Security concerns

jamesstripe

jamesstripe

Registered
Sorry if this is not your concern but I don't know where to turn.

Someone has 'cloned' my domain and is spamming from it.
I think it is coming from South Korea as I've actually received spam 'from myself"!.
The originating IP was 220.83.8.184.
My ISP has told me to turn off the catch-all facility on my e-mail to stop all the undelivered mail responses but this doesn't stop the spam and my fear is that I will get blacklisted (or chased up) because it appears I'm spamming.

Also, when I check the firewall log I see:
___
Feb 23 13:19:26 G4 ipfw: Stealth Mode connection attempt to TCP 10.XXX.XXX.XXX:49243 from 195.7.224.38:110
Feb 23 13:19:30 G4 ipfw: Stealth Mode connection attempt to TCP 10.XXX.XXX.XXX:49246 from 195.7.224.31:110
Feb 23 13:19:31 G4 ipfw: Stealth Mode connection attempt to TCP 10.XXX.XXX.XXX:49246 from 195.7.224.38:110
Feb 23 13:21:47 G4 ipfw: 35000 Deny UDP 0.XXX.XXX.XXX:68 255.255.255.255:67 in via en0
Feb 23 13:21:48 G4 ipfw: 35000 Deny UDP 0.XXX.XXX.XXX:68 255.255.255.255:67 in via en0
Feb 23 13:25:43 G4 ipfw: 35000 Deny UDP 10.XXX.XXX.XXX:138 10.255.255.255:138 in via en0
___
(This is just a tiny selection).

I'm getting quite concerned about this now as my ISP recently told me that someone had hacked into my webspace, they simply blamed my weak password.

All this going on at the same time is getting me worried.

ANY help will be much appreciated.


Plus: When I startup my mac iPhoto launches (not all the way to a window though). Any ideas?

Again many thanks

James

EDIT: replaced IP address with XXX.
 
Well first thing is talk with your ISP and any web space server site you are using. Second is you have just given anyone the access AGAIN by posting IP addresses. Third when you talk have your IP changed, and never EVER post your email address right out in the open on the net. You are only asking for trouble. Third is to have your ISP change your email address. Next if you have any PC, take it off line and throughly software wise clean it. You might have a PC robot program sending spam on it. Also talk with everyone on your address list because they may have a spam robot on their PC that got your information.

Your ISP would only cut you off if they detected that one of your machines is sending the spam.
 
Although I don't have the spam problem, when I check my firewall log, a IP is always trying to get connected. I have used whois and traceroute, not sure what I am looking for? I want to have them stop trying to access my Mac.
 
Thanks Satcomer for replying. Edited out my IP.

I have been in touch with quite a few people regarding this and it seems like there is nothing that can be done - just hope they go away.

Don't have a PC but do share the wireless router with an neighboring office.

Powermac, try dnsstuff.com and use the 'City from IP' to see where they are from. Doesn't solve the situation but I've found that they're from all over the world but mainly the US and far east.
 
It may surprise you but you can put anything you want as the "from" email address and it's a perfectly valid email. That's how you can get spam that looks like it's coming from your own address.

Blacklists will not usually blacklist your domain name, just the IP address of the SPAM source so as long as the spam isn't really from your server it's not a big deal. The only thing is that some people don't know better and will maybe blame you for sending them SPAM.
 
Captain Code said:
It may surprise you but you can put anything you want as the "from" email address and it's a perfectly valid email. That's how you can get spam that looks like it's coming from your own address.
Click to expand...
(Thanks for your comments)

The mail I've got has had my domain as the from but it's a domain that I don't use, just have registered (my name) and it's happened with several of my domains not just one. I did have, until I turned my catch-all off over 5000 returned (bounced) mails in the space of a couple of weeks.
I am also having trouble getting some mail through and suspect that it's linked to this situation.
 
jamesstripe said:
Thanks Satcomer for replying. Edited out my IP.

I have been in touch with quite a few people regarding this and it seems like there is nothing that can be done - just hope they go away.

Don't have a PC but do share the wireless router with an neighboring office.

Powermac, try dnsstuff.com and use the 'City from IP' to see where they are from. Doesn't solve the situation but I've found that they're from all over the world but mainly the US and far east.
Click to expand...

Thanks I did. What are they trying to do accessing my computer? I have OSX firewall install, in stealth mode. Who are they? Is this common? Most of the IPs I ran came from Seattle? Microsoft checking on me? :mad: As far as my technological knowledge allows me, they have not done anything but try to access my computer.
 
powermac said:
What are they trying to do accessing my computer? I have OSX firewall install, in stealth mode. Who are they? Is this common? Most of the IPs I ran came from Seattle? Microsoft checking on me? :mad: As far as my technological knowledge allows me, they have not done anything but try to access my computer.
Click to expand...

Powermac, this is a response I have had from spamcop (Ellen) when I raised the issue with them.

"Well the firewall pinging thing is perfectly normal -- the important thing
is that you *are* using a firewall and that is recognizing and stopping all
those."

It seems that there people out there looking at IP addresses in the hope they can 'get in' - what they intend to do once in is anyone guess.
 
You must log in or register to reply here.
Back
Top