Home  ›  Team Blog  ›  A New Spam Variant Is Out

Tags: ,

A New Spam Variant Is Out

Posted: Tuesday, July 6th, 2010 by Ted

We’ve been getting a large number of calls and emails today about a new type of spam that’s been hitting our customers’ mailboxes since the three-day weekend.  Typically the subject makes the message look like a Non-Delivery Receipt (NDR for short) from postmaster@somerandomdomain.com stating that a message you sent wasn’t able to be delivered and it’ll have an .html file attached.

The domain that is being sent from varies and is usually different in each message but the subject is almost always “Delivery Status Notification (Failure)” without quotes.

The body of the message will looks something like:

Note: Forwarded message is attached.

This is an automatically generated Delivery Status Notification.

Delivery to the following recipients failed.


Final-Recipient: rfc218;upholsterede65@reelradio.com

Action: failed

Status: 9.9.1

(Please note that the NDR states error 9.9.1 which isn’t an actual mail server error code)

While we highly recommend that our customers use Postini for spam and virus filtering, even Postini is having issues with this new type of spam.

What we’re currently recommending to resolve this issue until it gets under control is for our users to set up rules and/or filters in their email client to move messages with “Delivery Status Notification (Failure)” without quotes from the Inbox to another folder. We’re not recommending that you delete the messages immediately as there is the chance that legitimate NDRs can also be sent to you while this new spam type is in the loose. We’re recommending that you take a look at the NDR and see if it’s from a domain that you have sent to, if it is, do what you’d normally do. If it’s not then you’re free to delete the message from the folder.

Comments are closed.

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Help us improve this site Send Your Comments