「JPCERT/CC よりメールアカウント不正使用に関する情報提供のお願い」記事へのコメント

エラーメール送信先

[Anonymous Coward]

Fromを詐称されるだけでエラーメールはこっちに飛んでくるんじゃないの?

Re:エラーメール送信先

[Anonymous Coward]

若干オフトピですが、それを利用して、メールアドレスの有効性チェックは行われているようです。
(メールアドレスが無効なら、相手にエラーメールが返る仕組みを応用)

以下、実例(スパム送信元晒しとも言う)

Return-Path: <return-(任意の数字)@oritnagua.net>
Delivered-To: ひ・み・つ♪
Received: (qmail 17513 invoked by uid 89); 26 May 2012 23:16:35 +0900
Received: from am-k513.mail-bam.net (202.231.253.141)
    by メール鯖 with SMTP; 26 May 2012 23:16:35 +0900
Received-SPF: pass (メール鯖: SPF record at spf01.mail-b.net designates 202.231.253.141 as permitted sender)
Received: by am-k513.mail-bam.net (Postfix, from userid 1002)
        id 8BE61E9E9C; Sat, 26 May 2012 23:15:14 +0900 (JST)
Received: from rfr001.mail-bam.net (rfr001.mail-bam.net [202.231.254.68])
        by am-k513.mail-bam.net (Postfix) with ESMTP id 4F118E801C
        for <ひ・み・つ♪>; Sat, 26 May 2012 23:13:38 +0900 (JST)
Received: by rfr001.mail-bam.net (Postfix, from userid 1002)
        id 091B6B8E43; Sat, 26 May 2012 23:11:37 +0900 (JST)
Received: from dc28 (unknown [10.140.108.55])
        by rfr001.mail-bam.net (Postfix) with ESMTP id 8A46EB8536
        for <ひ・み・つ♪>; Sat, 26 May 2012 23:09:45 +0900 (JST)
Received: from dc28 (unknown [10.222.36.187])
        by rfr001.mail-bam.net (Postfix) with ESMTP id 8A46EB8536
        for <ひ・み・つ♪>; Sat, 26 May 2012 23:09:45 +0900 (JST)
Received: from dc28 (unknown [103.3.18.200])
        by rfr001.mail-bam.net (Postfix) with ESMTP id 8A46EB8536
        for <ひ・み・つ♪>; Sat, 26 May 2012 23:09:45 +0900 (JST)
Date: Sat, 26 May 2012 23:09:45 +0900 (JST)
From: [e-mail]
To: ひ・み・つ♪
Message-ID: <[e-mail]>
Subject: failure notice
MIME-Version: 1.0
Status: U
Content-Type: text/plain; charset=Shift_JIS
Content-Transfer-Encoding: 7bit

Remote host said: 550 : User unknown

このメールを受信してからは、mail-bam.netを経由したスパムがたくさん…orz

頻繁に送信元が変わるので、対策はReceivedにmail-bam.netかReceived-SPFにmail-b.netがあったらゴミ箱行きにしてます。