I have a domain www.international-survey.com and have, for many years,
been using it for email. Mail sent to anyone there (say,
xxx@international-survey.org) is automatically forwarded (via a "dot
forward command") to me at my local Australian ISP and to an account I
have at AOL (which I use while traveling). The problem seems to arise
in AOL (or at least involving AOL) where I frequently get messages
saying that some hundreds of messages have bounced, seemingly ones I
sent. The message is from a discount software seller, apparently the
same one, a good number of times in the last month or so.  I have
changed my AOL password but this has not stopped the problem. The name
it uses is "bruce@international-survey.org", which is not a real
person (although "Bruce" was a name that I at one time used in as a
password hint, or something of the sort).

The question: Whats going on and how can I stop it (if that is possible)?

A copy of the most recent "bounce" message follows:

Hi. This is the qmail-send program. 
I'm afraid I wasn't able to deliver your message to the following addresses. 
This is a permanent error; I've given up. Sorry it didn't work out. 

<drjkelley@aol.com>: 
64.12.137.152 failed after I sent the message. 
Remote host said: 554-: (HVU:B1)
http://postmaster.info.aol.com/errors/554hvub1.html
554 TRANSACTION FAILED 

--- Below this line is a copy of the message. 

Return-Path: <bruce@international-survey.org> 
Received: (qmail 89584 invoked by uid 12334); 18 Jun 2004 15:49:51 -0000 
Delivered-To: webmaster@international-survey.org 
Precedence: bulk 
Received: (qmail 89506 invoked by uid 12334); 18 Jun 2004 15:49:40 -0000 
Received: from unknown (HELO 198.63.48.46) ([221.124.64.229]) 
(envelope-sender <bruce@international-survey.org>) 
by 198.63.48.46 (qmail-ldap-1.03) with SMTP 
for <bruce@international-survey.org>; 18 Jun 2004 15:49:40 -0000 
X-Message-Info: 29OBR129Wutkq918clGkTV23QWX32jmoNYpMHD086 
Received: from r-255-50-01-861.IMEHKUJ99.bruce@international-survey.org
([67.37.154.83]) by mi507-mfyu4.bruce@international-survey.org with
Microsoft SMTPSVC(5.0.3354.9453);
Sun, 20 Jun 2004 12:40:44 -0300 
Message-ID: <128916939746511720.31612@bruce@international-survey.org> 
X-Originating-IP: [57.134.86.100] 
X-Originating-Email: [bruce@international-survey.org] 
X-Sender: bruce@international-survey.org 
Reply-To: " " <bruce@international-survey.org> 
From: " " <bruce@international-survey.org> 
To: "Bruce" <bruce@international-survey.org> 
Subject: Looking for cheap high-quality software? 
Date: Sun, 20 Jun 2004 21:42:44 +0600 
MIME-Version: 1.0 
Content-Type: multipart/alternative; 
boundary="--29899237001978359" 

----29899237001978359 
Content-Type: text/html; 
charset="iso-5575-3" 
Content-Transfer-Encoding: 7Bit 

Bruce, 

TOP quality software:<br><br> 
<b>Special Offer #1:</b><br> 
<a href="http://hzw.agelmkb.info/?BQDGDS5k69IuTBBdNj">Windows XP
Professional+Microsoft Office XP Professional</a> = only $80<br>

...etc... with more information on software to sell.

Hello Colemanhuff

I have had a similar problem with one of my domain names and
unfortunately there are few effective methods of dealing with this due
to the lack of laws at present to prevent this.  This problem occurs
when your domain name becomes targetted or hijacked by a someone who
is sending out spam email.

It is a fairly simple process to send emails from *any* email address,
and this is what is happening here, but it is much more difficult to
disguise where they are coming from.  It is the fact that it is
difficult to disguise where the spam is originating that allows the
spammers to be tracked and found.

In this case, the spammer has found your domain name (it is impossible
to say where from) and has attached a common first-name to it.  This
again is a common thing that they do to make it seem more like it has
originated from a real person and part of the con to make their emails
seem more legitimate.

You are receiving the bounce message because the email has either been
sent to an email address that does not exist or has been bounced back
by the recipient.  Some webhosts/ISP's do not forward these messages
on to the user but it appears that in your case they are doing so.

AOL has also added a note to the email directing you to:
http://postmaster.info.aol.com/errors/554hvub1.html

This page notes that many AOL users have complained about the URL
contained within the bounced email.  The above page gives you details
on how to contact AOL to discuss the matter and how to deal with it in
future.  This would be well worth doing so that AOL do not ban you
from their services.

It is also possible that that the bounce message is a fake as this is
another common tactic used by spammers to test whether an email
address is real or not!  Judging by the comments you have made though
this would appear unlikely in this case.

There are a number of things you can do to tackle the problem which I
will detail below.

1)  If the email address used is always bruce@international-survey.org
you can set up all email sent to that addresses to be automatically
deleted (how you do this depends upon who your webhost/ISP is for the
domain).  This will mean that you will no longer receive any email
sent to bruce@... but as you stated this isn't a real email address
anyway it is unlikely to be a problem.  You should contact your
webhost/ISP to get them to set this up for you immediately.

2)  Contact your ISP/webhost to tell them that this email address has
been hijacked, this will let them know that it is not you who is
sending the spam and will hopefully ensure you are not blackmailed for
doing so.

3)  You should report the IP addresses located in your spam emails to
the spam email blacklists.  This will mean that any email sent from
those IP addresses is marked automatically as spam by users around the
world.  There is a list of spam blacklists here:
http://directory.google.com/Top/Computers/Internet/Abuse/Spam/Blacklists

You do not need to report it to every one but I would recommend
reporting it at least to the following ones: Spamcop.net, ORDB.org,
Visi.com, Spambag.org

4)  You should then report the spam to the Federal Trade Commission at
http://www.ftc.gov/spam who may take action against the spammer if he
is known to be a regular abuser.

5)  Contact your local member of parliament and ask for steps as to
how to stop spam in your country.  (S)he should be able you to point
you to the correct organisations to contact near your location.  I
believe this is http://www.caube.au in Australia.

6)  There is also a wealth of information on the internet as to how to
protect and report spammers.  I would definitely recommend reading the
following pages which will provide you with further detail:
http://www.claws-and-paws.com/spam-l/tracking.html
http://www.cauce.org/
http://law.spamcon.org/

If you have any further questions on this subject please ask for
clarification and I will do my best to help.

Thorough and prompt. Thank you.