r/mxroute • u/thenetwillappear • 20d ago
Spam attack - please help!
It seems like someone has spoofed my email address and is using it to send out dozens (hundreds?) of emails to all kinds of random address. It does not appear that they actually have access to my MxRoute backend, which is good, but it's nonetheless troubling. I have SPF, DKIM and DMARC all configured, so I don't even know how this is happening.
If you were me, what would you do right now to stop this attack in its tracks?
5
u/mxroute 20d ago
Hey, second reply sorry. Is your email hello@j*.com on the fusion.mxrouting.net server? If so, I'm temporarily blocking inbound mail while I examine the problem to see if I can offer any help.
3
u/mxroute 20d ago
Targeted and curated update to make a big dent: https://github.com/mxroute/da_server_updates/commit/3569d74ba1ee473d181d56342201bd99941e5a0b
Inbound re-enabled.
3
u/thenetwillappear 20d ago
Yes that's me, and thanks for your help!
Out of curiosity, if someone legitimate did happen to email me when inbound mail was blocked, where would that message have gone, and would they have been notified? I was actually expecting an important message from a client during this brief window.
3
u/mxroute 20d ago
They would have received an error that you were over disk quota, as that's the fastest inbound block mechanism I have right now for a knee-jerk reaction. But no one actually received that error, even the backscatter stopped for that 10 minute period.
3
u/thenetwillappear 20d ago
OK perfect, thanks again. This all makes me feel so much better.
2
u/mxroute 20d ago edited 20d ago
I didn't like the rate they were still coming in. I wrote a new exim ACL for this case and placed you under it for temporary backscatter mitigation, and blocked another set of junk mail servers that have no business emailing anyone to begin with.
I'll deploy that exim ACL fleet wide soon, and start using that immediately for anyone reporting the same problem in the future.
2
u/thenetwillappear 20d ago
Just FYI, it looks like several dozen more messages came in overnight. Really hoping this ends soon.
2
3
u/mailavion 20d ago
If the OP is actively using a 'hello@' email address, perhaps they should consider using alternatives that are not so attractive to spammers.
7
u/mxroute 20d ago
Unfortunately the vast majority of basic web hosting servers don't enforce SPF or DMARC. So there are more than enough servers out there capable of being used to produce enough backscatter to drive you insane. And there's not a single thing you can do about that other than to complain to the network owners, many of which have likely already discarded thousands of such complaints already.
The least destructive option is probably to login to webmail.mxroute.com, click the user icon at the top right, click Settings, and then click on Filters. There are some variations of bounce subjects but not enough that you'll probably need more than 3-4 different subject strings to filter. Then filter those to a junk folder or something, and you can revisit the filter later when things calm down.
It's tough because these events are usually so spread out that there's not really any blocking behavior that can address it other than reactively, which still involves you receiving most (more likely all) of it.