Undeliverable mail attack

Gekko

I'm not sure if the correct name for this is a "denial of service" attack, but basically a spammer is somehow using my domain to spam people and when the email gets bounced back, I get all the undeliverable mail emails.

I've had several hundred just this afternoon.

Is there anything I can do to stop this as it's a bloody nuisance.

It happened last week one day as well.

DonkeyStyle \o/

Are you using any form-mail scripts a spammer could be abusing? Might be worth checking the websever logs for someone hitting it hard.
Are you sure the initial emails are originating from your domains mailserver? (ie. they're not just spoofing it (not sure if this would be preserved in the headers you're getting back though))
Does the sending mail account exist? Maybe change the account password to something strong if it does.
Maybe your host could have a look and shed some light on it.

My 2c anyway... sounds like a bit of a nightmare.

mneylon

They're probably bouncebacks

Just make sure you don't have any catchalls enabled and that will help

Gekko

Thanks guys - I think this is being done by spoofing my mailserver as they'd need a password to do anything otherwise.

I'm going to change the catchall setting and hopefully that will put a stop to it. My Gmail account which I use to catch spam had 950 emails logged to give you an idea of the number!

butts

Same thing happened to me about 3 or 4 times over a two week period and then stopped. My only concerns are, could my domain name get black listed from been associated with spam and subsequently lead to legitimate email from me getting blocked by other mail servers?

Adam

butts wrote: »

Same thing happened to me about 3 or 4 times over a two week period and then stopped. My only concerns are, could my domain name get black listed from been associated with spam and subsequently lead to legitimate email from me getting blocked by other mail servers?

To answer your question, yes. An email address my dad uses get's a very large amount of spam, and it was blacklisted, he couldn't send any emails until the registry was contacted, can't remember the name of the association though, sorry.

cgarvey

Gekko wrote: »

I'm not sure if the correct name for this is a "denial of service" attack, but basically a spammer is somehow using my domain to spam people and when the email gets bounced back, I get all the undeliverable mail emails.

Probably just a Joe Job Attack, but do check your outgoing mail server to make sure it's not a compromised SMTP account, SMTP service, or Web Script. Other than that, not a whole lot you can do if it's a mail address you use. If it's all different addresses at your domain, disabling any catch all alias will help.

It's a common enough attack, if that's what it is.

Gekko

My Gmail spam catcher seems to have weeded alot more of them out earlier today...about 500 more of them.

Peanut

butts wrote: »

...My only concerns are, could my domain name get black listed from been associated with spam and subsequently lead to legitimate email from me getting blocked by other mail servers?

Only if it's sending out spam, shouldn't make any difference what it receives.