Major Spam Issue (Anyone Else Having This Problem?)

[Teufel]

This morning I checked my e-mail and found about 60 Mail Delivery Subsystem <MAILER-DAEMON@*******.com> e-mails. Apparently someone is using my website's domain name in the From/Reply-To for the spam they're sending out. I'm being flooded with returned e-mails from ISPs all over the place.

Is anyone else using Aletia having the same problem? Any suggestions on what to do to get whoever it is to stop, or am I pretty much SoL?

I opened a ticket 7 hours ago, but no response yet. I'm really starting to get annoyed. Last thing I need is for ISPs to start blacklisting my domain for spam abuse.

[mattsiegman]

This is probably related to the Sobig virus.

[Teufel]

Originally posted by mattsiegman
This is probably related to the Sobig virus.

Damn... it's definitely wreaking havoc. It's not actually accessing my e-mail account, it's just using my domain name as the from/reply-to account, so I'm getting about 500 e-mails bounced back to me by various ISPs. I asked Aletia/Jaguar, and there's nothing they can do (as I assumed, since the e-mails aren't actually leaving from their servers).

At worst, this is a warning to everyone else. If it happened to me, it can happen to you, so be prepared for it, cos there's really not much that can be done about it except let it run it's course if it does happen.

[martin01]

Hi,
I had this at least two times on my domain. Since then I've forwarded my desired addresses to a specific pop account. All the rest I let bounce or blackhole in the default account.
I'm quite happy with this setup because I don't see the "wrong" spam bounces anymore.

Martin

[JonathanB]

I used to get a lot of those too, but after reading a great tip from someone else on this board I no longer have that problem.

For the default address (where all unrouted mail will be sent) I have the following:

:fail: unknown-email-address

The ":fail:" part causes the address to bounce back to the sender. The other part you can add anything you want (except spaces), and it will be displayed in the bounced message after the address they tried to send to.

[lookout]

Well that works well if the bounce backs are not arriving on one of your desired email accounts. But it they are and they are too numerous to effectively manage, it seems you are faced with the prospect of abandoning the account, or trying to filter out all the bounce backs (not as easy as it might appear at first glance).

I haven't seen any good solutions for retaining an account under heavy attack by false bounce backs yet. Have any of you, and if so, where?

[cub3d]

Why don't you use the spam filter gizmo in your control panel .. shouldn't be too hard to filter out all "MAILER-DAEMON" messages.

[lookout]

Been there, done that. It really doesn't work as well as you might think. Besides, I wouldn't want to filter out ALL bounce backs. They keep me alerted of legitimate email delivery failures.