How the hell are spammers using my domains email accounts!?

Hey all,

I'm just wondering how on earth are spammers using my domain email accounts to spam?

They've actually made accounts using my domain names, and then spammed the living shit out of email accounts...

The reason I want to know is to to prevent this from happening, I had bluehost contact me last year with the same issue and now I've just purchased a new domain, with new hosting and I'm wondering "how the f'ing hell is this happening again??"

Anyway thanks for the replies and I hope this is the right section to post in.

Gilesy

Do these email accounts exist ? If yes, change your password.

What do you mean by script? I've always just used cpanel...

No the accounts they're spamming with were made by them!?
I can't even see the accounts they're using in my cpanel account..

so the email accs are alive but not viewable in my cpanel? Is this even possible?

What kind of hosting do you have? If you have standard webhosting it's most likely managed by the hoster. Ask them for a security audit of your account. Tell them that your account has been compromised and that you need a complete reset of all passwords and an in-depth search of all your folders to find where the malicious code is hiding that logs your passwords. Cause I think you've got something nasty hiding and running in your folder structure.

oydeh said:

I mean, what script for website, wordpress, html, cutom script etc.
not control panel.

Click to expand...

Ohh.. I used xsitepro to build these websites... you got any ideas?

My guess is they are using a mass mailer application! which allows to mask the an email with any email address!

I don't think you can do anything!

I just mailed my host to have them look into and give me some advice...

I have alot of hosting solutions but this one is on a shared server. I had a very similar problem when I was with bluehost, and then I was with EW until he screwed up, so I wouldn't be blaming any hosts for this but how the hell did they plant anything on my system?

And more importantly how can I stop people like this?? Depressing to think that someone can actually mask their email account and spam away

Those are spooffed (fake) e-mail accounts, nothing much you can do about it, but nobody takes them too seriously, so if you get angry e-mails from spammed people - just refer them to spamcop or just tell them it's fake and ask them to check the ip

I get my share of them, especially on my oldest domain

andytopspin said:

What kind of hosting do you have? If you have standard webhosting it's most likely managed by the hoster. Ask them for a security audit of your account. Tell them that your account has been compromised and that you need a complete reset of all passwords and an in-depth search of all your folders to find where the malicious code is hiding that logs your passwords. Cause I think you've got something nasty hiding and running in your folder structure.

Click to expand...

jairathnem said:

My guess is they are using a mass mailer application! which allows to mask the an email with any email address!

I don't think you can do anything!

Click to expand...

dowser said:

Those are spooffed (fake) e-mail accounts, nothing much you can do about it, but nobody takes them too seriously, so if you get angry e-mails from spammed people - just refer them to spamcop or just tell them it's fake and ask them to check the ip

I get my share of them, especially on my oldest domain

Click to expand...

I wish people who spam would learn how to market and instead of being dicks... the worst people online have to be spammers and virus coders... sadistic people, who need some porn in their lives or something..

well at least my host knows now, and I use offshore hosting/domains so shouldn't be any hassle.

Cheers as always for the suggestion boys, BHW never lets ye down!

i need inbox mailer

oooo I just won the Nigerian lottery and if I send them my credit card details I can claim my prize!

Archeon said:

oooo I just won the Nigerian lottery and if I send them my credit card details I can claim my prize!

Click to expand...

I won that last year but forgot to claim hahaha

It's likely they're just spoofing email accounts from your domain in the send. You can usually check the email headers and see where it's really coming from.

I'm really sorry, OP, I'll tone it down some.

This is awful.

Use security tight. shut off your smtp relay. use password authentication.

is your server an open relay? check it at mxtoolbox.com

Chees said:

is your server an open relay? check it at mxtoolbox.com

Click to expand...

Tried it there, its not on an open relay!?

They are spoofing sender addresses with your domain name. As it's been already pointed out there is not much you can do about it. I second using mxtoolbox.com to make sure your mail server config is following best practices.

I see this once in a while as a hosting service. Typically it has nothing to do with your hosting or website. What they do is use a compromised server and spoof the email header so the emails that bounce hit your server rather than the one they originated from. They typically use a valid email account from your website so it appears the emails came from you and are bouncing back to you.

Check the IP in the email header and contact the owner of the server sending the emails. They have an open relay or compromised email account and they'll shut it down and thank you for letting them know.

Second thing is to drop the email account on your server that the spammers are using so when the emails bounce back to your server they bounce back to the originator and aren't received by your host. Basically just delete the email account and use something different so you don't see all the bounced emails and neither does your host.

If you look at the bounced messages they're probably an alphabetical list of names to large companies in China or Russia.

Double check and make sure you're not using stupid passwords either on your email accounts. Most of the time the compromised email accounts are like [email protected] and the password is webmaster. DUH just waiting to be hacked. I had several clients using my hosting service doing such stupid stuff and of course they all got warnings once I saw the relays being sent from their compromised email accounts.

Good luck

Its inherent on the SMTP protocol. There is no password required to send mail. If you know a bit of SMTP you can sent it from any smtp servers that allows you to relay (eg from your isp, or your own smtp, or an open smtp, or a hacked smtp, or a hacked pc running an smtp for the spam bot).

There are only checks to see if the sending domain really exists and thats only recently. Good receiving-mailservers also check against the senders domain mailserver to see if the account actually exists but many domain mailservers just always say 'yes' since they have no checks (eg a frontend smtp for an exchange box that is not coupled into the AD). Since the spoofed mails are getting through from unexisting accounts it looks like your domain mailserver always says yes or the receiving mailserver does not perform this check (many mails get classified as false positive spam by this so many admins disable these checks)

If you like to know more about this just sent a PM, i'm not going to give a class here

Anyway,