Weird case of spam [qmail]

AxelTerizaki · n00b Joined: 12 Apr 2003 Posts: 33

Hello

One of the users of my mail server reported to me this strange case of spamming, apparently coming from his own address, to somewhere else. He noticed it because the message bounced back at him, since the recipient seems not to be valid.

Here is a copy of the headers of the "spam mail". I'll discuss about it right after.

Note: myuser@rafal-team.net is obviously a false address I replaced, instead of the real one.
Note 2: I also replaced the spam's subject on purpose

GordSki · Guru Joined: 18 Oct 2004 Posts: 329

Hi,

Have you checked to see if your server will relay mail that appears to come from one of your valid users? This wouldn't be the same as an open relay because the mail looks like its coming from your domain.

The headers you supplied suggest that the mail when through your server and started at: 98.25.92.196

This would rule out the other option, which would be that your users address has been hijacked and forged.

G.

AxelTerizaki · n00b Joined: 12 Apr 2003 Posts: 33

Hmmm. Well, I asked just now that my user disables his SMTP auth on Thunderbird, and he then tried to send a mail to another address not hosted on the server (he tried to relay).

But he got rejected by the server, saying the doamin wasn't in its lists of rcpthosts, so, I guess this eliminates the possibility of the server accepting mail from a known address, even without auth.

GordSki · Guru Joined: 18 Oct 2004 Posts: 329

I'm guessing someone has nabbed/guessed your user's password then. The original spam message (or others like it) should appear in your logs and you should be able tell if they are authenticating properly.

G.