[SOLVED] Slightly OT: Spam being sent from my domain or just backscatter?

sombragris · 03-12-2014, 07:01 PM

Hi folks,

Bear with me this OT issue. I share the issue here because I trust most of the regular people here.

THE ISSUE:
Starting this morning, I began to get thousands of bounce messages.
Apparently, spam was being sent from my domain.

I understand that most of these issues are just backscatter, but judging from the headers of the bounce messages I cannot be sure.

Thus, my question: can you tell if this is just backscatter or if my domain account was hijacked? Thanks in advance.

Below there is an anonymized bounce message.
Key: myhosting.com = my hosting provider
mydomain.org = my domain name

Code:

Envelope-to: sombrag@myhosting.com
Delivery-date: Wed, 12 Mar 2014 17:44:13 -0500
Auto-Submitted: auto-replied
From: Mail Delivery System <Mailer-Daemon@myhosting.com>
To: sombrag@myhosting.com
Subject: Mail delivery failed: returning message to sender
Message-Id: <E1WNrsj-00062X-29@myhosting.com>
Date: Wed, 12 Mar 2014 17:44:13 -0500

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  someone@att.net
    SMTP error from remote mail server after RCPT TO:<someone@att.net>:
    host scc-mailrelay.att.net [204.127.208.75]: 551 not our customer

------ This is a copy of the message, including all the headers. ------

Return-path: <sombrag@myhosting.com>
Received: from sombrag by myhosting.com with local (Exim 4.82)
	(envelope-from <sombrag@myhosting.com>)
	id 1WNrsY-00061L-S6
	for someone@att.net; Wed, 12 Mar 2014 17:44:02 -0500
To: someone@att.net
Subject: Voice Message Notification
From: "WhatsApp Messaging Service" <service@mydomain.org>
X-Mailer: JustMeCollection
Reply-To: "WhatsApp Messaging Service" <service@mydomain.org>
Mime-Version: 1.0
Content-Type: multipart/alternative;boundary="----------13946642425320E332D02A9"
Message-Id: <E1WNrsY-00061L-S6@myhosting.com>
Date: Wed, 12 Mar 2014 17:44:02 -0500

------------13946642425320E332D02A9
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit

(some spam here)

ReaperX7 · 03-12-2014, 11:47 PM

Try to pinpoint which IP address they are originating from first.

jtsn · 03-13-2014, 06:53 AM

Quote:

Originally Posted by sombragris

Below there is an anonymized bounce message.

That's not very useful.

General tips:

Set SPF records on your domain to reduce abuse by spammers as a MAIL FROM.
Use DNSBLs like backscatterer.org and reject mails with empty MAIL FROM from these servers.

sombragris · 03-17-2014, 03:57 PM

Thanks for all the answers. Spam was being set indeed from my hosting site. The issue: a very old WordPress theme. So, do not only check you WordPress install proper; check also your themes and plugins. Marking thread as solved.