Computer savvy: how can I stop this type of spam?

[soupcxan]

At least once a day, I get a spam message that looks like a returned email in the subject line, but is actually spam. They always come from the mail server at greatbasin.net. I don't think that Greatbasin (a legitimate ISP in Nevada) is sending these messages, but someone must be abusing their mailserver to send them. I've checked their mailserver to see if it is an open relay (using http://www.abuse.net/relay.html), and it does not appear to be...so how are spammers able to use their server to spam? Is their server mis-configured? I have pasted the email headers below. My email account is not with Greatbasin.net or gbismail.net or any of the domains listed below.

I have tried emailing all of the standard contact names (abuse, admin, support, etc.) @greatbasin.net but have received no reply. Do I need to call them on the phone and bitch them out? What exactly do I need to tell them to fix? Greatbasin is the only ISP that I get these types of fake-returned-mail spams from so I think they're at fault.

Headers:

From: Mail Delivery Subsystem <MAILER-DAEMON@smtp0.greatbasin.net>
Subject: Returned mail: see transcript for details
To: *my email address*

The original message was received at Thu, 27 Jul 2006 09:43:00 -0700
from [218.107.0.164]

----- The following addresses had permanent fatal errors -----
<info@gbismail.net>
(reason: 550-Mailbox unknown. Either there is no mailbox associated with this)

----- Transcript of session follows -----
... while talking to localhost.greatbasin.net.:
>>> DATA
<<< 550-Mailbox unknown. Either there is no mailbox associated with this
<<< 550-name or you do not have authorization to see it.
<<< 550 5.1.1 User unknown
554 5.0.0 Service unavailable (Mailbox unknown. Either there is no mailbox associated with this)

Return-Path: <*My email address*>
Received: from mailicopycenter.com ([218.107.0.164])
by smtp0.greatbasin.net (8.12.10/8.12.10) with SMTP id k6RGgwhO022901
for <info@gbismail.net>; Thu, 27 Jul 2006 09:43:00 -0700
Received: from 200.183.129.61
(SquirrelMail authenticated user mhmoiojb@bluemountain.com);
by mailicopycenter.com with HTTP id Ab44qw9z082056189;
Thu, 27 Jul 2006 16:50:40 +0000
Message-Id: <gU4mFx.squirrel@200.183.129.61>
Date: Thu, 27 Jul 2006 16:50:40 +0000
Subject: ONLINE MEDICATION? easy !
From: "Dahlia" <mhmoiojb@bluemountain.com>
To: <info@gbismail.net>
User-Agent: SquirrelMail/1.4.3a
X-Mailer: SquirrelMail/1.4.3a
MIME-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
Importance: Normal

Spam for viagra follows...

 

[cube_rat]

GMAIL is the best at preventing spam!!!  You need an invite though....

BTW - spam spoofing (looking like the origination is coming from one place, but in actuality is orginating from another) happens alot. You'll make yourself crazy trying to track these spammers down. It's code that's propagating spam not people -- although people built the spam code

 

[TromboneAl]

The situation may be worse than you realize.  A spammer is using your email address as their return address.  So when that spammer sends email to a non-working address, that email gets bounced back to you.

If that's what's happening, you can read up on it here:

http://www.cert.org/tech_tips/email_spoofing.html

 

[mickeyd]

Been visiting porn sites lately? I was told that some porn sites collect the email addresses of "visitors" and sell them in bulk to anyone with a buck.

Of course, porn sites that I visit would never do such a thing.  8)

 

[eridanus]

Received: from mailicopycenter.com ([218.107.0.164])

[Note that mailicopycenter.com doesn't exist...except on someone's spamming box.]

The original message was received at Thu, 27 Jul 2006 09:43:00 -0700
from [218.107.0.164]

/home% traceroute 218.107.0.164
traceroute to 218.107.0.164 (218.107.0.164), 64 hops max, 44 byte packets

...
14 po1x0-gsr2-zq1.gdgz.cncnet.net (210.21.1.17) 255.289 ms 254.836 ms 255.456 ms
15 vl3-rtr4-zq1.gdgz.cncnet.net (210.21.4.18) 250.738 ms 251.635 ms 252.036 ms
16 *^C

home% whois cncnet.net

Registrant:
China NetCom Corp.
Building C,No.156 Fuxingmennei St.Beijing,10031,China
100031


In conclusion: What T-Al wrote.