My webmaster catch-all email address started receiving a lot of "Delivery Status Notification (Failure)" replies from various email systems. In the order of 1 per hour.
It's obviously Spam being sent, as the content is about medications. I'm trying to figure out if
1)It is not being sent by us but the reply-to field is being set to our site, and therefore we receive the failure notification or 2) Our system has been compromised and it's being sent by us, hurting our reputation. Also - if this is the case, where do I look to fix the problem?!
Here is an example:
Delivery to the following recipient failed permanently: firstname.lastname@example.org Technical details of permanent failure: Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 550 550 5.1.1 <email@example.com>... User unknown (state 13). ----- Original message ----- Received: by 10.204.152.70 with SMTP id f6mr6872450bkw.7.1341224023720; Mon, 02 Jul 2012 03:13:43 -0700 (PDT) Received: by 10.204.152.70 with SMTP id f6mr6872447bkw.7.1341224023673; Mon, 02 Jul 2012 03:13:43 -0700 (PDT) Return-Path: <Ester7CB4674@mysite.com> Received: from 184.108.40.206 ([220.127.116.11]) by mx.google.com with ESMTP id hi9si10538192bkc.151.2012.07.02.03.13.38; Mon, 02 Jul 2012 03:13:39 -0700 (PDT) Received-SPF: neutral (google.com: 18.104.22.168 is neither permitted nor denied by best guess record for domain of Ester7CB4674@mysite.com) client-ip=22.214.171.124; Authentication-Results: mx.google.com; spf=neutral (google.com: 126.96.36.199 is neither permitted nor denied by best guess record for domain of Ester7CB4674@mysite.com) smtp.mail=Ester7CB4674@mysite.com Date: Mon, 02 Jul 2012 03:13:39 -0700 (PDT) Message-Id: <20120702131340.6C18454BE719A3A513E9@USER-PC> From: Leslie Browning <Ester7CB4674@mysite.com> To: grdchurch <firstname.lastname@example.org> Reply-To: Maryanne Whitehead <Terry1DA24@starlane411.com> Subject: For grdchurch Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit best ED meds! Be confident! Buy here http://www.akermedic.ru/ B3B0ED3F2E14A898C2C644020D7E9A8071 30DA492A4CF3EB0A0E3DE1371040BE5C81 4C9CF9C9AC2D7881DACD5D1B0A9A460