Mass Spam

Danger Phoenix · 8 Aug 2007 at 11:31

Hxc said:
cPanel's email programs are absolutly awful at dealing with spam, I'd use a mail client and a software spam filter to do anything to a domain account.

Well it has just started today... so it is someone using my domain. And at present I am not worried about receiving it, but more about my domain being blacklisted

syke · 8 Aug 2007 at 11:31

Dont subscripe to certain websites

.

Danger Phoenix · 8 Aug 2007 at 11:32

Syk3 said:
Dont subscripe to certain websites .

I didn't

syke · 8 Aug 2007 at 11:34

Danger Phoenix said:
I didn't

I get a lot of spam on my website emails - i just filter dodgey words at the front of the email addresses and it automatically deletes them.

Danger Phoenix · 8 Aug 2007 at 11:38

Syk3 said:
I get a lot of spam on my website emails - i just filter dodgey words at the front of the email addresses and it automatically deletes them.

Yes, but this is not from the spammer... these emails are "failed delivery" emails because the spammer is using my domain name as the sender's details...

Filtering the content will stop me receiving them, but will not stop the spammer using my domain and getting it blacklisted...

Shackley · 8 Aug 2007 at 11:56

Danger Phoenix said:
Oh... hmm... GRRR! My domain name is (my name), and I want to keep it! Who would blacklist it? I may contact them right now...

You may have a long day and night ahead of you then

Here are some links that might help:

The first time I got added to a Blacklist was many years ago over one Christmas when someone exploited the sendmail open relay that I had left open. Got into work after the holiday to discover masses of emails telling me to stop sending out spam and that I couldn't send or receive email - nightmare!

For what it is worth, you may never get put onto any list - good luck, truly.

Danger Phoenix · 8 Aug 2007 at 12:00

Shackley said:
You may have a long day and night ahead of you then

<snip>

Cheers for all the links mate

Danger Phoenix · 8 Aug 2007 at 16:07

Can some of you do me a favour and send an email to something [at] hirenshah [dot] co [dot] uk where the something is anything you want

georges · 8 Aug 2007 at 16:31

done you one. (testor@...)

Danger Phoenix · 8 Aug 2007 at 16:35

georges said:
done you one. (testor@...)

Cheers... got it

Well I'm not sure what my host has done, but the spam is not around 1 email every 2 minutes, rather than 1 email per second...

Tefal · 8 Aug 2007 at 16:59

Amoeba · 8 Aug 2007 at 17:42

Shackley said:
The first time I got added to a Blacklist was many years ago over one Christmas when someone exploited the sendmail open relay that I had left open. Got into work after the holiday to discover masses of emails telling me to stop sending out spam and that I couldn't send or receive email - nightmare!

For what it is worth, you may never get put onto any list - good luck, truly.

Had the same thing here, except it wasn't so much an exploit, just me not securing the SMTP server properly

Took literally about 2 days from me turning the server on for spammers to find it and send about 3000 emails through my poor p233 box

To the OP: Good luck with whatever you try and do to fix it, sounds like you could be screwed though if somebody is spoofing your domain

Zogger · 8 Aug 2007 at 18:59

I've had the same issue with bounced emails. I came back from holiday in June to find I was receiving about 1000 emails every half hour or so. I have basically had to block (in cpanel) anything from postmaster or mailer-daemon or the like, and anything with ***SPAM*** in the title.

I don't get many of them now but unfortunately I would imagine my domain's reputation will suffer somewhat.

Danger Phoenix · 8 Aug 2007 at 19:02

I randomly emailed someone from Spamhaus, and this is what they said:

Hi, no, you can not be blacklisted for this problem. This problem happens all the time to thousands of people every day, the blacklists never act on the address the spam says it is "From" as we know this is always false.

The 'bounce attack' on you will stop in a day or two, as the spammer will change to using someone else's domain as his 'From'. So for the moment there's nothing you can do except trash the bounces.

Regards,

Steve Linford
The Spamhaus Project
http://www.spamhaus.org

Amoeba · 8 Aug 2007 at 19:32

Problem solved then hehehe

Phaser · 8 Aug 2007 at 19:36

How come you always use [email protected]

Wouldn't it be better to just setup one account for registrations etc and use that with no catchall?

HungryHippos · 8 Aug 2007 at 20:50

yup the spam databases blacklist based upon the IP address of the sending server as it's so easy to spoof a from address.

This isn't SPAM per se, it's legitimate NDR messages that are being generated as some tard has spoofed your email addresses, the fact you have a catchall means that you will receive every last email sent to your domain.

unlucky :8

Danger Phoenix · 8 Aug 2007 at 20:58

Phaser said:
How come you always use [email protected]

Wouldn't it be better to just setup one account for registrations etc and use that with no catchall?

I use it because it allows me to filter emails easily in my Outlook, and also if one website starts sending me spam, I can block that [email protected]...

I suppose that doesn't help when something like this happens

Eulogy said:
yup the spam databases blacklist based upon the IP address of the sending server as it's so easy to spoof a from address.

This isn't SPAM per se, it's legitimate NDR messages that are being generated as some tard has spoofed your email addresses, the fact you have a catchall means that you will receive every last email sent to your domain.

unlucky :8

Yeah... I wish I could kill the guy, because sifting through the emails trying to spot the ones I want to keep is becoming a headache. The spam has picking up again to around 5 every minute... still less than this morning.

If tomorrow there is a news article saying "Spammer Killed In Frenzied Attack" it wasn't me

Bry · 8 Aug 2007 at 21:33

depending upon how many different [email protected] you could try setting up forwarders in cpanel.
As i was getting around 300 spam emails a day and i had a catchall email and have about 5 email addresses like forum@domain and support@domain

What i did was turn catch all off, setup my main address and then forward the other address (forum@ support@ etc) to my main address.
This had the effect of stopping all the random names@domain email from getting through but still allowing me to use the few other addresses i wanted to use.

Obviously the degree of success with this will only work depending upon how amny addresses you have and whether or not they are all going to certain addresses or random ones

Danger Phoenix · 8 Aug 2007 at 21:40

I have hundreds of addresses, which makes it near impossible to do... for every site I have signed up at, or for everything I have put my email address down, it is a different alias.

Ranging from giving Barclays my email address to placing an order online at HSS...