Spam Attack! from my domain?!

someone is pretending to be my site!

[ezyid]

Hello all,
Yesterday I received from 500 to 1000 emails that were mostly returned to sender.
All to my domain.
But, they were all sent from my domain.

The thing is the emails were sent from say [e-mail] to [e-mail]

and returned to me as I have the catch all for my domain.

Obviously I received some people who were angry with me for sending them spam.

I am preying that no one has reported my domain on any blacklist, does anyone know what I can do to protect myself from such attacks and from any blacklist?

I’m rather worried as I don’t want to be in trouble for something I haven’t done!

Cheers.
Steve.

[Automan Empire]

I get spam "from" myself once in awhile- me@mydomain dot com, from me@mydomain dot com.
How the heck do they do that, I always wonder?
In my case, I get a dozen gibberish emails a week sent to my controversial political hobby site. If it was in response to me spamming, I wouldn't feel too sorry for myself, nor expect anyone else to.
-Automan

[Moparx]

Is the email originating from your server or is someone just using your domain as a return address?

If the mail is originating from your server, you will need to lock down your mail server and also look for any form mail scripts that need to be secured.

If they are using you as a return address you can set up an SPF (Sender Policy Framework) Record [spf.pobox.com].

Here is a little background on SPF if you don't know what it is:

SPF fights return-path address forgery and makes it easier to identify spoofs.
Domain owners identify sending mail servers in DNS.
SMTP receivers verify the envelope sender address against this information, and can distinguish authentic messages from forgeries before any message data is transmitted.

[bts111]

I get these horrid emails all the time.

Haven't these losers got anything better to do?

[oneguy]

I get spam "from" myself once in awhile- me@mydomain dot com, from me@mydomain dot com.

I get those too.

It's better than me @mydomain to everyone everywhere. (which has happened before... not through my server, but I got all of the bounces.)

[ezyid]

MMM... it seems that they sent out random messages to thousands of people, mailnly from aol.

Could this be an attempt to get me reported as a spam sender?

My messages that were returned looked like this....

subject:
Returned mail: see transcript for details

Body:
The original message was received at Wed, 16 Nov 2005 13:45:34 +1300
from localhost.localdomain [127.0.0.1]

----- The following addresses had permanent fatal errors -----
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]
<[e-mail]>
(reason: 554 (RLY:B1) [postmaster.info.aol.com...]

----- Transcript of session follows -----
... while talking to mailin-02.mx.aol.com.:
>>> QUIT
<<< 554 (RLY:B1) [postmaster.info.aol.com...]
... while talking to mailin-01.mx.aol.com.:
>>> QUIT
<<< 554 (RLY:B1) [postmaster.info.aol.com...]
... while talking to mailin-03.mx.aol.com.:
>>> QUIT
<<< 554 (RLY:B1) [postmaster.info.aol.com...]
... while talking to mailin-04.mx.aol.com.:
>>> QUIT
<<< 554 (RLY:B1) [postmaster.info.aol.com...]
554 5.0.0 Service unavailable

[Jane_Doe]

This spoofing happens to a lot of sites and even just people with email addresses.

One of our neighbors got a spam email at work, spoofed to look like it was from me. Only I never even knew the person's work email address and it was not stored anywhere on my PC, so I could not have possibly sent her spam even if I had wanted to.

We eventually figured out that her home PC had gotten infected and everyone in her email address book on her home PC was getting their address spoofed by email being sent out with viruses attached.

Our neighbors are Filipino, so for a few months I kept getting weird email rejected or returned messages due to viruses from antivirus software belonging to people with Filipino surnames.

[inbound]

I had a really bad case of this a while ago. A pharmacy site sent what must have been tens of thousands of emails with a faked 'from' address (server not comprimised).

I recieved thousands upon thousands of returned emails on the first day (no real limit on the email box on my server, and no real rules set up at the time as there seemed no need). I thought that they would move on to a different address soon enough so I did nothing on the first day.

On the second day it got worse! So I did a little digging and found the company that was responsible. They weren't a legal target that I could easily deal with so I simply set my catch all email address to forward to their email box. I honestly thought that they would get around that easily. However, it turns out that it must have been easier for them to send emails posing as a different sender than deal with someone who was fighting back.

There is thepossibility that the sender will get upset and try to get their own back in some way but I suspect that they get 'annoyed' by many people and just move on.

[inbound]

P.S. I never had an blacklisting issues arise from it (that I'm aware of). I may have just been lucky.

[ezyid]

Thankyou for your replys.. im still not happy tho.

I mean what is the point of sending out thousands of emails pretending you are someone else?

Dosent make sence!

[rocknbil]

ezyid tell us, do you have cgi mailer scripts on your server that are possibly unsecure and are being compromised for the purpose of spamming?

The following is going on that assumption. One or two stabs at a domain email address is nothing, but thousands indicate some sort of script abuse.

One attack is to send hundreds of emails to these scripts with [e-mail] in each of the fields until they find one that they can violate by adding a newline and their own BCC: field. In this bcc field they dump thousands of email addresses to send out spam in your name. Many programmers mistakenly point their screening attention at the recipient (to) and sender (from) fields, but the violated field can be any part of a valid mail header, including the subject or even message body fields (if the message body immediately follows the headers in your configuration.) Some attacks even print their own multipart mime-type headers and muck up the works that way.

If successful, remember what a BCC field does: those of you that get one or two of these may think no harm done, but being a BCC, you didn't get to see the thousand AOL addy's that were spammed.

Anything you do on the web page itself can be irrelevant. For example, if your "subject" field is a select list you might think you're safe because they can only select the values from the list. But the way this is done is to make a request to your script across the internet from a command line or program that never actually hits the form page.

Chances are good that "they" aren't mad at you; they don't care who you are, nor how much damage it causes. Why? Most simply, "because they can." If they can con one of those recipients out of five bucks, it's worth it. If they can slow down the AOL mail server for a millisecond, it's worth it. If they can ruin someone's day, brag to their circle of hackers that they did it, anything, it's worth it.

It can get you blacklisted or ignored, yes, but most likely you'll get a warning from AOL or someone that your scripts are being abused to spam AOL users. Review your code, close up the holes, accept only valid input and they will go away. Or at least not be able to use your server to do their dirty work.

This is all, of course, only if they are using your mailer scripts to do so. BUT! By the tone and nature of your original post - If you are sending spam, kharma's a nasty bug. :-)

[ezyid]

intresting,
I do have a mailer script.. but this script sends the emails from a completly different server.. and with completly new ip/url!

I will have to look into a way that i can stop the abuse then.

Cheers.
Steve.

[ezyid]

Im really worried now, can i find out where the best and latest blacklists are?

and if I am on one doe this effect search engines?

Cheers.
Steve.

[freeadcentral]

Steve,

Thanks for the opportunity for my first post to this forum. Wish it was under better circumstances...

Please, do yourself a favor. From my own personal experience - get in touch with your host asap and let them know about this spoofing. Talk with them and get a catch-all set up.

They'll know what is happening. And they'll know how to stop it. But it's very important they know it's not you! They have to reply to complaints! If you haven't communicated with them, it is entirely possible they'll assume the worst.

More important than a black list at the moment would be your hosting privileges. You CAN be shut down.

HTH,

Mark

[GeorgeK]

One method to reduce the problem is to publish SPF records for your domain name. See:

[openspf.org...]

It lists which servers are allowed to send email for your domain name. Not everyone is using SPF, though, but some of the "big boys" (Yahoo, Hotmail, AOL) do, so it would help against forged emails being sent to recipients at those sites.