The From field in most spam is forged and meaningless. Some spamware uses addresses from the spammer’s “To” list to also fill in the “From” address. Usually that is just a random selection, but occasionally spammers “bounce bomb” a particular recipient with thousands of forged return-paths forged in the victim’s name, either out of revenge or simply because their ratware is shoddy and the random rotation fails.

Such an attack is sometimes called a Joe job, but a Joe job attack falsely implicates the victim as being the beneficiary of the spam message. A forged From attack is more similar to what happened to and resulted in civil judgement against the spammer ([1], [2]). Both those attacks occurred in 1997. Abuse desks and anti-spammers are well aware of such things.

Either way, Spamhaus is careful to avoid such innocent victims of spammers. We don’t list for forged From and we don’t list Joe Job victims.

Leave a comment