London.pm technical meeting 29th May 2008

[Peter Corlett]

On Thu, May 29, 2008 at 08:50:09AM +0100, Paul Makepeace wrote:
> On Wed, May 28, 2008 at 3:56 PM, Peter Corlett <abuse at cabal.org.uk> wrote:
[...]
>> You mean there is legitimate mail that comes from *.google.com? I thought
>> it was all 419 scams.
> (Perhaps you mean gmail.com? Or googlemail.com as it is in the UK)

I refer to the reverse DNS entries (which are actually of the form
*-out-*.google.com) and not the proffered sender address or HELO string. In
fact, the sender addresses are *never* in gmail.com, googlemail.com or
google.com. I hypothesise that this is because the spammer has set up a
temporary forward to my address and then spammed their Gmail account from
the usual botnets.

> Funnily enough, I ignored the Google engineering recruiter's first email
> or two when I saw the @google.com address :-)

TTBOMK, I've never had one, although being a jaded old cynic I am probably
not their ideal employee.

>> Blocking Google has reduced my incoming spam by about 95%. Google need to
>> start applying their spamfighting technology to *outbound* mail.

It looks like Hotmail (remember them?) have drawn the same conclusion:

"This is an automatically generated Delivery Status Notification

Delivery to the following recipient failed permanently:

   [email address]

Technical details of permanent failure:
PERM_FAILURE: Gmail tried to deliver your message, but it was rejected
by the recipient domain. We recommend contacting the other email
provider for further information about the cause of this error. The
error that the other server returned was: 550 550 SC-004 Mail rejected
by Windows Live Hotmail for policy reasons. A block has been placed
against your IP address because we have received complaints concerning
mail coming from that IP address. If you are not an email/network
admin please contact your E-mail/Internet Service Provider for help.
Email/network admins, we recommend enrolling in our Junk E-Mail
Reporting Program (JMRP), a free program intended to help senders
remove unwanted recipients from their e-mail list: http://postmaster.live.com
(state 13)."