Catch all off - still get random addresses

[#1]

I've turned off the catch all for my account, but I'm still getting emails to random addresses.  I've pasted some headers below.
I use a hosted domain name for the vast majority of my email, so could it be that the domain is passing all aliases, while the .plus.com addresses drop the random ones?

Quote

Envelope-to: 1hjzyubtcbhs8.dlg@fishter.org.uk Delivery-date: Wed, 09 Apr 2008 14:10:20 +0100 Received: from mail.plus.net [212.159.10.1]     by myth.fishter.org.uk with POP3 (fetchmail-6.3.8)     for <gee@localhost> (single-drop); Wed, 09 Apr 2008 14:12:09 +0100 (BST) Received: from exprod5mx247.postini.com ([64.18.0.167] helo=psmtp.com)     by pih-sunmxcore19.plus.net with smtp (PlusNet MXCore v2.00) id 1Jja4A-0004LY-5c     for 1hjzyubtcbhs8.dlg@fishter.org.uk; Wed, 09 Apr 2008 14:10:19 +0100 Received: from source ([118.74.32.127]) by exprod5mx247.postini.com ([64.18.4.13]) with SMTP;     Wed, 09 Apr 2008 08:09:41 CDT Received: from [118.74.32.127] by corptorospam02.corusent.com; Wed, 9 Apr 2008 21:10:07 +0800 From: "Galen Staley" <tek@q107.com> To: <1hjzyubtcbhs8.dlg@mail.fishter.org.uk> Date: Wed, 9 Apr 2008 21:10:07 +0800 MIME-Version: 1.0 Content-Type: multipart/mixed;     boundary="----=_NextPart_000_000E_01C89A86.16456180" X-Mailer: Microsoft Office Outlook, Build 11.0.6353 Thread-Index: Aca6QC5D9OZSK2EPKVRPL7BY96RSY3== X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Message-ID: <01c89a86$16456180$7f204a76@tek> X-pstn-neptune: 4/4/1.00/87 X-pstn-levels: (S: 0.16715/99.46010 CV:99.9000 R:95.9108 P:95.9108 M:97.0282 C:98.6951 ) X-pstn-settings: 1 (0.1500:0.1500) cv gt3 gt2 gt1 r p m c X-pstn-addresses: from <tek@q107.com> [99/5] X-pn-pstn: Spam 2 X-PN-Virus-Filtered: by PlusNet MXCore (v4.00) X-PN-Spam-Filtered: by PlusNet MXCore (v4.00) Subject: Hello! X-Clamav-Status: No

[#2]

Hmm, I've just had a look in the mail db here and can't see a catch-all mailbox in there or even a mailbox with the name you've specified. I've given your account a friendly kick to try to resolve this, let me know if you continue to get email not addressed to a mailbox/redirect/alias etc on your account.

[#3]

I've not seen any today, but they might be getting quarantined at postini.  I'll post back if any more come through.
Cheers,

[#4]

This is happening to me too. I just received a mail to webmaster@ one of my domains, and that alias does not exist. My catchall was pointing to a mailbox that I never read (although I thought it was off - it is now). There are other examples too.

[#5]

Got another one today - note I didn't release this one from quarantine!

Quote

X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on myth.<domain>.uk X-Spam-Level: ****** X-Spam-Status: Yes, score=6.2 required=5.0 tests=AWL,BAYES_05,     DATE_IN_PAST_06_12,HTML_MESSAGE,RAZOR2_CF_RANGE_51_100,     RAZOR2_CF_RANGE_E8_51_100,RAZOR2_CHECK,RCVD_IN_DNSWL_MED,URIBL_BLACK,     URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_RHS_DOB,URIBL_SC_SURBL autolearn=no     version=3.2.4 X-Spam-Report:     * -4.0 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/,     * medium trust     * [64.18.0.121 listed in list.dnswl.org]     * 1.1 DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date     * 0.0 HTML_MESSAGE BODY: HTML included in message     * -1.1 BAYES_05 BODY: Bayesian spam probability is 1 to 5%     * [score: 0.0133]     * 1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level     * above 50%     * [cf: 100]     * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)     * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%     * [cf: 100]     * 1.1 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread)     * [URIs: markleast.com]     * 2.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist     * [URIs: markleast.com]     * 1.5 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist     * [URIs: markleast.com]     * 1.5 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist     * [URIs: markleast.com]     * 0.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist     * [URIs: markleast.com]     * 1.2 AWL AWL: From: address is in the auto white-list Received: from myth.<domain>.uk (localhost.localdomain [127.0.0.1])     by mail.<domain>.uk (8.14.2/8.14.2) with ESMTP id m3ECVeWn011096     for <gee@localhost>; Mon, 14 Apr 2008 13:31:40 +0100 Envelope-to: 317248878.86671480890156@<domain>.uk Delivery-date: Mon, 14 Apr 2008 13:30:58 +0100 Received: from mail.plus.net [212.159.10.1]     by myth.<domain>.uk with POP3 (fetchmail-6.3.8)     for <gee@localhost> (single-drop); Mon, 14 Apr 2008 13:31:40 +0100 (BST) Received: from exprod5mx235.postini.com ([64.18.0.121] helo=psmtp.com)     by pih-sunmxcore18.plus.net with smtp (PlusNet MXCore v2.00) id 1JlNpp-0004Ye-7O     for 317248878.86671480890156@<domain>.uk; Mon, 14 Apr 2008 13:30:57 +0100 Received: from source ([209.249.146.20]) (using TLSv1) by exprod5mx235.postini.com ([64.18.4.10]) with SMTP;     Mon, 14 Apr 2008 08:30:55 EDT Received: from localhost (localhost)     by cobalt3.jdhost.com (8.11.6/8.11.6) id m3E5Z1k19887;     Mon, 14 Apr 2008 00:35:01 -0500 Date: Mon, 14 Apr 2008 00:35:01 -0500 From: Mail Delivery Subsystem <MAILER-DAEMON@cobalt3.jdhost.com> Message-Id: <200804140535.m3E5Z1k19887@cobalt3.jdhost.com> To: <317248878.86671480890156@mail.<domain>.uk> MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status;     boundary="m3E5Z1k19887.1208151301/cobalt3.jdhost.com" Auto-Submitted: auto-generated (failure) X-pstn-neptune: 0/0/0.00/0 X-pstn-levels: (S: 0.41031/99.71124 CV:99.9000 R:95.9108 P:95.9108 M:97.0282 C:98.6951 ) X-pstn-settings: 1 (0.1500:0.1500) cv gt3 gt2 gt1 r p m c X-pstn-addresses: from <MAILER-DAEMON@cobalt3.jdhost.com> [146/7] X-pn-pstn: Spam 3 X-PN-Virus-Filtered: by PlusNet MXCore (v4.00) X-PN-Spam-Filtered: by PlusNet MXCore (v4.00) Subject: Returned mail: see transcript for details X-Clamav-Status: No

[#6]

I've been looking into a similar problem today regarding emails going to a catch-all account instead of a dedicated mailbox. We've just rolled a fix for this so I'd be interested if you see any further examples.

[#7]

Here's another one that got through to an address I don't have listed.

Quote

X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on myth.<domain>.uk X-Spam-Level: **** X-Spam-Status: No, score=4.9 required=5.0 tests=BAYES_50,HTML_MESSAGE,      MIME_QP_LONG_LINE,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,      RAZOR2_CHECK,RCVD_IN_DNSWL_MED,URIBL_BLACK,URIBL_JP_SURBL,URIBL_OB_SURBL      autolearn=no version=3.2.4 Received: from myth.<domain>.uk (localhost.localdomain [127.0.0.1])      by mail.<domain>.uk (8.14.2/8.14.2) with ESMTP id m3F9iu5O020932      for <gee@localhost>; Tue, 15 Apr 2008 10:44:56 +0100 Envelope-to: hiltongraeme.hilton@<domain>.uk Delivery-date: Tue, 15 Apr 2008 10:44:05 +0100 Received: from mail.plus.net [212.159.10.1]      by myth.<domain>.uk with POP3 (fetchmail-6.3.8)      for <gee@localhost> (single-drop); Tue, 15 Apr 2008 10:44:56 +0100 (BST) Received: from exprod5mx242.postini.com ([64.18.0.162] helo=psmtp.com)      by pih-sunmxcore12.plus.net with smtp (PlusNet MXCore v2.00) id 1Jlhht-00037r-54      for hiltongraeme.hilton@<domain>.uk; Tue, 15 Apr 2008 10:44:05 +0100 Received: from source ([79.186.109.38]) by exprod5mx242.postini.com ([64.18.4.13]) with SMTP;      Tue, 15 Apr 2008 09:43:58 GMT Message-ID: <003201c89edd$395e46e0$cb00000a@Pirson-Andrzej> From: "E-Card from Yahoo! Greetings" <e-cards@yahoo.americangreeting.co.uk> To: <hiltongraeme.hilton@mail.<domain>.uk> Date: Tue, 15 Apr 2008 11:43:56 +0200 MIME-Version: 1.0 Content-Type: multipart/alternative;      boundary="----=_NextPart_000_002D_01C89EED.FCE716E0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-pstn-neptune: 0/0/0.00/0 X-pstn-levels: (S: 0.41931/99.71503 CV:99.9000 R:95.9108 P:95.9108 M:97.0282 C:98.6951 ) X-pstn-settings: 1 (0.1500:0.1500) cv gt3 gt2 gt1 r p m c X-pstn-addresses: from <e-cards@yahoo.americangreeting.co.uk> [146/7] X-pn-pstn: Spam 3 X-PN-Virus-Filtered: by PlusNet MXCore (v4.00) X-PN-Spam-Filtered: by PlusNet MXCore (v4.00) Subject: A Mate has sent you an e-card from Yahoo! Greetings - EID: 2262 X-Clamav-Status: No

Quote

X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on myth.<domain>.uk X-Spam-Level: X-Spam-Status: No, score=-1.8 required=5.0 tests=BAYES_50,HTML_MESSAGE, MIME_HTML_MOSTLY,RCVD_IN_DNSWL_MED,TVD_SPACE_RATIO autolearn=ham version=3.2.4 Received: from myth.<domain>.uk (localhost.localdomain [127.0.0.1]) by mail.<domain>.uk (8.14.2/8.14.2) with ESMTP id m3FKpCNE024684 for <gee@localhost>; Tue, 15 Apr 2008 21:51:12 +0100 Envelope-to: chyz0kqh9x8g.dlg@<domain>.uk Delivery-date: Tue, 15 Apr 2008 21:49:23 +0100 Received: from mail.plus.net [212.159.10.1] by myth.<domain>.uk with POP3 (fetchmail-6.3.8) for <gee@localhost> (single-drop); Tue, 15 Apr 2008 21:51:12 +0100 (BST) Received: from exprod5mx213.postini.com ([64.18.0.72] helo=psmtp.com)   by pih-sunmxcore19.plus.net with smtp (PlusNet MXCore v2.00) id 1Jls5j-0000ve-62   for chyz0kqh9x8g.dlg@<domain>.uk; Tue, 15 Apr 2008 21:49:23 +0100 Received: from source ([77.201.9.60]) by exprod5mx213.postini.com ([64.18.4.14]) with SMTP; Tue, 15 Apr 2008 12:49:19 PST X-Original-To: chyz0kqh9x8g.dlg@<domain>.uk Delivered-To: chyz0kqh9x8g.dlg@<domain>.uk Received: from [77.201.9.60] (port=37303 helo=60.9.201-77.rev.gaoland.net)         by <domain>.uk.s5b2.psmtp.com with esmtp         id 80c9b9-2f4f32-9d         for chyz0kqh9x8g.dlg@<domain>.uk; Tue, 15 Apr 2008 22:48:38 +0100 Message-ID: <cd5b01c89f4a$d80bd6f0$3c09c94d@<domain>.uk> From: "Coleman" <jfmqbr@<domain>.uk> To: "Jerri" <chyz0kqh9x8g.dlg@mail.<domain>.uk> Date: Tue, 15 Apr 2008 22:48:38 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_001_CD5A_01C89F3A.149EF360" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-pstn-neptune: 500/284/0.57/72 X-pstn-levels:     (S: 4.72544/99.90000 CV:99.9000 R:95.9108 P:95.9108 M:97.0282 C:98.6951 ) X-pstn-settings: 1 (0.1500:0.1500) cv gt3 gt2 gt1 r p m c X-pstn-addresses: from <jfmqbr@<domain>.uk> [146/7] X-pn-pstn: Spam 5 X-PN-Virus-Filtered: by PlusNet MXCore (v4.00) X-PN-Spam-Filtered: by PlusNet MXCore (v4.00) Subject:  hosk X-Clamav-Status: No