Someone is spoofing my domain

**Buddha** · 05-31-2004, 02:20 PM

One of those looks like W32/Bagle-W trojan, email number one.

This happens to my clients sometime... Not much you can do except not give your email address out and make sure everyone you do give it to is well informed about virus protection.

We have figured out who was infected a couple time by the returned emails.

**Frank Hagan** · 05-31-2004, 04:31 PM

You cannot control what other people do. There is nothing you can do to prevent someone from making up an email address with your domain name in it and sending it out.

You can protect your real email addresses by not having them posted in a manner that they can be harvested. Don't have them in "mailto:" links on your sites, or your customer's sites. Encode them using any of the obfuscation methods. Look at Tim Williams' examples at http://www.u.arizona.edu/~trw/spam/index.htm

That way, the spammers will simply make up an email address, but they won't be using your actual email address.

Other than that, you have to wait for some kind of legislative change to track users across the Internet.

**fcm** · 05-17-2006, 05:48 PM

So here are a couple of questions about this (I have a client getting tons of this stuff, apparently from their own domain):

1. If I set up an actual email address using the 'spoofed' email address, would that help my situation? None of the emails that come are from 'legitimate' email accounts on that domain.

2. Client is concerned that if they add the sender to a 'Junk' email list (they have Zone Alarm, I think) that it will block all the other addresses from their domain, and they won't be able to send each other stuff. Any thoughts on that?

3. And finally, just to clarify, this email 'spoofing' doesn't mean that their site security has been comprimised, is that correct? Just that their domain has been targeted and someone is faking it?

Thanks in advance to those in the know. It really freaked my client out, and I am admittedly no email guru.

**Buddha** · 05-17-2006, 06:23 PM

Originally posted by fcm

1. If I set up an actual email address using the 'spoofed' email address, would that help my situation? None of the emails that come are from 'legitimate' email accounts on that domain.

No it wouldn't help. Might set the default email address to /dev/nul (blackhole in cPanel) though.

Originally posted by fcm

2. Client is concerned that if they add the sender to a 'Junk' email list (they have Zone Alarm, I think) that it will block all the other addresses from their domain, and they won't be able to send each other stuff. Any thoughts on that?

I usually tell my clients never to mark their own domain as junk. If I ain't looking over their shoulder, I don't trust them to not to be reporting themselves to Spamhaus or something.

Originally posted by fcm

3. And finally, just to clarify, this email 'spoofing' doesn't mean that their site security has been comprimised, is that correct? Just that their domain has been targeted and someone is faking it?

No it doesn't mean the server has been compromised but somebody's PC has been though. Make sure every one has up to date virus and adware protection especially those with access to the server (yourself included).

**samsam** · 05-17-2006, 11:36 PM

Originally posted by LVZ

Someone is spoofing my domain sending out EXE and PIF files which are presumably viruses or trojans under my domain name. What can I do to prevent this?

Not much. It happens to me periodically too - I get a ton of spam from some of my own domains and I think for a second - WTF?

It is trivially easy in any email client or script to put in a phony 'from' or 'reply to' address (try it yourself sometime). Hence the problem.

I find that most of these spam messages using my own address(es) in the 'from' field come about as a result of people I have emailed in the past getting their PC's infected with a virus/trojan that harvests their address books, and hence the trojan finds my address. All too common.

I can verify this because some of the spam I have received apparently from myself has used a quite complicated email address I have only used to correspond with very specific clients about specific projects, and which has never otherwise been public, or on the web etc. And which would be too hard to generate randomly.

So I certainly concur with the advice others have given here - one part of the solution is for your clients/ correspondents to keep their email anti-virus systems up to date.

Having said this though, I find that most of these spams only have a short shelf life. It's been very rare for me to get the same sort of spoofed email twice.

**mdmcginn** · 07-21-2006, 09:21 PM

SPF (if it ever became common) would reduce this problem. I added the following TXT record to my DNS zone, to signal that any email from mydomain.com that didn't go through mail.mydomain.com didn't really come from my domain and shouldn't be trusted (I don't use my ISP's mailservers):

Code:

'v=spf1 a mx mx:cpanelxx.gzo.com ~all'

Someone is spoofing my domain

Someone is spoofing my domain

Comment

Comment

Comment

Comment

Comment

Comment