Spammers Hijacking Email Accounts

dolphyn

• February 22, 2014 18:12

Spammers seem to have found a new way to exploit mail servers. I'm seeing a pattern of spammers authenticating once and sending 2-3 messages, each to dozens of recipients, and then it stops. Many of the messages contain a URL and no other content, often with somebody's name as the subject line. Many of these messages are rejected by Yahoo with a [PH01] error message. The spammer's IP address varies, representing countries where we have no customers, including Morocco, Turkey, and Tunisia. But in each case the spammer stops after 2-3 messages, leading me to wonder if the spammer "faked" authentication somehow or if they actually obtained the user's credentials. The spammers have consistently used "mycomputer" as the HELO or EHLO name, so currently it's pretty easy to see if you've been affected. If your logs are in the usual place, just run exigrep mycomputer /var/log/exim* | more
and look for mail going to multiple addresses. I first noticed the problem on a Windows server running "SmarterMail," so the issue is not specific to CPanel or Exim. Many others have seen similar issues, as evidenced by responses to my post [url=http://forums.smartertools.com/threads/spammers-authenticating-once.41207/]here (SmarterTools Community Forums).

• 

  xml

  • March 01, 2014 12:51

  After reading this post I was able to recover my SMTP and prevent spamers from using my email account by changing the account password Right now I am getting huge attack on my server SMTP service Blocked by LFD (Login Failure Daemon) and getting lot of thease warning alerts: Time: Sat Mar 1 16:44:58 2014 +0300 IP: 182.160.38.21 (MN/Mongolia/-) Failures: 1 (smtpauth) Interval: 3600 seconds Blocked: Permanent Block Log entries: 2014-03-01 16:44:56 dovecot_plain authenticator failed for (mn-284b7a0b8379) [182.160.38.21]:2486: 535 Incorrect authentication data (set_id=support@mywebsite.com)
  

  0

Please sign in to leave a comment.