Email been hijacked?
Author
Discussion

saf

Original Poster:

448 posts

270 months

Thursday 27th April 2006
quotequote all
Over the last couple of weeks I've been receiving notifications of "non delivered mail" all relate to my motormugs.co.uk address, the contact name (if you can call it that) is just a combination of letters not related to my address. I seem to recall something a while back relating to "Net Benefit" (which all these seem to be sourced from). I received 25 of then today, now I can't block this email as it's the one for my website.

Can anyone suggest how to remedy this, as it could end up I get blocked world-wide

Thanks
Sharon

zumbruk

7,848 posts

290 months

Thursday 27th April 2006
quotequote all
A spammer has forged your site as the originating address of a zillion spams and you're getting all the bounces and rejections. There's no way of stopping this.

What I suggest you do is bounce all emails that are for an unknown user at your domain. How to do this varies depending on what kind of mail server you are using.

onomatopoeia

3,526 posts

247 months

Thursday 27th April 2006
quotequote all
zumbruk said:
What I suggest you do is bounce all emails that are for an unknown user at your domain. How to do this varies depending on what kind of mail server you are using.


If you can reject at RCPT rather than accepting the whole email and sending a bounce email it's even better - less bandwidth and CPU used for one thing. Some SMTP servers require patching to do this.

If the SMTP server is qmail have a look at http://http.netdevice.com:9080/qmail/ , the *second* goodrcptto link would do this. Don't click the first one as that's my patch that predates the second and is nowhere near is good. Plus I put the raw diff output on my site instead of a patch so it's a pain to apply .

deva link

26,934 posts

275 months

Thursday 27th April 2006
quotequote all
I had this a couple of years ago and was getting hundreds of bounce messages a day, plus some angry emails from people who thought I was spamming them. I had to give up using the account.

You say it's the email address for your web page - obviously somebody could have just seen it but it may have been picked up spammers 'bots'. You should javascript the address.