Am I being attacked?

joshac · #1 12-18-2007, 08:32 AM

I noticed today that I had over 1,000 emails and they all looked like bounce back emails with titles like:

Out of Office AutoReply: Spam: If you're in the US or anywhere else, join your new casino

Out of Office AutoReply: Best offer in gambling history .

Google Groups: No such group

They all seem to come from my domain but I did not send them... So my question is, is some one attacking my site? are they tring to get my onto a blocked list?

Any help would be great,
Cheers.

Dominique · #2 12-18-2007, 08:52 AM

Someone is sending out mail and spoofing your address as the sender.

It is a very common thing today, happened to me a couple of times.

kwblue · #3 12-18-2007, 09:01 AM

Yes, it doesn't necessarily mean that your email server is compromised, but I would search your website for files you didn't put there anyway.

allfreechips · #4 12-18-2007, 09:17 AM

Look at the email headers to see where they were sent from (server IP) to start with. If its your server then you got issues, if not its just crap that happens.

On a side note, blacklists and spam source services report the IP of open relays and spammers not the e-mail address so getting spoofed is not that harmful.

Engineer · #5 12-18-2007, 10:48 AM

Quote:

Originally Posted by allfreechips

On a side note, blacklists and spam source services report the IP of open relays and spammers not the e-mail address so getting spoofed is not that harmful.

That's good to know. Thanks for the info!

GamTrak · #6 12-18-2007, 11:07 AM

Thanks for the information. I've had this problem for 2 years. Everyday I have to delete upto 2k of messages. 75% are junk spam and others are the standard [Mail Delivery Subsystem with the subject as Returned mail: see transcript for details].

Yesterday Windows Live Messenger would popup with a link attached to a porn titled file and had my first name as the contact name. I tried to block the sender three times, but I continued to receive more pop-ups hourly so I closed the application. After a system check I noticed a windows upgrade that was almost 200 MB and took several hours to update that caused me some concern, but it was legit.

Just to be sure I immediatly called my host to backup my portals and forum as well as change all passwords.

Goldfinger · #7 12-18-2007, 12:22 PM

Do you have a catch all account or does the spammer spoof one of your actual addresses? If he tries randomizedgarbage@yourdomain.com switching the catch all off will greatly reduce the number of mailer daemon notifications.

GamTrak · #8 12-18-2007, 01:15 PM

Hi Goldfinger,

I think that I do, but it's redirected to a yahoo account. I'm going to contact my host to discuss this while I'm thinking about it.

Thanks very much.

DRSharpe · #9 12-19-2007, 08:32 AM

Guys

If any of you are using SEND STUDIO as an e-mail system, please contact me. We were successfully hacked through a flaw in the software 2 days ago, that allowed the guys doing it to send thousands of e-mails off our server, as well as download some information (lucky for us it was encrypted)...if anyone has the software on their server, please hit me up...I will not post the hack they used/more info for fear of giving anyone ideas...ditto for PMs...I will send you a fix for it and the issue, but not the hack...so any wanna-be hackers - don't bother pretending you have the software...its not gonna happen

Cheers
Dave

Thread Tools
Show Printable Version Email this Page
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread:

The Following User Says Thank You to Dominique For This Useful Post:
GamTrak (12-18-2007)

The Following User Says Thank You to kwblue For This Useful Post:
GamTrak (12-18-2007)

The Following 3 Users Say Thank You to allfreechips For This Useful Post:
bonustreak (12-18-2007), Engineer (12-18-2007), GamTrak (12-18-2007)