Anybody ever seen this one

jcoote

one of the lads asked me for a dig out and i have to say i've never seen this before

every time he checks his pop3 mail (signed up to indigofree) he recieves about 100-150 mails with the message did not send error.. but he's not sending the mails..he's never even heard of some of the sites he is recieving htem from


here's whats been sent to him

---

Original Message

---

From: <MAILER-DAEMON@eircom.net>
Subject: failure notice


> Hi. This is the qmail-send program at eircom.net.
> I'm afraid I wasn't able to deliver your message to the following addresses.
> This is a permanent error; I've given up. Sorry it didn't work out.
>
> <schnau@pramt.cs.uni-magdeburg.de>:
> Sorry, I couldn't find any host named pramt.cs.uni-magdeburg.de. (#5.1.2)
>
> <s@sebkr.de>:
> Sorry, I couldn't find any host named sebkr.de. (#5.1.2)
>
> <moebus@sunpool.cs.uni-magdeburg.de>:
> Sorry, I couldn't find any host named sunpool.cs.uni-magdeburg.de. (#5.1.2)
>
> <wischmeier@gmx.net>:
> 213.165.64.100 does not like recipient.
> Remote host said: 552 {mx015-rz3} The user's mailbox is full
> Giving up on 213.165.64.100.
>
> <timme@pramt.cs.uni-magdeburg.de>:
> Sorry, I couldn't find any host named pramt.cs.uni-magdeburg.de. (#5.1.2)
>
> <helbing@monet.cs.uni-magdeburg.de>:
> Sorry, I wasn't able to establish an SMTP connection. (#4.4.1)
> I'm not going to try again; this message has been in the queue too long.
>
> <kgrabski@iws.cs.uni-magdeburg.de>:
> Sorry, I wasn't able to establish an SMTP connection. (#4.4.1)
> I'm not going to try again; this message has been in the queue too long.
>
> <mxp@iws.cs.uni-magdeburg.de>:
> Sorry, I wasn't able to establish an SMTP connection. (#4.4.1)
> I'm not going to try again; this message has been in the queue too long.
>
> <florian28379@gmx.net>:
> 213.165.64.100 does not like recipient.
> Remote host said: 552 {mx011} The user's mailbox is full
> Giving up on 213.165.64.100.
>
> <nothing-@-snothing.com>:
> Sorry, I couldn't find any host named -snothing.com. (#5.1.2)
>
> <counterspell@gmx.net>:
> 213.165.64.100 does not like recipient.
> Remote host said: 550 {mx028-rz3} <counterspell@gmx.net>... User is unknown
> Giving up on 213.165.64.100.
>
> <toengel@gmx.de>:
> 213.165.64.100 does not like recipient.
> Remote host said: 552 {mx003} The user's mailbox is full
> Giving up on 213.165.64.100.
>
> <gobble-g@gmx.de>:
> 213.165.64.100 does not like recipient.
> Remote host said: 552 {mx021-rz3} The user's mailbox is full
> Giving up on 213.165.64.100.
>
> <no.email.address.entered@none444.yet>:
> Sorry, I couldn't find any host named none444.yet. (#5.1.2)
>
> <laber@rababer.com>:
> Sorry, I couldn't find any host named rababer.com. (#5.1.2)
>
> <luettich@gmx.net>:
> 213.165.64.100 does not like recipient.
> Remote host said: 550 {mx033-rz3} <luettich@gmx.net>... User is unknown
> Giving up on 213.165.64.100.
>
> <rene.wiermer@student.uni-magdeburg.de>:
> 141.44.1.10 failed after I sent the message.
> Remote host said: 550 Administrative prohibition
>
> <bert.steffens@student.uni-magdeburg.de>:
> 141.44.1.10 failed after I sent the message.
> Remote host said: 550 Administrative prohibition
>
> <memmory100@mail.ru>:
> 194.67.23.20 failed after I sent the message.
> Remote host said: 550 Message rejected: virus found
>
> <bert@isg.cs.uni-magdeburg.de>:
> Connected to 141.44.23.1 but sender was rejected.
> Remote host said: 550 5.7.1 Access denied
>
> <stefans@isg.cs.uni-magdeburg.de>:
> Connected to 141.44.23.1 but sender was rejected.
> Remote host said: 550 5.7.1 Access denied
>
> <isenberg@luxator.cs.uni-magdeburg.de>:
> Connected to 141.44.23.1 but sender was rejected.
> Remote host said: 550 5.7.1 Access denied
>
> <georg_russ@web.de>:
> 217.72.192.149 does not like recipient.
> Remote host said: 550 <georg_russ@web.de> Benutzer hat das Speichervolumen ueberschritten. / User has exhausted allowed storage space.
> Giving up on 217.72.192.149.
>
> <q@exoz.net>:
> Sorry, I wasn't able to establish an SMTP connection. (#4.4.1)
> I'm not going to try again; this message has been in the queue too long.
>
> <markgraf@mail.cs.uni-magdeburg.de>:
> 141.44.21.2 failed after I sent the message.
> Remote host said: 553 5.7.1 We do not accept your Microsoft spam
>
> <heydekor@cs.uni-magdeburg.de>:
> 141.44.21.2 failed after I sent the message.
> Remote host said: 553 5.7.1 We do not accept your Microsoft spam
>
> <jesse@mail.cs.uni-magdeburg.de>:
> 141.44.21.2 failed after I sent the message.
> Remote host said: 553 5.7.1 We do not accept your Microsoft spam
>
> <silange@cs.uni-magdeburg.de>:
> 141.44.21.2 failed after I sent the message.
> Remote host said: 553 5.7.1 We do not accept your Microsoft spam
>
> <folkens@cs.uni-magdeburg.de>:
> 141.44.21.2 failed after I sent the message.
> Remote host said: 553 5.7.1 We do not accept your Microsoft spam
>
> <weilepp@cs.uni-magdeburg.de>:
> 141.44.21.2 failed after I sent the message.
> Remote host said: 553 5.7.1 We do not accept your Microsoft spam
>
> <pkruse@cs.uni-magdeburg.de>:
> 141.44.21.2 failed after I sent the message.
> Remote host said: 553 5.7.1 We do not accept your Microsoft spam
>
> <russ@cs.uni-magdeburg.de>:
> 141.44.21.2 failed after I sent the message.
> Remote host said: 553 5.7.1 We do not accept your Microsoft spam
>
> <drechssl@cs.uni-magdeburg.de>:
> 141.44.21.2 failed after I sent the message.
> Remote host said: 553 5.7.1 We do not accept your Microsoft spam
>
> <pauer@cs.uni-magdeburg.de>:
> 141.44.21.2 failed after I sent the message.
> Remote host said: 553 5.7.1 We do not accept your Microsoft spam
>
> <senthilb007@yahoo.com>:
> 64.156.215.6 failed after I sent the message.
> Remote host said: 554 delivery error: dd Sorry, your message to senthilb007@yahoo.com cannot be delivered. This account is over quota. - mta197.mail.scd.yahoo.com
>
> <gmpcue@yahoo.com>:
> 64.156.215.6 failed after I sent the message.
> Remote host said: 554 delivery error: dd This user doesn't have a yahoo.com account (gmpcue@yahoo.com) [0] - mta239.mail.scd.yahoo.com
>
> <buchmann@iti.cs.uni-magdeburg.de>:
> 141.44.26.1 failed after I sent the message.
> Remote host said: 553 5.7.1 We do not accept your Microsoft spam
>
> <toepel@iti.cs.uni-magdeburg.de>:
> 141.44.26.1 failed after I sent the message.
> Remote host said: 553 5.7.1 We do not accept your Microsoft spam
>
> <hoepfner@iti.cs.uni-magdeburg.de>:
> 141.44.26.1 failed after I sent the message.
> Remote host said: 553 5.7.1 We do not accept your Microsoft spam
>
> <martin.kowalski@student.uni-magdeburg.de>:
> 141.44.1.10 failed after I sent the message.
> Remote host said: 550 Administrative prohibition
>
> <ragnar.bade@student.uni-magdeburg.de>:
> 141.44.1.10 failed after I sent the message.
> Remote host said: 550 Administrative prohibition
>
> <nico.grzelachowski@student.uni-magdeburg.de>:
> 141.44.1.10 failed after I sent the message.
> Remote host said: 550 Administrative prohibition
>
> <katrin.wolf@student.uni-magdeburg.de>:
> 141.44.1.10 failed after I sent the message.
> Remote host said: 550 Administrative prohibition
>
> <petra.neumann@student.uni-magdeburg.de>:
> 141.44.1.10 failed after I sent the message.
> Remote host said: 550 Administrative prohibition
>
> <stefan.schumacher@student.uni-magdeburg.de>:
> 141.44.1.10 failed after I sent the message.
> Remote host said: 550 Administrative prohibition
>
> --- Enclosed is a copy of the message.
>

ANY HELP IS SUPER COS I'M STUMPED ON THIS ONE

BigEejit

some spammer is after using his email as the return address most likely

Snaga

It _looks_ like someone spamming using his email address as the sender, more commonly known as a 'joe job' attack as he gets all of the return receipts into his mail account, causing a nuisance.

Its a tough one to handle properly due the fact that eircoms mail servers are usually open for all to spam off, but that said the returned mails should have a mail ID number which eircoms abuse department should be able to track to the ip address of whoever is sending the mails.

If its a non eircom customer then they are obliged to contact this persons ISP and ask them to stop, if its an eircom customer then they can ring them and ask them to stop.

< edit - beat me to it >

BigEejit

na naaa

Frank Grimes

Originally posted by Snaga
Its a tough one to handle properly due the fact that eircoms mail servers are usually open for all to spam off

That's not true.
Also, the guy could have a virus on his machine that's churning out a load of spam.

ando

swen virus

shinzon

thats the swen virus alright, had it meself a while back, just dl the removal tool from symantec, that will sort ye out

shin