Mac Mail argh help. Someone using my account to send spam...

Question

Mac Mail argh help. Someone using my account to send spam...

I'm getting a weird attack. I thought it was coming from my domain server, but it seems to be originating from mac.com
I've been getting tons and tons of returned mail messages at various skulbone.com email addresses. It started with just a couple, now it's picking up speed. Do you think you can help? These are random addresses that are not my accounts, but I've received in various delivery sys return emails.

ckaunf@skulbone.com
wxwipi@skulbone.com
vra@skulbone.com
ghp@skulbone.com
lggj@skulbone.com
wvqtz@skulbone.com
xdrgq@skulbone.com
etc.

I did an email trace and it's coming up:

ckaunf@skulbone.com
virtual_aliases via/etc/valiases/skulbone.com

thevisualvoice@mac.com
Lookuphost via smtp-mx6.mac.com [17.250.244.63] MX=10

thevisualvoice@mac.com
Lookuphost via smtp-mx7.mac.com [17.250.244.62] MX=10

thevisualvoice@mac.com
Lookuphost via smtp-mx8.mac.com [17.250.244.64] MX=10

thevisualvoice@mac.com
Lookuphost via smtp-mx5.mac.com [17.250.244.61] MX=10

4 x 2.5 GHz G5, Mac OS X (10.4.8)

Posted on Oct 15, 2006 9:12 PM

Reply

Answer 1

Oct 15, 2006 9:30 PM in response to Community User

Addition: here is a long header to aid...

From: postmaster@enidine.de
Subject: Benachrichtungzum=?unicode-1-1-utf-7?Q?+ANw-bermittlungsstatus (Fehlgeschlagen)?=
Date: October 15, 2006 7:36:59 AM EDT
To: yrjtno@skulbone.com
Return-Path:
Received: from mac.com (smtpin15-en2 [10.13.11.243]) by ms32.mac.com (iPlanet Messaging Server 5.2 Patch 2 (built Jul 14 2004)) with ESMTP id <0J7700IA9MR7ZD@ms32.mac.com> for thevisualvoice@mac.com; Sun, 15 Oct 2006 20:52:19 -0700 (PDT)
Received: from server1.creativitees.com (server1.creativitees.com [64.34.170.170]) by mac.com (Xserve/smtpin15/MantshX 4.0) with ESMTP id k9G3qFvU018167for <thevisualvoice@mac.com>; Sun, 15 Oct 2006 20:52:16 -0700 (PDT)
Received: from [212.227.15.22] (helo=mout-bounce.kundenserver.de) by server1.creativitees.com with esmtp (Exim 4.52) id 1GZJWO-00037B-VZfor yrjtno@skulbone.com; Sun, 15 Oct 2006 23:52:13 -0400
Received: from [80.152.21.243] (helo=mail.enidine.de) by mrelayeu.kundenserver.de (node=mrelayeu6) with ESMTP (Nemesis), id 0ML29c-1GZ4Ic1aIR-00006O; Sun, 15 Oct 2006 13:36:58 +0200
Message-Id: <DuXoskwgn00005244@mail.enidine.de>
Mime-Version: 1.0
Content-Type: multipart/report; boundary="9B095B5ADSN=_01C6E639A24488440004AEEAmail.enidine.de"; report-type=delivery-status
X-Dsncontext: 335a7efd - 4523 - 00000001 - 80040546
X-Provags-Id: kundenserver.de abuse@kundenserver.de login:05e9aab232a68882eb6f487ad1a6f8b1
X-Antiabuse: This header was added to track abuse, please include it with any abuse report
X-Antiabuse: Primary Hostname - server1.creativitees.com
X-Antiabuse: Original Domain - skulbone.com
X-Antiabuse: Originator/Caller UID/GID - [0 0] / [47 12]
X-Antiabuse: Sender Address Domain -
X-Source:
X-Source-Args:
X-Source-Dir:
X-Brightmail-Tracker: AAAAAA==
X-Brightmail-Scanned: yes
Original-Recipient: rfc822;thevisualvoice@mac.com

Reply

Answer 2

Oct 16, 2006 2:14 AM in response to Community User

If you are getting all these as controller of the skulbone.com domain, turn off the notifications on your server. The spammer is using someone's machine to generate guessed target email addresses, the guessed addresses don't exist, and there is nothing you can do to stop it.

AK

Reply