Spams sent from an external email address but email address sender changed to my own email address in my...
up vote
1
down vote
favorite
I recently received some strange spams on my mail server, i'm using zimbra 8.x. bundled with postfix.
I think i've secure postfix enough to avoid receiving spams from my own domain by an external smtp connection without authentication.
Here is the part of zimbra.log when some spammers are trying to send emails from my email address to my email address without smtp authentication.
Message ID '[reject:NOQUEUE:mail]'
virginie@mydomain.com -->
virginie@mydomain.com
Recipient virginie@mydomain.com
Nov 19 12:24:41 - unknown (91.x.24.x) status reject
553 5.7.1 <virginie@mydomain.com>: Sender address rejected: not logged in
They all get rejected, so theoretically i shouldn't be able to receive email coming from my own email address from spammers, except if my account has been hacked, which is not the case, i'll show you why in the logs.
The spammer used as sender an external email address, which is usual and then no authentication is needed in that case.
Nov 19 20:39:40 mail postfix/smtpd[4733]: NOQUEUE: filter: RCPT from hackzor.net[185.24.1.1]: <spammer@hackzor.net>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:100
26; from=<spammer@hackzor.net> to=<virginie@mydomain.com> proto=ESMTP helo=<hackzor.net>
But the weird thing is that email in my inbox, the sender has changed to my own email address, here the header.
Return-Path: spammer@hackzor.net
Received: from mail.mydomain.com (LHLO mail.mydomain.com) (192.168.1.1) by
mail.mydomain.com with LMTP; Mon, 19 Nov 2018 20:39:45 +0800 (CST)
Received: from localhost (localhost [127.0.0.1])
by mail.mydomain.com (Postfix) with ESMTP id 60A105B459DE;
Mon, 19 Nov 2018 20:39:45 +0800 (CST)
X-Virus-Scanned: amavisd-new at mail.mydomain.com
Received: from mail.mydomain.com ([127.0.0.1])
by localhost (mail.mydomain.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id yARN2OhX10-F; Mon, 19 Nov 2018 20:39:41 +0800 (CST)
Received: from hackzor.net (hackzor.net [185.24.1.1])
by mail.mydomain.com (Postfix) with ESMTPS id 7325D5B459A3
for <virginie@mydomain.com>; Mon, 19 Nov 2018 20:39:38 +0800 (CST)
Received: by hackzor.net (Postfix, from userid 10000)
id 28A931650A4; Mon, 19 Nov 2018 07:15:11 -0500 (EST)
To: virginie@mydomain.com
Subject: virginie@mydomain.com was hacked.
X-PHP-Originating-Script: 10000:c.php
MIME-Version: 1.0
Content-type:text/html;charset=UTF-8
From: virginie@mydomain.com <virginie@mydomain.com>
Message-Id: <20181119121513.28A931650A4@hackzor.net>
Date: Mon, 19 Nov 2018 07:15:11 -0500 (EST)
Does someone have a clue on how it's possible and how to avoid this kind of spoofing ?
Bye
email postfix spoofing zimbra
asked Nov 21 at 2:43
user3723669
61
New contributor
user3723669 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
up vote
1
down vote
favorite
I recently received some strange spams on my mail server, i'm using zimbra 8.x. bundled with postfix.
I think i've secure postfix enough to avoid receiving spams from my own domain by an external smtp connection without authentication.
Here is the part of zimbra.log when some spammers are trying to send emails from my email address to my email address without smtp authentication.
Message ID '[reject:NOQUEUE:mail]'
virginie@mydomain.com -->
virginie@mydomain.com
Recipient virginie@mydomain.com
Nov 19 12:24:41 - unknown (91.x.24.x) status reject
553 5.7.1 <virginie@mydomain.com>: Sender address rejected: not logged in
They all get rejected, so theoretically i shouldn't be able to receive email coming from my own email address from spammers, except if my account has been hacked, which is not the case, i'll show you why in the logs.
The spammer used as sender an external email address, which is usual and then no authentication is needed in that case.
Nov 19 20:39:40 mail postfix/smtpd[4733]: NOQUEUE: filter: RCPT from hackzor.net[185.24.1.1]: <spammer@hackzor.net>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:100
26; from=<spammer@hackzor.net> to=<virginie@mydomain.com> proto=ESMTP helo=<hackzor.net>
But the weird thing is that email in my inbox, the sender has changed to my own email address, here the header.
Return-Path: spammer@hackzor.net
Received: from mail.mydomain.com (LHLO mail.mydomain.com) (192.168.1.1) by
mail.mydomain.com with LMTP; Mon, 19 Nov 2018 20:39:45 +0800 (CST)
Received: from localhost (localhost [127.0.0.1])
by mail.mydomain.com (Postfix) with ESMTP id 60A105B459DE;
Mon, 19 Nov 2018 20:39:45 +0800 (CST)
X-Virus-Scanned: amavisd-new at mail.mydomain.com
Received: from mail.mydomain.com ([127.0.0.1])
by localhost (mail.mydomain.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id yARN2OhX10-F; Mon, 19 Nov 2018 20:39:41 +0800 (CST)
Received: from hackzor.net (hackzor.net [185.24.1.1])
by mail.mydomain.com (Postfix) with ESMTPS id 7325D5B459A3
for <virginie@mydomain.com>; Mon, 19 Nov 2018 20:39:38 +0800 (CST)
Received: by hackzor.net (Postfix, from userid 10000)
id 28A931650A4; Mon, 19 Nov 2018 07:15:11 -0500 (EST)
To: virginie@mydomain.com
Subject: virginie@mydomain.com was hacked.
X-PHP-Originating-Script: 10000:c.php
MIME-Version: 1.0
Content-type:text/html;charset=UTF-8
From: virginie@mydomain.com <virginie@mydomain.com>
Message-Id: <20181119121513.28A931650A4@hackzor.net>
Date: Mon, 19 Nov 2018 07:15:11 -0500 (EST)
Does someone have a clue on how it's possible and how to avoid this kind of spoofing ?
Bye
email postfix spoofing zimbra
asked Nov 21 at 2:43
user3723669
61
New contributor
user3723669 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Look up email spoofing. Not uncommon.
– JakeGould
Nov 21 at 2:54
An SPF record in your DNS is a good start and easy to do. Combine that with DKIM for better protection.
– davidgo
Nov 21 at 6:26
Unfortunately, i cannot implement SPF verification, many of our customers / suppliers doesn't use it. :(((
– user3723669
Nov 21 at 7:29
add a comment |
up vote
1
down vote
favorite
up vote
1
down vote
favorite
I recently received some strange spams on my mail server, i'm using zimbra 8.x. bundled with postfix.
I think i've secure postfix enough to avoid receiving spams from my own domain by an external smtp connection without authentication.
Here is the part of zimbra.log when some spammers are trying to send emails from my email address to my email address without smtp authentication.
Message ID '[reject:NOQUEUE:mail]'
virginie@mydomain.com -->
virginie@mydomain.com
Recipient virginie@mydomain.com
Nov 19 12:24:41 - unknown (91.x.24.x) status reject
553 5.7.1 <virginie@mydomain.com>: Sender address rejected: not logged in
They all get rejected, so theoretically i shouldn't be able to receive email coming from my own email address from spammers, except if my account has been hacked, which is not the case, i'll show you why in the logs.
The spammer used as sender an external email address, which is usual and then no authentication is needed in that case.
Nov 19 20:39:40 mail postfix/smtpd[4733]: NOQUEUE: filter: RCPT from hackzor.net[185.24.1.1]: <spammer@hackzor.net>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:100
26; from=<spammer@hackzor.net> to=<virginie@mydomain.com> proto=ESMTP helo=<hackzor.net>
But the weird thing is that email in my inbox, the sender has changed to my own email address, here the header.
Return-Path: spammer@hackzor.net
Received: from mail.mydomain.com (LHLO mail.mydomain.com) (192.168.1.1) by
mail.mydomain.com with LMTP; Mon, 19 Nov 2018 20:39:45 +0800 (CST)
Received: from localhost (localhost [127.0.0.1])
by mail.mydomain.com (Postfix) with ESMTP id 60A105B459DE;
Mon, 19 Nov 2018 20:39:45 +0800 (CST)
X-Virus-Scanned: amavisd-new at mail.mydomain.com
Received: from mail.mydomain.com ([127.0.0.1])
by localhost (mail.mydomain.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id yARN2OhX10-F; Mon, 19 Nov 2018 20:39:41 +0800 (CST)
Received: from hackzor.net (hackzor.net [185.24.1.1])
by mail.mydomain.com (Postfix) with ESMTPS id 7325D5B459A3
for <virginie@mydomain.com>; Mon, 19 Nov 2018 20:39:38 +0800 (CST)
Received: by hackzor.net (Postfix, from userid 10000)
id 28A931650A4; Mon, 19 Nov 2018 07:15:11 -0500 (EST)
To: virginie@mydomain.com
Subject: virginie@mydomain.com was hacked.
X-PHP-Originating-Script: 10000:c.php
MIME-Version: 1.0
Content-type:text/html;charset=UTF-8
From: virginie@mydomain.com <virginie@mydomain.com>
Message-Id: <20181119121513.28A931650A4@hackzor.net>
Date: Mon, 19 Nov 2018 07:15:11 -0500 (EST)
Does someone have a clue on how it's possible and how to avoid this kind of spoofing ?
Bye
email postfix spoofing zimbra
asked Nov 21 at 2:43
user3723669
61
New contributor
user3723669 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I recently received some strange spams on my mail server, i'm using zimbra 8.x. bundled with postfix.
I think i've secure postfix enough to avoid receiving spams from my own domain by an external smtp connection without authentication.
Here is the part of zimbra.log when some spammers are trying to send emails from my email address to my email address without smtp authentication.
Message ID '[reject:NOQUEUE:mail]'
virginie@mydomain.com -->
virginie@mydomain.com
Recipient virginie@mydomain.com
Nov 19 12:24:41 - unknown (91.x.24.x) status reject
553 5.7.1 <virginie@mydomain.com>: Sender address rejected: not logged in
They all get rejected, so theoretically i shouldn't be able to receive email coming from my own email address from spammers, except if my account has been hacked, which is not the case, i'll show you why in the logs.
The spammer used as sender an external email address, which is usual and then no authentication is needed in that case.
Nov 19 20:39:40 mail postfix/smtpd[4733]: NOQUEUE: filter: RCPT from hackzor.net[185.24.1.1]: <spammer@hackzor.net>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:100
26; from=<spammer@hackzor.net> to=<virginie@mydomain.com> proto=ESMTP helo=<hackzor.net>
But the weird thing is that email in my inbox, the sender has changed to my own email address, here the header.
Return-Path: spammer@hackzor.net
Received: from mail.mydomain.com (LHLO mail.mydomain.com) (192.168.1.1) by
mail.mydomain.com with LMTP; Mon, 19 Nov 2018 20:39:45 +0800 (CST)
Received: from localhost (localhost [127.0.0.1])
by mail.mydomain.com (Postfix) with ESMTP id 60A105B459DE;
Mon, 19 Nov 2018 20:39:45 +0800 (CST)
X-Virus-Scanned: amavisd-new at mail.mydomain.com
Received: from mail.mydomain.com ([127.0.0.1])
by localhost (mail.mydomain.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id yARN2OhX10-F; Mon, 19 Nov 2018 20:39:41 +0800 (CST)
Received: from hackzor.net (hackzor.net [185.24.1.1])
by mail.mydomain.com (Postfix) with ESMTPS id 7325D5B459A3
for <virginie@mydomain.com>; Mon, 19 Nov 2018 20:39:38 +0800 (CST)
Received: by hackzor.net (Postfix, from userid 10000)
id 28A931650A4; Mon, 19 Nov 2018 07:15:11 -0500 (EST)
To: virginie@mydomain.com
Subject: virginie@mydomain.com was hacked.
X-PHP-Originating-Script: 10000:c.php
MIME-Version: 1.0
Content-type:text/html;charset=UTF-8
From: virginie@mydomain.com <virginie@mydomain.com>
Message-Id: <20181119121513.28A931650A4@hackzor.net>
Date: Mon, 19 Nov 2018 07:15:11 -0500 (EST)
Does someone have a clue on how it's possible and how to avoid this kind of spoofing ?
Bye
email postfix spoofing zimbra
email postfix spoofing zimbra
asked Nov 21 at 2:43
user3723669
61
New contributor
user3723669 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Nov 21 at 2:43
user3723669
61
New contributor
user3723669 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Nov 21 at 2:43
user3723669
61
New contributor
user3723669 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Nov 21 at 2:43
user3723669
61
asked Nov 21 at 2:43
user3723669
61
61
New contributor
user3723669 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
user3723669 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
user3723669 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Look up email spoofing. Not uncommon.
– JakeGould
Nov 21 at 2:54
An SPF record in your DNS is a good start and easy to do. Combine that with DKIM for better protection.
– davidgo
Nov 21 at 6:26
Unfortunately, i cannot implement SPF verification, many of our customers / suppliers doesn't use it. :(((
– user3723669
Nov 21 at 7:29
add a comment |
Look up email spoofing. Not uncommon.
– JakeGould
Nov 21 at 2:54
An SPF record in your DNS is a good start and easy to do. Combine that with DKIM for better protection.
– davidgo
Nov 21 at 6:26
Unfortunately, i cannot implement SPF verification, many of our customers / suppliers doesn't use it. :(((
– user3723669
Nov 21 at 7:29
Look up email spoofing. Not uncommon.
– JakeGould
Nov 21 at 2:54
Look up email spoofing. Not uncommon.
– JakeGould
Nov 21 at 2:54
An SPF record in your DNS is a good start and easy to do. Combine that with DKIM for better protection.
– davidgo
Nov 21 at 6:26
An SPF record in your DNS is a good start and easy to do. Combine that with DKIM for better protection.
– davidgo
Nov 21 at 6:26
Unfortunately, i cannot implement SPF verification, many of our customers / suppliers doesn't use it. :(((
– user3723669
Nov 21 at 7:29
Unfortunately, i cannot implement SPF verification, many of our customers / suppliers doesn't use it. :(((
– user3723669
Nov 21 at 7:29
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
user3723669 is a new contributor. Be nice, and check out our Code of Conduct.
user3723669 is a new contributor. Be nice, and check out our Code of Conduct.
user3723669 is a new contributor. Be nice, and check out our Code of Conduct.
user3723669 is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1377156%2fspams-sent-from-an-external-email-address-but-email-address-sender-changed-to-my%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Look up email spoofing. Not uncommon.
– JakeGould
Nov 21 at 2:54
An SPF record in your DNS is a good start and easy to do. Combine that with DKIM for better protection.
– davidgo
Nov 21 at 6:26
Unfortunately, i cannot implement SPF verification, many of our customers / suppliers doesn't use it. :(((
– user3723669
Nov 21 at 7:29