[SOLVED] Someone is phishing using my domain name

Mikro · 04-15-2013, 04:39 AM

Hi, I received today a spam message apparently sent from an unexistant account in my virtual server.

The email was sent to some real and some random adresses, all of them belonging to my domain. I've checked a bit (logs, access ...) and there are no clear signs of intrusion (but I am no security expert).

I've edited the personal data. server.vhost.interdominios.com is my vserver and server.es the domain name. The apparent sender is pablo@server.es (non existant). The email was sent to my mail group, group@server.es which points to info@server.es and redirected to my gmail account at XXXX@gmail.com. That is how I arranged it, so it is perfectly normal.

Partial message header:

Code:

Received-SPF: softfail (google.com: domain of transitioning gentleab91@google.com does not designate 89.248.100.21 as permitted sender) client-ip=89.248.100.21;
Date: Sun, 14 Apr 2013 19:05:24 -0300
From: <pablo@server.es>
Cc: <proair@server.es>,
	<admin@server.es>,
	<abernardos@server.es>,
	<arancha@server.es>,
	<jose@server.es>,
	<jairo@server.es>,

X-Mailer: The Bat! (v2.00.0) Educational
X-Priority: 3 (Normal)
Message-ID: <7137911244.NEG05YX0597699@rdtpooyzf.fmpmjje.net>
To: <pablo@server.es>

...

As I understand, the message was faked to look like it had been sent from my server but the original address is (somehow, probably faked too) expostulationx8@google.com and the "answer adress" is gentleab91@google.com

Is this so?

I know it is not very difficult to tailor an email, but is it SOOO easy that you can fake any domain name you want? Or has my server been seriously hacked into?

How can I stop this?

Thanks a lot!

Dån

linosaurusroot · 04-15-2013, 05:46 AM

Quote:

Received: from pc-82-137-44-190.cm.vtr.net (pc-82-137-44-190.cm.vtr.net [190.44.137.82])
by server.vhost.interdominios.com (Postfix) with ESMTP
for <group@server.es>; Sun, 14 Apr 2013 23:52:42 +0200 (CEST)
Received: from [221.197.51.196] (account expostulationx8@google.com HELO kwyqzwvysh.pnvqsitm.tv)
by pc-82-137-44-190.cm.vtr.net (CommuniGate Pro SMTP 5.2.3)
with ESMTPA id 853941885 for pablo@server.es; Sun, 14 Apr 2013 19:05:24 -0300

Traffic that claims to come from you but actually arrives from elsewhere is a good candidate for deleting.

Also if they are guessing multiple names that don't exist at your server that suggests spam.

Quote:

From: <pablo@server.es>
Cc: <proair@server.es>,
<admin@server.es>,
<abernardos@server.es>,
<arancha@server.es>,
<jose@server.es>,
<jairo@server.es>,

Habitual · 04-15-2013, 11:29 AM

221.197.51.196 / www196.asd.tj.cn.

sundialsvcs · 04-15-2013, 12:53 PM

I get messages from "god@heaven.com" all the time ... (Ahh, good ol' Ray Stevens ... "Phone Call From God.")

PTrenholme · 04-15-2013, 06:46 PM

If you're really concerned about this, ask the moderators to move your thread to the security sub-forum, or just go there and read the various threads about "how to secure ..."

Mikro · 04-15-2013, 07:33 PM

Quote:

Originally Posted by PTrenholme

If you're really concerned about this, ask the moderators to move your thread to the security sub-forum, or just go there and read the various threads about "how to secure ..."

Thanks. Will do that.

Dån

unSpawn · 04-21-2013, 05:01 PM

Quote:

Originally Posted by Mikro

I know it is not very difficult to tailor an email, but is it SOOO easy that you can fake any domain name you want?

As you have experienced, yes.

Quote:

Originally Posted by Mikro

Or has my server been seriously hacked into?

If you think your vserver has been compromised you can investigate. Even if it isn't it should be a good exercise should you ever need it for real.

Quote:

Originally Posted by Mikro

How can I stop this?

If you run one, decide if you need to run a (publicly accessible?) MTA, review the standard Postfix documentation, RBL configuration and add greylisting.

Mikro · 04-21-2013, 05:18 PM

Thank you, unSpawn. The spamming storm has passed.

Quote:

Originally Posted by unSpawn

If you think your vserver has been compromised you can investigate. Even if it isn't it should be a good exercise should you ever need it for real.

I will run some more security checks on the server to sharpen my skills, but looks like everything is in order.

Thanks for your time

Dån

unSpawn · 04-21-2013, 05:45 PM

Quote:

Originally Posted by Mikro

The spamming storm has passed.

As in famous last words? ;-p

Quote:

Originally Posted by Mikro

I will run some more security checks on the server to sharpen my skills, but looks like everything is in order.

Sharpening skills definitely is cool but I'd rather see you review your Postfix, RBL and greylisting configuration first.

Noway2 · 04-22-2013, 08:14 AM

Look at the email headers. In particular notice this one:

Quote:

Received: from pc-82-137-44-190.cm.vtr.net (pc-82-137-44-190.cm.vtr.net [190.44.137.82])
by server.vhost.interdominios.com (Postfix) with ESMTP
for <group@server.es>; Sun, 14 Apr 2013 23:52:42 +0200 (CEST)

Your machine, server.vhost.interdominios.com, received the message from 190.44.137.82. This IP address is a known spam source. It is currently listed by Sorbs, CASA-CBL, and others. You can have Postifx automatically check these lists and reject the message if they banned, which this message should have been.