Strange Emails (Undeliverable: Binder Planet. Subscription activation message.)

[jbade]

I am getting constantly hit with undeliverable emails

Undeliverable: Binder Planet. Subscription activation message.

Your message did not reach some or all of the intended recipients.

Sent: 18 May 2011 09:43:35 -0500
Subject: Binder Planet. Subscription activation message.

The following recipient(s) could not be reached:

[email protected]
Error Type: SMTP
Remote server (74.125.159.27) issued an error.
hMailServer sent: RCPT TO:<[email protected]>
Remote server replied: 550 5.1.1 http://mail.google.com/support/bin/a...py?answer=6596 e24si3880355yhg.265



I don't use paid subscriptions,
It's obviously an Automated attack.

But I can't find what Page is allowing the robot to try and subscribe.

I was going to remove Payments.php..
What else could it be trying to get to?

The email used is always [email protected] or [email protected] never anything else.

[Trevor Hannant]

Do you use SMTP mail or sendmail on your site?

[jbade]

Do you use SMTP mail or sendmail on your site?

SMTP Mail

[jbade]

The other strange thing is these emails come to me.. directly...

Where as the normal bounced messages go to a Distribution group set as the webmaster and contract us email.

[kh99]

It's someone (or a bot) registering with an invalid email address, of course. That email address is flagged at stopforumspam.com, so one thing you could do is use a mod that checks SFS on registration, like this one: http://www.vbulletin.org/forum/showt...light=glowhost

There are others that check email domain, I don't know if any let you ban a specific email address.

ETA: oh, i re-read your first post (and the one above), maybe this isn't the problem.

[Trevor Hannant]

Are you able to get the full header for the outgoing mail?

[jbade]

Return-Path:
Content-Type: text/plain; charset="utf-8"
Return-Path: <>
Message-ID: <[email protected]>
Date: Wed, 18 May 2011 11:43:38 -0500
From: [email protected]
To: [email protected]
Subject: Undeliverable: Binder Planet. Subscription activation message.
Content-Transfer-Encoding: quoted-printable
X-hMailServer-LoopCount: 1

the original email is definitely coming from my vbulletin server.. Not external.
Since this is the mail daemon response there isn't much in the header..
I'll see what I can do about the org header.

[jbade]

I haven't been able to grab the email..

But it's every half hour exactly.
And it stops for awhile.. then picks back up..

[Zachery]

'This Gmail user does not exist...'

Find the user in the user database, and remove them, or their email. Its invalid.