is happening. Still getting them but fewer each day. Should my system have protected against this?

__LEE__ said:

sjp63 said:

Ive had half a dozen "returned emails" that were sent to addresses ive never heard of recently. My virus protection is bang up to date McAfee and ive scanned but nothing found. The email was sent from/returned to a variation of my email address, so instead of [e-mail] it was [e-mail]. Who or what is IKB???!!!!!

This is normally caused by someone spoofing your email address. I.e. They send an email from an open relay somewhere pretending to be you and then when the email hits an exchange server or the like but the address is not valid on their domain the exchange server produces an NDR (Non delivery report) and sends it back to the sender which in their case
is you.

An example:

I find a unprotected (open relay) exchange server and mass send out emails pretending to be you i.e. sent from [e-mail] using one of the mass mailer programs. The email then hits a random address on someone elses domain i.e. [e-mail] but that email address does not exist so the server on the other side generates a non delivery report which gets sent to the sender i.e. [e-mail] which then gets delivered to you.

Can you copy the text from one of the emails into a post so we can prove this is the case?

[thepassenger]

sjp63 said:

This is what is happening. Still getting them but fewer each day. Should my system have protected against this?

As it's a spammer faking either the reply-to or from fields their is nothing either you or the ISP can do about it.
Look at it this way in Outlook / O Express / Thunderbird or any other e-mail program nothing stops you putting in a fake e-mail address and sending a message. I have one set to [e-mail] which I use to slag off spammers who get through my SA setup (I trawl their e-mail for the correct address rather than just hit 'reply').

Dealing with spam in all of it's glorious forms is one of the most resource intensive things a mail server can do; my small machine in London generally gets eaten alive by SpamAssassin (spamd's are using 200MB RAM and regularly max the processor) and this is handling 2 domains and a total of 6 e-mail addresses. I'd probably go in to a murderous rampage seeing the resources someone like Jamie would need to throw at the problem.

[sjp63]

Im still getting about 4 per day its a pain in the butt!

thepassenger said:

sjp63 said:

This is what is happening. Still getting them but fewer each day. Should my system have protected against this?

As it's a spammer faking either the reply-to or from fields their is nothing either you or the ISP can do about it.
Look at it this way in Outlook / O Express / Thunderbird or any other e-mail program nothing stops you putting in a fake e-mail address and sending a message. I have one set to [e-mail] which I use to slag off spammers who get through my SA setup (I trawl their e-mail for the correct address rather than just hit 'reply').

Dealing with spam in all of it's glorious forms is one of the most resource intensive things a mail server can do; my small machine in London generally gets eaten alive by SpamAssassin (spamd's are using 200MB RAM and regularly max the processor) and this is handling 2 domains and a total of 6 e-mail addresses. I'd probably go in to a murderous rampage seeing the resources someone like Jamie would need to throw at the problem.

[anonymous-user]

We have been inundated with these damn things for about the last 10 days. it had been tailing off a bit but there's another 20 this morning! The spammer is using random letters followed by our proper address along the lines,

[e-mail]

so they are working through billions of letter combinations.

The biggest problem is that other servers are reacting to this deluge of spam by blocking anything which contains the genuine ending of our address, for example,

@pistonheads.aol.co.uk

The result is we are becoming unable to get our genuine messages through to people we are trying to contact. What a PITA! These people are utter scum.

[meeja]

rebelstar said:

Actually I find it a really good way to deal with spam. Every time I sign up to a new website I use a different name so I can identify where the spam is coming from.

I do the same..... I use the "name of the website@mydomain"

that way, I can directly accuse them of selling my details when the spam pops into my mailbox!