|
October 9, 2003: Yesterday as I downloaded my mail from one of my other domains, I noticed there were many mailer-daemon failure messages. Irritating, but I soon got fascinated by what I found: 1) The failure messages were all from AOL. 2) They were all from different addresses on my domain - non-existent ones (the domain has catch all e-mail). 4) The sender addresses were all random series of numbers and letters. 3) There was always a name given as the sender, not just an e-mail address. 4) All of the mails were sent to three to six AOL recipients. One in the To field, and the rest in the CC field. 5) The mails were apparently sent from different hosts - different IP numbers on virtually all of them. 6) Many of the e-mail addresses used in the spam-run failed, but not all. Some mails got through for each of the failure messages I got. Who knows how many succeeded without any failures! I really hope people understand I had nothing to do with this! 7) One mail garnered a different response from AOL, and this response was given for each addressee (I've munged the address it was sent to that I'm showing here): This message was created automatically by mail delivery software. 8) Here are the hosts that apparently was used for this (apparently) distributed spam-run. These are the ones I've received to date: 9) Another thing I noticed that may or may not mean something: Those that originated with AOL had this line (I've munged the address): X-Apparently-From: xxxxx@aol.com So my question is if this was done by the spamming software, or if it was added by AOL after the PC was hijacked? 10) Here's the actual headers (the AOL mail daemon sends the headers, but not the complete message, of failed messages back to the apparent sender) of one message, with lots of munging of e-mail addresses: Received: from d-43-88.dhcp-149-159.indiana.edu (d-43-88.dhcp-149-159.indiana.edu [149.159.43.88]) by rly-yb02.mx.aol.com (v96.8) with ESMTP id MAILRELAYINYB22-17e3f842e57d5; Wed, 08 Oct 2003 11:33:44 -0400 11) Here are part of the headers of a mail I once sent, where I got a 550 failure in return from AOL. As usual, I'll munge it (if you receive mail from me, I don't mind that you know my IP address, but I don't put it on the web when I don't have to. I have no qualms about revealing IP addresses of compromised machines though, how's that for double standards?)... Also note that different mail programs will result in slightly different headers, and mine is not OE...: Received: from xxxxx (xxxx [xxxx]) by rly-xd04.mx.aol.com (v95.1) with ESMTP id MAILRELAYINXD44-11c3f51f0433dc; Sun, 31 Aug 2003 08:55:31 -0400 12) Here are the headers of a mail with my return address, that was sent by another machine, and then stopped by AOL because it contained a virus (again, munged): Received: from CASH4MODELS (mtl-ppp-152843.qc.sympatico.ca [65.94.35.135]) by rly-xn04.mx.aol.com (v95.1) with ESMTP id MAILRELAYINXN43-6433f379b79184; Mon, 11 Aug 2003 09:34:49 -0400 13) So, conclusion? It's probably a distributed spam-run caused by virus-infected single computers. Their owners are probably completely unaware of what their computers are doing. 14) November 7, 2003: ----- Transcript of session follows ----- In other words, this aol user has received spam from my domain name before, and is now blocking any mail from it. To mail servers, this message looks like a failure message of the same type that is generated when an address doesn't exist (550). But when you open it up and check it, you'll see that the text is different. You can imagine that this is getting to be a big problem. I don't know if these people think *I* spammed them. I imagine they might if they don't know me. That's distressing! I really hope somebody finds a cure for this problem, and makes it known so the number of zombie machines will sink dramatically! 15) Note that all the spam messages I've seen are different (I usually see the subject line, and when the sending IP address has been blocked I'll get a copy of the full mail), so I imagine there must be some kind of communication between the spammer and these machines. 16) I just noticed that all the user agent strings on some of the latest batch are different. There's another sub-group without any user agent strings at all. Two different trojans? 17) I sent a bunch of abuse complaints today, and in my haste, I read some headers incorrectly. One nice admin sent a reply explaining what had happened in one case - a forged header that made the mail seem to come from his IP-address, while the mail had instead come from China! I then checked a few more headers, and saw that there are several ways these mails are sent. He gave me a useful tool for checking IP numbers: When checking some of the IP numbers I found, I found, I found this line: CBL/abuseat.org: 553 CBL Proxy/Trojan The description reads: Fully automated feed from very large spamtraps, lists open proxies and trojans of any kind Interesting, so in spite of very few news reports about this, it's known in the spam fighting biz that there are trojanized zombies out there! Interesting! 18) December 21, 2003: A new type of spam run started November 29 or earlier. This time the e-mail addresses used as "from" consist of a name or two and two random characters. Here are some examples: sami.shepard_kn Those bounces I got from November 29 and later all report to be produced by: X-Mailer: Microsoft Outlook Express 6.00.2800.1158 One of my friends uses this version of OE. It may be a forge job, or it could be a case of using a flaw in OE, I don't know. 19) December 21, 2003: Since December 5, 2003 I no longer get bounces (except a few 550 bounces) from AOL. AOL is refusing to deliver the e-mails for these reasons. Bear in mind that the bounces are actually from other mail servers, so they don't necessarily include the right language that an AOL bounce would: December 5 and onwards:
20) Until today, I haven't had any problems apart from an occasional slew of bounces because of these spam runs. But today an e-mail to a friend on AOL bounced back! This is the error message I got back: ----- Transcript of session follows -----
Read these usenet message that talk about this problem: |
This page was created by Ann Elisabeth Nordbo
and has its home at http://www.annelisabeth.com/
Updated 10.23.2005
Premiere issue March 3rd 2000