Home page logo

educause logo Educause Security Discussion mailing list archives

Re: spam return address backlash
From: Mark Borrie <mark.borrie () OTAGO AC NZ>
Date: Wed, 10 Jan 2007 11:18:39 +1300

From time to time we get this occuring on a significant basis, i.e. large
numbers of bounces (> 100 a day) come through. This first occurred several
years ago when a HOD's email address was used and he received approx
70 000 bounces a day for a number of weeks.

Today many of the bounce messages get quarantined in our spam system
so users don't see them.

The trend I am more concerned about at the moment is the mass
subscription of an email address to "random" mail lists. This generates huge
volumes of unwanted emails for the recipient who then doesn't know which
are real lists that can be unsubscribed from which are not.

Several of our users have opted to change email address rather than try and
clean up incoming email.

The only reason I can work out at the moment for this mass subscription is
to cause a DOS on users.


On 9 Jan 2007 at 14:43, Roger Safian wrote:


In the last couple weeks we have seen several of our
addresses used as the from address in spam.  This
causes few serious problems, but does generate an
increase in the number of spam complaints to our
abuse aliases.

It does cause a serious issue if the chosen address
used by the spammer, also happens to be a real
address in use here at Northwestern.  We have
heard of people receiving hundreds of bounced messages
per day if this happens.  We recommend filters,
but there's little else we can do to stop this.

My questions are two.  Is this happening elsewhere,
and if so, have you recently noticed an increase
in this activity?

Roger A. Safian
r-safian () northwestern edu (email) public key available on many key servers.
(847) 491-4058   (voice)
(847) 467-6500   (Fax) "You're never too old to have a great childhood!"

Mark Borrie
Information Security Manager,
Information Technology Services, University of Otago,
Dunedin, N.Z.
Ph +64 3 479-8395, Fax +64 3 479-5080, Mobile +64 27 609-6409

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]