cancel
Showing results for 
Search instead for 
Did you mean: 

Spam being sent twice

Community Veteran
Posts: 1,160
Thanks: 1
Registered: 01-08-2007

Spam being sent twice

I noticed that some emails marked SPAM have apparently been sent twice. They are all addressed to 9063d274926c016c67cc1aae37e5ce9a@sybilandbarry.plus.com

Looking at the full headers I see that in each identical pair they differ as here:
To: 9063d274926c016c67cc1aae37e5ce9a@sybilandbarry.plus.com
Envelope-To: 9063d274926c016c67cc1aae37e5ce9a@sybilandbarry.plus.com
and
To: 9063d274926c016c67cc1aae37e5ce9a@sybilandbarry.plus.com
Envelope-To: xxxxxxx@sybilandbarry.plus.com
the xxxxxxx representing one of our valid email addresses.

I've not seen this sort of thing before and they only started arriving on Christmas Day. Has anyone else been getting this annoyance?

I've stopped downloading one of each pair now by deactivating the catch-all address in my Mail program but that means I'll have to check the mailbox online every so often to delete them all and make sure no legitimate mail with a misspelt first part is hiding in amongst all the spam.
Plusnet user since November 2003
Currently on Unlimited Fibre Extra and Unlimited UK & Mobile Calls
15 REPLIES
MrToast
Grafter
Posts: 550
Registered: 31-07-2007

Spam being sent twice

Not sure why you are worried about miss-spelt first parts to email addresses (mailbox) since your correspondents could just as easily miss-spell your domain.

If you 'blackhole' your default mail box a 550 error would be returned for anything directed at it thus alerting a real sender to a problem.

Blackhole is actually blocked, as in the mailbox doesn't exsist.
Community Veteran
Posts: 1,160
Thanks: 1
Registered: 01-08-2007

Spam being sent twice

It's not too much bother to check and someone might really have the first part of an address wrong in the various addresses we have, whereas they're less likely to have the second bit written down wrong and if the email was bounced back they might think the address was no longer in use.

Anyhow, that isn't what I'm having the problem with which is these stupid 'twin' emails with a long number instead of a name, which have the 'envelope to' a valid address for one as well as to the number for the other. I wanted to know if anyone else was getting them as they're annoying me no end. They contain just the usual 'medications' and weight loss type messages.
Plusnet user since November 2003
Currently on Unlimited Fibre Extra and Unlimited UK & Mobile Calls
MrToast
Grafter
Posts: 550
Registered: 31-07-2007

Spam being sent twice

Quote
I wanted to know if anyone else was getting them ('double SPAM') as they're annoying me no end.


Well, I was getting them too. Didn't take much notice since it was just more SPAM so far as I was concerned.

Are you really concerned about the quality of SPAM you are receiving or have I missed something?
csogilvie
Grafter
Posts: 5,852
Registered: 04-04-2007

Spam being sent twice

I often get them, but I just toss them in the spam folder and just ignore them.
Community Veteran
Posts: 1,160
Thanks: 1
Registered: 01-08-2007

Spam being sent twice

Quote

Are you really concerned about the quality of SPAM you are receiving or have I missed something?

Of course not!!!

I was just wondering if there was something odd happening in the PlusNet servers which was maybe sending them twice, once with one envelope as addressed and once with a valid address.

What does 'Envelope to' mean as opposed to 'To' on its own? It was puzzling me why they differed on one and were the same on the other in each identical pair. Looking at other emails they're usually both to the same where it appears, except where the 'To' address is to a mailing list.

I'm assuming the stupid number address was cobbled up on an infected computer somewhere.
Plusnet user since November 2003
Currently on Unlimited Fibre Extra and Unlimited UK & Mobile Calls
Community Veteran
Posts: 26,357
Thanks: 607
Fixes: 8
Registered: 10-04-2007

Spam being sent twice

I think the envelope to will show where the email is being delivered to, even when it is being sent to a BCC address. If you get a pair of emails I'm guessing it might be because it was sent "To" and "BCC" the same address (perhaps another spammers ploy to circumvent some spam filters?).
jelv (a.k.a Spoon Whittler)
   Why I have left Plusnet (warning: long post!)   
Broadband: Andrews & Arnold Home::1 (FTTC 80/20)
Line rental: Pulse 8 Home Line Rental (£13/month)
Mobile: iD mobile (£4/month)
Plusnet Staff
Plusnet Staff
Posts: 12,169
Thanks: 18
Fixes: 1
Registered: 04-04-2007

Spam being sent twice

Hi,

I get loads of these, well used to as I went on a blackholing mission a while back. Something spammers have been doing for a while now, sending the spam twice, once with a BCC to a known address and once to a seemingly random address as the To address (the part after the @ generally being the same in both cases).

The reason for doing this is that it tries to catch out simple mail filters. For example, if you know you are getting spam to the known address you may have a mail rule to delete mail sent To or CC that address but might not have the rule on the BCC, while the random string is there to catch out catch all mailboxes.
csogilvie
Grafter
Posts: 5,852
Registered: 04-04-2007

Spam being sent twice

The To: header in an email is completely meaningless... the Enevelope-To is probably the one you actually want to look at if trying to work out / filter email based on email addreses.

I could construct an SMTP transaction which sends an email to someone@somedomain.ext but have the To: header say bill@microsoft.com
Community Veteran
Posts: 1,160
Thanks: 1
Registered: 01-08-2007

Spam being sent twice

Ah, so I've been lucky that I haven't seen these before.

Thanks for your explanations, Elvin, Dave and Colin, though I'm not sure quite how they fit with the fact that most of the legitimate mail I get via both PlusNet and .Mac doesn't even have 'Envelope to' when I expand the headers, just the 'To' line. I'm using the Mac Mail program BTW, where I have the Rules set up to deposit all Spam, as identified by PlusNet and by the program itself, into a separate folder. This works well and only very occasionally sends something that's not Spam into said folder.

Anyhow, I'll now just continue deleting the doubled up ones with all the rest of the rubbish mail without giving them a second look!
Plusnet user since November 2003
Currently on Unlimited Fibre Extra and Unlimited UK & Mobile Calls
csogilvie
Grafter
Posts: 5,852
Registered: 04-04-2007

Spam being sent twice

Envelope-To is not a standard email header - it tends to be added by certain mail server software to show where it went.

Ages back it used to be a Delivered-To header PlusNet added that had some werid format that I can't quite remember - now it's Envelope-To though.
Community Veteran
Posts: 26,357
Thanks: 607
Fixes: 8
Registered: 10-04-2007

Spam being sent twice

Delivered-To: el_plusn-elvin-mailbox@username.plus.com
jelv (a.k.a Spoon Whittler)
   Why I have left Plusnet (warning: long post!)   
Broadband: Andrews & Arnold Home::1 (FTTC 80/20)
Line rental: Pulse 8 Home Line Rental (£13/month)
Mobile: iD mobile (£4/month)
N/A

Spam being sent twice

I too have been receiving spam re:finacial tipping with a political message underneath. I used the spam filter from the email settings on My Account. Now I receive spam notification and delivery failure messages every 30 minutes. I set up a rule in MS Outlook to delete all emails that contain the words spam, returned mail or delivery. This is a bit crude is there a better way? I undertand its all part of it, but it hacks me right off :x
Plusnet Staff
Plusnet Staff
Posts: 12,169
Thanks: 18
Fixes: 1
Registered: 04-04-2007

Spam being sent twice

It may sound crude, generally it's quite efficient. Activating the spam protection will catch a certain amount of the spam and mark the subject line as such with a spam tag doing the hard part of detecting spam. A rule then which deletes anything with [-SPAM-] in the subject is all that's needed, same really with delivery failures. That's how I do it (although I send the mail to the deleted items folder rather than permanently deleted just to check for the off false positive).
N/A

Spam being sent twice

Can someone explain 'blackholeing' mentioned a couple of times in this mail string. Cheers