I host scvrs.org on one of my servers, and, it does not have any outlook or owa
services. For some reason, someone decided to try and send this message
out to various internet recipients:
Dear user of the scvrs.org mailing service!
We are informing you that because of the security upgrade of the mailing
service your mailbox (x) settings were changed. In order to
apply the new set of settings click on the following link:
I host scvrs.org on one of my servers, and, it does not have any outlook or owa
services. For some reason, someone decided to try and send this message
out to various internet recipients:
...
Anyone seen this before? Any good techniques for combatting it?
If you look more closely at the messages I believe you'll find that
they are multipart/alternative, and that the second part gives a
slightly modified version of the owa URL. For instance, for my own
nethelp.no domain the first part of message says
Yep. I've been receiving them from several of my domains for a couple
weeks. I've been sending the normal complaints to the provider of the IP
space in the header but other than that I have no good ideas about combating
it.
I've received several of these for zimmy.co.uk, they lasted about a
week, then they stopped. I would suggest waiting this out, if after a
week or two they haven't ceased then I would suggest contacting the ISP
from where these EMails are originating.
As for the blacklisting of your host, contact them and inform this is a
phishing scam; this is better delegated to blacklists such as Netcraft
rather than SORBS or the like.
Unfortunately, I only have the spamcop report sent to me, I don't have the original message.
What spamcop sends does not include Content-Type headers or the additional parts of
the message, only the plain text portion.
Unfortunately, it's turnning things like SPAMCOP into a DOS attack against the sites
they are hoping to protect when they start treating the initial "advertised" URL as
being the "spam advertised site".
And yes, we're all getting a crapload of these but most die in the
spam filter so we never see them. The message I quoted from achieved a
spam-assassin score of 26.