A spammer has decided to start sending his garbage using a Reply-To address of bondercine@ondercin.com . We have absolutely NOTHING to do with this spammer, the trash he is sending and are being victomized by this worthless scum. Ondercin.com is NOT an open relay and is NOT listed on any blacklist or blackhole that tests for open relays. We do not sell anything.

If you look at the headers of the mail being sent to you, you will see that the only mention of ondercin.com is the Reply-To address in the email. The mail is NOT sent from this server. An examination of your server's email log files will also show that the connecting MTA that delivered this trash to you is NOT the ondercin.com server. (Any headers showing where the email came OTHER than from your own server can be forged, you should only trust your own logs and information coming directly from trusted servers.

How is ondercin.com being victomized when you are receiving the spam?
The spammer is sending via a dictionary attack to POSSIBLE email addresses. Which means that all of the bounces to bad addresses and rejects from spam filters get sent back to the Reply-To address... Which is this poor little server. Yes, we are getting flooded by bounces to messages we have not sent and are completely against.

As an addition we will also have to deal with other administrators and postmasters that will think that we are sending this slime.

What can I do to stop this junk?
Other than setting your spam filters to DISCARD any mail with a Reply-To address of bondercine@ondercin.com, there really isn't much you can do. There is no such address as bondercine@ondercin.com. We ask that you do not block all of ondercin.com. We host several email lists from this server, notably one for discussion of the Friesian horse breed (high volume) an another for a local historical recreation group in Chandler, AZ.

Usually spammers will randomly create and use a Reply-To address for a short while (one sending, several sendings, maybe a week or so) then rotate to another one randomly created from another address. They do this BECAUSE people add that address to their spam filters quickly. So the flood will stop coming in looking like it came from ondercin.com. And the flood of bounces will stop as well.

Bounces coming in on 12-30-06
Bounces coming in on 12-31-06
Bounces coming in on 01-01-07

Regards
Postmaster at ondercin.com 31 December 2006, 12:50 GMT-5