[GRLUG] Email overload

[Stro]

On Wed, 2008-04-30 at 15:52 -0400, Topher wrote:
> On Wed, 30 Apr 2008, Collin wrote:
> 
> > I'm getting hundreds upon hundreds of bounce messages from all over the 
> > world today. Someone used our email domain as the sender address for not 
> > so nice emails (they didn't use our server they just claim to be us). 
> > Normally it isn't bad but today is terrible. Anyone else getting this? 
> > If it's on going what's the best course of action? ignore it? Use a mail 
> > filter to trashcan it (though legit bounce messages would be lost too)?
> 
> Yes, we've had that a couple times here in the last month.  It's called a 
> Joe Job, you can read about it here:
> http://en.wikipedia.org/wiki/Joe_job
> 
> There's not much you can do about it.  During the fallout from something 
> like that, I *do* blackhole bounce reports.  It's just not worth dealing 
> with them.
> 
> Topher
> Manager of Internet Services
> Cornerstone University Radio
> 


Joe Jobs and backscatter have been on rise over the last few weeks. I
personally got over 600 over the last weekend and have had alot of users
complaining of the same. Had to resort to blackholing bounce reports
myself as well.  Seeing how alot of MTA's include the content of the
bounced message with the bounce notification, I wonder if it is some new
technique spammers are using to send spam by bouncing it to the victim
instead of sending it directly.

-Luke