Owner-list@ spam messages

adamsgi

New member
Joined
Feb 11, 2007
Messages
3
Hi all

I have been getting Mail delivery failure notices to spma messages sent via majordomo on my site. I did have two mailing lists set up - one called "owner" with just my email address, postings restricted to just members, and a second one called "Clients" where postings were restricted to just the Owner List (effectively meaning that only I could send any emails to the mailing lists).

I have now deleted the mailing lists hoping that might solve the problem, but am still receiving the messages. Could someone clarify whether I am receiving a spam attempt (i.e. one spam email sent, and then it is bouncing back to me because the recipient isn't in a mailing list) or whether the spam is being successful and I am receiving a legitimate bounce back from their email server?

The message is:

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:

[email protected]
SMTP error from remote mail server after RCPT TO:<[email protected]>:
host in1.smtp.messagingengine.com [66.111.4.71]:
550 <[email protected]>: Recipient address rejected:
User unknown in local recipient table

------ This is a copy of the message, including all the headers. ------

Return-path: <[email protected]>
Received: from majordomo by zeus.aushost.biz with local (Exim 4.60)
(envelope-from <[email protected]>)
id 1HGBvR-0005jt-IG
for [email protected]; Sun, 11 Feb 2007 05:27:17 -0500
To: [email protected]
From: [email protected]
Subject: Majordomo results: *****SPAM***** Save on medications with
Reply-To: [email protected]
Message-Id: <[email protected]>
Date: Sun, 11 Feb 2007 05:27:17 -0500

--

>>>> This is a multi-part message in MIME format.
**** Command 'this' not recognized.
>>>>
>>>> ------------=_45CEEF85.09E9817E
**** Command '------------=_45ceef85.09e9817e' not recognized.
>>>> Content-Type: text/plain
**** Command 'content-type:' not recognized.
>>>> Content-Disposition: inline
**** Command 'content-disposition:' not recognized.
>>>> Content-Transfer-Encoding: 8bit
**** Command 'content-transfer-encoding:' not recognized.
>>>>
>>>> Spam detection software, running on the system "zeus.aushost.biz",
>>>> has
**** Command 'spam' not recognized.
>>>> identified this incoming email as possible spam. The original
>>>> message
**** Command 'identified' not recognized.
>>>> has been attached to this so you can view it (if it isn't spam) or
>>>> label
**** Command 'has' not recognized.
>>>> similar future email. If you have any questions, see
**** Command 'similar' not recognized.
>>>> the administrator of that system for details.
**** Command 'the' not recognized.
>>>>
>>>> Content preview: Hot selling meds at cheapAll countries
>>>> shipingBest
**** Command 'content' not recognized.
>>>> international pharma site for 2005 Viagra, Valium, Lorazepam,
>>>> Cialis,
**** Command 'international' not recognized.
>>>> Xanax, Meridia, Lipitor, Zoloft, Celebrex, Soma & many more
>>>> popular meds
**** Command 'xanax,' not recognized.
>>>> filledbeing.All this you can find at LegalRXMedications drug
>>>> store.Legal
**** Command 'filledbeing.all' not recognized.
>>>> and cheap pills only. And get medications that you need instantly
>>>> direct
**** Command 'and' not recognized.
>>>> to your home. We are verified by VeriSign and VISA so we provide
>>>> secure
**** Command 'to' not recognized.
>>>> and confidential purchase.CLICK HERE TO ORDER Sun, 11 Feb 2007
>>>> 10:27:12
**** Command 'and' not recognized.
>>>> +0480 @3TDUC7 [...]
**** Command '+0480' not recognized.
>>>>
>>>> Content analysis details: (24.0 points, 7.5 required)
**** Command 'content' not recognized.
>>>>
>>>> pts rule name description
**** Command 'pts' not recognized.
>>>> ---- ----------------------
>>>> --------------------------------------------------
**** Command '----' not recognized.
>>>> 0.5 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date
**** Command '0.5' not recognized.
>>>> 0.0 HTML_MESSAGE BODY: HTML included in message
**** Command '0.0' not recognized.
>>>> 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
**** Command '3.5' not recognized.
>>>> [score: 1.0000]
**** Command '[score:' not recognized.
>>>> 0.2 HTML_TITLE_EMPTY BODY: HTML title contains no text
**** Command '0.2' not recognized.
>>>> 2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
**** Command '2.0' not recognized.
>>>> [71.80.171.41 listed in
>>>> dnsbl.sorbs.net]
**** Command '[71.80.171.41' not recognized.
>>>> 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
>>>> bl.spamcop.net
**** Command '1.6' not recognized.
>>>> [Blocked - see
>>>> <http://www.spamcop.net/bl.shtml?71.80.171.41>]
**** Command '[blocked' not recognized.
>>>> 3.9 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
**** Command '3.9' not recognized.
>>>> [71.80.171.41 listed in
>>>> sbl-xbl.spamhaus.org]
**** Command '[71.80.171.41' not recognized.
>>>> 3.8 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
**** Command '3.8' not recognized.
>>>> [URIs: hornycrocodile.com]
**** Command '[uris:' not recognized.
>>>> 4.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
**** Command '4.5' not recognized.
>>>> [URIs: hornycrocodile.com]
**** Command '[uris:' not recognized.
>>>> 0.5 DRUGS_ERECTILE Refers to an erectile drug
**** Command '0.5' not recognized.
>>>> 0.4 DRUGS_ANXIETY Refers to an anxiety control drug
**** Command '0.4' not recognized.
>>>> 0.0 DRUGS_MUSCLE Refers to a muscle relaxant
**** Command '0.0' not recognized.
>>>> 0.6 DRUGS_DIET Refers to a diet drug
**** Command '0.6' not recognized.
>>>> 0.0 DRUGS_PAIN Refers to a pain relief drug
**** Command '0.0' not recognized.
>>>> 2.2 FORGED_MUA_OIMO Forged mail pretending to be from MS Outlook IMO
**** Command '2.2' not recognized.
>>>> 0.2 DRUGS_ANXIETY_EREC Refers to both an erectile and an anxiety drug
**** Command '0.2' not recognized.
>>>> 0.0 DRUGS_MANYKINDS Refers to at least four kinds of drugs
**** Command '0.0' not recognized.
>>>>
>>>> The original message was not completely plain text, and may be
>>>> unsafe to
**** Command 'the' not recognized.
>>>> open with some email clients; in particular, it may contain a
>>>> virus,
**** Command 'open' not recognized.
>>>> or confirm that your address can receive spam. If you wish to view
**** Command 'or' not recognized.
>>>> it, it may be safer to save it to a file and open it with an editor.
**** Command 'it,' not recognized.
>>>>
>>>>
>>>> ------------=_45CEEF85.09E9817E
**** Command '------------=_45ceef85.09e9817e' not recognized.
>>>> Content-Type: text/plain; x-spam-type=original
**** Command 'content-type:' not recognized.
>>>> Content-Description: original message before SpamAssassin
**** Command 'content-description:' not recognized.
>>>> Content-Disposition: attachment
**** Command 'content-disposition:' not recognized.
>>>> Content-Transfer-Encoding: 8bit
**** Command 'content-transfer-encoding:' not recognized.
>>>>
>>>> Received: from 71-80-171-41.dhcp.wsco.ca.charter.com
>>>> ([71.80.171.41])
**** Command 'received:' not recognized.
>>>> by zeus.aushost.biz with esmtp (Exim 4.60)
**** Command 'by' not recognized.
>>>> (envelope-from <[email protected]>)
**** Command '(envelope-from' not recognized.
>>>> id 1HGBvK-0005je-TX
**** Command 'id' not recognized.
>>>> for [email protected]; Sun, 11 Feb 2007
>>>> 05:27:11 -0500
**** Command 'for' not recognized.
>>>> Received: from 66.111.4.73 (HELO in1.smtp.messagingengine.com)
**** Command 'received:' not recognized.
>>>> by armstrongpayrollsolutions.com with esmtp (J312TD9S 1KY+K)
**** Command 'by' not recognized.
>>>> id BX1;30-08.8/E-<2
**** Command 'id' not recognized.
>>>> for [email protected]; Sun, 11 Feb 2007
>>>> 10:27:12 +0480
**** Command 'for' not recognized.
>>>> From: "Charley Mcelroy" <[email protected]>
**** Command 'from:' not recognized.
>>>> To: <[email protected]>
**** Command 'to:' not recognized.
>>>> Subject: Save on medications with us!
**** Command 'subject:' not recognized.
>>>> Date: Sun, 11 Feb 2007 10:27:12 +0480
**** Command 'date:' not recognized.
>>>> Message-ID: <01c74dc7$317b3fe0$6c822ecf@loyallywriters>
**** Command 'message-id:' not recognized.
>>>> MIME-Version: 1.0
**** Command 'mime-version:' not recognized.
>>>> Content-Type: multipart/alternative;
**** Command 'content-type:' not recognized.
>>>> boundary="----=_NextPart_000_000E_01C74D84.2357FFE0"
**** Command 'boundary="----=_nextpart_000_000e_01c74d84.2357ffe0"' not recognized.
>>>> X-Priority: 3 (Normal)
**** Command 'x-priority:' not recognized.
>>>> X-MSMail-Priority: Normal
**** Command 'x-msmail-priority:' not recognized.
>>>> X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
**** Command 'x-mailer:' not recognized.
>>>> X-MimeOLE: Produced By Microsoft MimeOLE V4.71.2244.8
**** Command 'x-mimeole:' not recognized.
>>>> Importance: Normal
**** Command 'importance:' not recognized.
>>>>
>>>> This is a multi-part message in MIME format.
**** Command 'this' not recognized.
>>>>
>>>> ------=_NextPart_000_000E_01C74D84.2357FFE0
**** Command '------=_nextpart_000_000e_01c74d84.2357ffe0' not recognized.
>>>> Content-Type: text/plain;
**** Command 'content-type:' not recognized.
>>>> charset="iso-8859-1"
**** Command 'charset="iso-8859-1"' not recognized.
>>>> Content-Transfer-Encoding: 7bit
**** Command 'content-transfer-encoding:' not recognized.
>>>>
>>>> Hot selling meds at cheapAll countries shipingBest international
>>>> pharma site for 2005
**** Command 'hot' not recognized.
>>>> Viagra, Valium, Lorazepam, Cialis, Xanax, Meridia, Lipitor, Zoloft, Celebrex, Soma & many more popular meds filledbeing.All this you can find at LegalRXMedications drug store.Legal and cheap pills only.
**** Command 'viagra,' not recognized.
>>>> And get medications that you need instantly direct to your home.
**** Command 'and' not recognized.
>>>> We are verified by VeriSign and VISA so we provide secure and
>>>> confidential purchase.CLICK HERE TO ORDER
**** Command 'we' not recognized.
>>>> Sun, 11 Feb 2007 10:27:12 +0480 @3TDUC7
**** Command 'sun,' not recognized.
>>>>
>>>>
>>>>
>>>> ------=_NextPart_000_000E_01C74D84.2357FFE0
**** Command '------=_nextpart_000_000e_01c74d84.2357ffe0' not recognized.
>>>> Content-Type: text/html;
**** Command 'content-type:' not recognized.
>>>> charset="iso-8859-1"
**** Command 'charset="iso-8859-1"' not recognized.
>>>> Content-Transfer-Encoding: quoted-printable
**** Command 'content-transfer-encoding:' not recognized.
>>>>
>>>> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
**** Command '<!doctype' not recognized.
>>>> <HTML><HEAD><TITLE></TITLE>
**** Command '<html><head><title></title>' not recognized.
>>>> <META content=3D"text/html; charset=3Diso-8859-1"
>>>> http-equiv=3DContent-Type>
**** Command '<meta' not recognized.
>>>> <META content=3D"MSHTML 4.71.2244.8" name=3DGENERATOR></HEAD>
**** Command '<meta' not recognized.
>>>> <BODY>
**** Command '<body>' not recognized.
>>>> <HTML><HEAD>
**** Command '<html><head>' not recognized.
>>>> </HEAD>
**** Command '</head>' not recognized.
>>>> <body>
**** Command '<body>' not recognized.
>>>> <DIV>
**** Command '<div>' not recognized.
>>>> <DIV align=3D"center"><FONT face=3DVerdana><font color=3D"#808000">
**** Command '<div' not recognized.
>>>> <center>
**** Command '<center>' not recognized.
>>>> <table border=3D2 cellspacing=3D0 cellpadding=3D10 width=3D530
>>>> bordercolor=
**** Command '<table' not recognized.
>>>> =3D00DD6F>
**** Command '=3d00dd6f>' not recognized.
>>>> <tr><td bgcolor=3DFFFFFF>
**** Command '<tr><td' not recognized.
>>>> <font face=3Darial color=3D000000>
**** Command '<font' not recognized.
>>>> <center><font color=3DF9A915 face=3DVerdana><b><center>Hot selling
>>>> meds at =
**** Command '<center><font' not recognized.
>>>> cheap<br><font color=3DFF9DFF>All countries
>>>> shiping</font></font><br><font =
**** Command 'cheap<br><font' not recognized.
>>>> color=3Dred>Best international pharma site for 2005</font></font>
**** Command 'color=3dred>best' not recognized.
>>>> </b></center><br>
**** Command '</b></center><br>' not recognized.
>>>> Viagra, Valium, Lorazepam, Cialis, Xanax, Meridia, Lipitor,
>>>> Zoloft, Celebr=
**** Command 'viagra,' not recognized.
>>>> ex, Soma<br> & many more popular meds filledbeing.<br>All this you
>>>> can find=
**** Command 'ex,' not recognized.
>>>> at LegalRXMedications drug store.<br><b>Legal and cheap pills
>>>> only.</b><br=
**** Command 'at' not recognized.
>>>> ><br>
**** Command '><br>' not recognized.
>>>> And get medications that you need instantly direct to your
>>>> home.<br>
**** Command 'and' not recognized.
>>>> We are verified by VeriSign and VISA so we provide secure and
>>>> confidential =
**** Command 'we' not recognized.
>>>> purchase.<br><br>
**** Command 'purchase.<br><br>' not recognized.
>>>> <center>
**** Command '<center>' not recognized.
>>>> <a target=3D"_blank"
>>>> href=3D"http://www.hornycrocodile.com/st/st.php?id=3D=
**** Command '<a' not recognized.
>>>> 8051&script=3D1&url=3DaHR0cDovL2RlYXJncmFsZXIubmV0Lw=3D=3D&p=3D60"
>>>> ><font =
**** Command '8051&script=3d1&url=3dahr0cdovl2rlyxjncmfszxiubmv0lw=3d=3d&p=3d60"' not recognized.
>>>> color=3D1C1CFF><u><b><font color=3D"#2FDE03">CLICK HERE TO
>>>> ORDER</font></fo=
**** Command 'color=3d1c1cff><u><b><font' not recognized.
>>>> nt></font></b></u></a><br><br>
**** Command 'nt></font></b></u></a><br><br>' not recognized.
>>>> </center>
**** Command '</center>' not recognized.
>>>> </td></tr></table>
**** Command '</td></tr></table>' not recognized.
>>>> <br><br>
**** Command '<br><br>' not recognized.
>>>> Sun, 11 Feb 2007 10:27:12 +0480 @3TDUC7
**** Command 'sun,' not recognized.
>>>> </body>
**** Command '</body>' not recognized.
>>>> </html>
**** Command '</html>' not recognized.
>>>> </BODY></HTML>
**** Command '</body></html>' not recognized.
>>>>
>>>> ------=_NextPart_000_000E_01C74D84.2357FFE0--
**** Command '------=_nextpart_000_000e_01c74d84.2357ffe0--' not recognized.
>>>>
>>>>
>>>> ------------=_45CEEF85.09E9817E--
**** Command '------------=_45ceef85.09e9817e--' not recognized.
>>>>
>>>>
**** No valid commands found.
**** Commands must be in message BODY, not in HEADER.

**** Help for [email protected]:

And then you get the full help file.

Can anyone assist?

Thanks

Adam (serious newbie)
 
Bump

bump - can anyone help at all with this? Maybe a way to disable majordomo from working at my site?
 
Adam, you aren't giving enough information. For example, who sent you the email you posted?

You can't disable Majordomo completely except by using a custom skin which leaves out the links, but you can set users to have zero mailing lists.

However that won't keep mail from coming to addresses that once existed. If you're using catchall email turn it off as it will result in you getting email for addrsses that don't exist.

Jeff
 
Your guess is as good as mine

Who sent me the email? I have no idea. From what I can make out, someone is trying to send spam using [email protected] as the from and reply to address. The email is being bounced back to majordomo@ and because that account doesn't exist, I am assuming the server is trying to send an email to majordomo-owner (i.e. me)

All i can assume is that someone is choosing the majordomo@ email hoping that if it gets bounced back to a distribution list that it may get sent ton everyone on a distribution list.

I haven't got catch all email working so I can't disable it. I have contacted my host (I am an end user - not a host), who have been less than useless telling me to come on here and look through the forum for an answer.

HELP!! Thanks!!
 
You might want to post on the majordomo-users list maintained by the group that maintains majordomo.

Jeff
 
Back
Top