Aaarrrrrrrggggghh Spammers

[grandmaster]

Some moron is spoofing my domain and sending out spam,
I'm getting tons of replies from peoples accounts and undeliverable messages etc.


Why cant they ask me first..in a locked room...with immunity for me against being arrested and found guilty of assault

Morons!

[banjo]

I have received several emails that have been supposedly sent from my own email address, I don't know how they do this but if I block these messages I block myself if you see what I mean ?

[grandmaster]

using a simple form you can pretend to be anyone you like but obviously you cant get the reply.

My friend wrote a script a number of years ago and sent me a mail from bill gates

It was funny and harmless at the time but sending hundreds pretending to be from my domain is another thing all together....

[Kymmy]

Anyone can send out an email pretending to be anyone else, but it's a matter of finding out which SMTP servers allow it..

VM will allow you to do this but you have to be conencted to thier network (as with most anti-relay rules) and they do log the IP against the user..

There's NO WAY you can stop it apart from at the source

[Raistlin]

Had this happen to me a while back, got so bad that I couldn't weed through them and get to the stuff that was legit.

The first week alone I must have received over 100,000 items of mail

In the end I ended up sending the whole lot to /null for a week until it stopped.

[grandmaster]

Originally Posted by Rob M

Had this happen to me a while back, got so bad that I couldn't weed through them and get to the stuff that was legit.

The first week alone I must have received over 100,000 items of mail

In the end I ended up sending the whole lot to /null for a week until it stopped.

Not a bad idea!

[Dai]

You may be able to reduce the volume a bit by going to your domain host and blocking anything not sent specifically to your user name ie "grandmaster@"

otherwise you've been "joe jobbed" and it'll die off in a few days.

http://en.wikipedia.org/wiki/Joe_job

It's a total PITA. I've had a couple of my domains hit the same way. All you can do is wait it out.

[grandmaster]

I have set it to null for now, the domain is not important for email anyway.
Its just where i host a few pics...

thanks for the replies!!

Ryan

[dragon]

I've been getting a lot of spam emails lately that they try and look like they are come with a from address matching mine

I think they are forging the From address to look like the TO address presumably to try and fool spamfilters into thinking it came from a trusted domain

Thankfully the spam filter hasn't fallen for it (I use Untangle in front of the SMTP)

[Dai]

Originally Posted by dragon

Thankfully the spam filter hasn't fallen for it (I use Untangle in front of the SMTP)

Untangle - looks really interesting. Thanks for the mention as I'd not come across it before.

[Callumpy]

Originally Posted by DaiNasty

Untangle - looks really interesting. Thanks for the mention as I'd not come across it before.

I want untangle. But i dont want to run a second server for it.

It looks good though

[dragon]

Originally Posted by DaiNasty

Untangle - looks really interesting. Thanks for the mention as I'd not come across it before.

It doesn't seem to handle a routed subnet to well, either I set it up wrong or there was something very strange going on.

Network settings were set correctly as far as i could tell but I managed to get it to create a routing loop for certain destinations, it was really strange I could ping an external Ip address and get a reply back, but if I did a tracert it would hit the int IF then the external IF and then back to myself!

In the end I switched it into bridge and went back to pfSense for routing and firewall and just untangle for the spam/virus scanning.

I do it in one box thanks to vmware (Cost to co-lo another box would be to high)