Can't forward email — new trick for old phish?

[Territan]

I got a phishing email recently, pretending to be a notification from Facebook. Par for the course so far and hardly Verizon's problem, I know. Patience...

Many companies, epecially credit card companies and banks, maintain email addresses so you can report exactly this sort of suspicious email. Facebook has one too. Again, sounds like it's not Verizon's problem, but...

When I tried to forward the hinky message to the proper authorities, the SMTP server spit it back in my face. Refused to send it. No reason given beyond "Sending the message content to the server failed." While not squarely in Verizon's court, the ball has hit the net, and stuck there.

I sent another test message to myself, and it went through just fine. So it's just that one message. Which raises questions:

• Could the phisher have stuck something into the email to prevent it from being forwarded?
• Could Verizon, in its finite wisdom and infinite attempts to cover its **bleep**, be blocking the email from being sent because it contains suspicious elements? Which, technically, it does—I'm trying to forward the original message to report it.

Either there's a technical limitation on Verizon's smtp server that's preventing the forwarding, or Verizon itself has set a "protection" on the server to keep suspicious emails from going out. I have "protection" in sneer-quotes in this case because, by preventing the forwarding, Verizon is protecting the phisher.

Suggestions?

[lilhighway]

territan,

i wonder if verizon can fix the problem? i can fix the problem but verizon does not like my fix lol good luck with verizon tech support.

[tns2 · Accepted solution]

Forward it to verizon's spamdetector.notcaught@verizon.net which allows such to be forwarded.  They do contact the other companies where necessary.

If you foward to other locations they really don't know that you aren't the spammer and so it gets stopped.

[lilhighway]

tns_2 do you forward your spam too?how much spam you recieve in a day?

[Territan]

---

@tns_2 wrote:

Forward it to verizon's spamdetector.notcaught@verizon.net which allows such to be forwarded.  They do contact the other companies where necessary.

---

...and it's on its way. Thanks for the info.

Yeah, that tells me that it's a protection that Verizon has in place to deal with such things. And on this my feelings are mixed—

On the one hand, it's reassuring to know that such protection is in place.

On the other hand, I'd never seen that email address before. Where was that posted? Because if I didn't post it here, I might never have known about it and it would never have gone through. There are numerous other instances that I'd forwarded to the proper authorities according to their websites, including credit card companies and banks. How long has this "safeguard" been in place?

Frankly, I have more trouble with false positives—legitimate emails that never make it to me. That's why I turned my spam detector off in the first place. And use the whitelist. And some stuff still gets stopped at the gate.

---

@tns_2 also wrote:

If you foward to other locations they really don't know that you aren't the spammer and so it gets stopped.

---

Ummmm, yeah, about that...

If Facebook explicitly sets up an email address (phish@fb.com) for the forwarding and reporting of phishing messages, and then mistakes an email forwarded to that address as a phishing message itself, than Facebook has far, far worse problems than customers being phished.

[tns2]

---

@lilhighway wrote:

tns_2 do you forward your spam too?how much spam you recieve in a day?

---

5 to 10 a day thay aren't already stopped.  I forward to verizon's site and the US goverment site spam@uce.gov .

My older verizon.email id (about 10 years old) gets most of them.  Almost none to my newer verizon email id.  I probably would cut down on spam received if I retired the older email id.

[lilhighway]

If From Contains verizon delete
If From Contains facebookmail.com delete
If From Contains .net delete
If From Contains .co delete
If From Contains .info delete

this is my filter setup it works

[tns2]

---

@Territan wrote:

---

,,,

---

@tns_2 also wrote:

If you foward to other locations they really don't know that you aren't the spammer and so it gets stopped.

---

Ummmm, yeah, about that...

If Facebook explicitly sets up an email address (phish@fb.com) for the forwarding and reporting of phishing messages, and then mistakes an email forwarded to that address as a phishing message itself, than Facebook has far, far worse problems than customers being phished.

---

The mail is not being stopped by facebook when you send it to that address.  It gets stopped by anyone of  a number of providers inbetween.  Perhaps verizon (yeah they have been known to  not detect it when they receive it but detect it on sending) or perhaps anyone of the servers between you and Facebook.

[lilhighway]

tns,

your gonna get spam no matter how old the account is unless you take the proper steps to pervent spam.fyi sending spam to spamnotcaught is not a step to pervent spam. if you setup windows mail or windows live correctly you will not recieve spam enough said.

[tns2]

---

@lilhighway wrote:

tns,

your gonna get spam no matter how old the account is unless you take the proper steps to pervent spam.fyi sending spam to spamnotcaught is not a step to pervent spam. if you setup windows mail or windows live correctly you will not recieve spam enough said.

---

Nothing will currently prevent spam.  Setting your email "correctly" doesn't prevent it either, just makes sure it is more likely to be caught.  I don't let my Email client on my machine just delete spam.  Instead it goes to a spam folder, and anything that goes there is what I forward to smamnotcaught along with any new spam the client didn't detect.

As far as age of IDS.  I am pretty careful about sending out my email only to legitimate people, but unfortunately not everyone I send mail to is as careful.  Overtime someone will harvest your ID and then of course it will start receiving spam.