Oh dear SPAM propagating?

I am sure like many others I have SPAM in my various mailboxes but to my surprise a short while ago I got one in the [email protected] mailbox. I have never seen SPAM in that one before. Bearing in mind that I never send mail from that address and it is in effect an internal address how the heck does it slip through the filtering?

I am sure I have the filtering set to maximum!

Why are you surprised? Or have you not been here the last few days?

As I understand it, ALL the mailboxes on that particular server have been compromised, so it makes no difference whether you ever used that address before or not. If it existed, it is now known to spammers.

And how is the spam filter supposed to know something was spam just because it was sent to that mailbox? It doesn't know how you use your own private mailboxes, so it would need more than destination alone to conclude that something was "spam".

T.

Well I've now got postmaster, username and a couple of others @username.plus.com filtered to delete e-mail at the server end. They can spam all they like now. It's Plusnet's problem.

Yes, I have been around these last many days and had my share of additional spam as I think I indicated.

As for which server the pnetnotices are sent from I have no idea but for the fact I have never seen any spam from that source before and granted there were many reports of 'unused' addresses being spammed but that the main raft of that was few days ago and as I said that address as I perceived is "internal" for PlusNet notices. And in my haste I did not say correctly that it was id'ed as SPAM. My surprise was the mailbox it landed in after the matter had had much attention by PlusNet.

The spam does appear to be coming in waves. It may even be that the leaked addresses were split up and sold to different people. It's also possible that after some time the known addresses will be used as the basis for more random attempts. For example, if they had the address [email protected] they may try [email protected]. Plenty of addresses only used internally have been leaked though.

I wish there was something more helpful I could add. If you think this address is reciving abnormal spam and do not think it was linked to the webmail platform, you could try getting in touch with one of the comms team. Although I haven't had much like on that front with an address I queried. One explanation given is that all email addresses that existed before the atmail system was implemented were imported into the system.

In reply to:

---

The spam does appear to be coming in waves

---

Yup.. here's a couple of stats screen links from a site that uses my spam/virus sigs:

http://overlord.oucs.ox.ac.uk/images/stats/relay/virus-day.png
http://overlord.oucs.ox.ac.uk/images/stats/relay/virus-month.png

There is no doubt better stats out there releated to PlusNet... but you can see the point and the numbers ISP/big organisations are having to deal with

Cheers,

Steve