Mail being sent out under our domain name

[suzebee]

It looks like someone is sending out malicious mail under our domain name.

I have double, treble checked and we are not being used as an open relay. But are receiving malicious mails being sent from users in our domain name and they definately haven't been sent by the users?

Any ideas please.

Cheers

 

[rvbrvb]

There are several ways for a person with malicious intent to spoof your domainname. I assume you discovered the problem because of mails that didn't get to their addressee and were returned to the sender. You are not the sender but because your domainname is used the mails are returned to you.

The only way to find out who is using your domainname is to retrace the message to the computer from which it was sent. You can do this by checking the headers of the message to find the TCP/IP address of the original sender.

Hope this helps...

Robert.

 

[EdwinSKH]

How do we see the headers from Microsoft Outlook 2000?

 

[gcdhnjgfhfgsxh]

Hi

To view the headers in Oulook open the e-mail the go View / Options

Hope this helps

Dave

http://affy.dynu.net

 

[suzebee]

Once I have their IP addresses what can I do? Is there anyway of reporting it?

I can get contact details from whois, and send the admin a mail??

 

[rvbrvb]

Once you have their IP adresses you can contact their internetprovider because they know which IP-adresses they have given out at any time and to whom they have given them.

Mind you... not all internetproviders are eager to co-operate in such cases.

Good luck.

Robert.

 

[suzebee]

Thanks very much

 

[securityforums]

Indeed as rvbrvb says a lot of establishments, especially if in far away countries will just ignore it

There is a really nice thread here on reporting abuse, for the odd bit of spam its not worth it but for something malicious its probably worth a few minutes of your time blasting off an abuse report to various bodies:

More here

http://www.security-forums.com/forum/viewtopic.php?t=285

----------------------->

http://exchange.security-forums.com

http://www.security-forums.com

 

[wibbe]

Hi,

If the ISP dont cooperate. Send the incidents to mailabuse.com and get the ISP banned.
Then there is at least one less of them...

Make them act!
Or at least, hang them out here.

//Wibbe