2

I am taking care of a website like example.com. The company is using the email on the same domain (as you'd expect), like user@example.com.

Unfortunately, someone has created an address like person@example.com, the same domain, and started sending bills and stuff to other people (clients or related to the company) and it is obviously hurting the business.

I've tried to contact the hosting company but they keep saying that it is not their fault because people clone email addresses and they have nothing to do with this.

What can I do about this? Is this a problem from the hosting company or are they right that any address can be cloned? I was not aware of this but I have a feeling this is not entirely true.

|improve this question
  • Do you have a copy of one or more of these fake e-mails?? – closetnoc Sep 7 '16 at 15:11
  • 1
    Anyone can fake the From field of an email if that is what is happening. SPF and DKIM should be implemented, if not already, to help with this. However, I don't see how they can can't create a mailbox without "someone on the inside"? And presumably "they" will not be able to pickup email sent to this address - they are just using it to "send"? However, if these emails are being sent to "clients" then it sounds like an "inside job" or the company is being specifically targetted?! – MrWhite Sep 7 '16 at 16:00
  • Do you have any malicious scripts? Or nulled scripts that is installed? Those could be factors. – Abu Nooh Sep 7 '16 at 18:58
  • Yes I do have a copy of these emails – Vlad Eugen Nitu Sep 8 '16 at 8:41
  • This can't be an inside job. The "company" has 3 employees and I know all of them, one being actually my girlfriend so that is not the problem. My problem is that I'm trying to communicate with the hosting company and they simply say that this is a normal thing to happen and it's not their fault and they can not do anything. Now thinking about it, if the person that received the mail paid the bill to God knows what account, who would have blamed? Us, of course. So i'm intending to go to the police but I wanted to find out more about the situation itself before. – Vlad Eugen Nitu Sep 8 '16 at 8:44
2

I'm assuming the spoofing party (the bad guys pretending to be you) don't have access to your server.

In that case, the solution is fairly simpel: Set a SPF record. Simplefied it works like this:

DomainOwner mails via the website. This IP is 1.1.1.1. Bad guy also mails using your mail address, but he mails from IP 4.3.2.1. This is like your current situation now.

The recieving party, or your ISP, or your spamfilter will check the SPF-record for example.com, which says Mail send under my name from IP 1.1.1.1 is legit, ignore the rest.

You add this as TXT record to your DNS: "v=spf1 a -all". This says to check your A-record (that's what that loner 'a' stands for).

To make even more improvment, add DKIM. This is yet another check to prevent spamming and spoofing.

If you can't set one of those because your hoster doesn't let you, it's time to move.

|improve this answer
1

No one can clone an email address, they can create a spoof email and show the name as from being sent as the company but can not clone the email address itself.

Example - Real Email: Sender: myCompany, Subject: mySubject, Email Address: person@myDomain.con

Example - Fake Email: Sender: myCompany, Subject: mySubject, Email Address: person@myDomian.con

Did you catch it? Look at misspelling of fake email address.

The only way some can can create an email with the real domain name is by gaining access to the Domain Control Panel or the Email Control Panel and creating a legit email.

With that, I would check the Domain Control Panel or the Email Control Panel to see if someone altered the MX records or created this person@example.com email you mentioned.

In either case hosting and email providers are not responsible. I suggest you enable 2-step verification if you have not done so. This way, the phone number on record will be texted an authorization code after corretly supplying login credentials.

|improve this answer
  • I just checked the phishing mail. It seems legit with the domain name written right. I tried replying to it but I get the notification that the email address does not exist. Could it be because if the address was fraudulently created, it might have been deleted as well? – Vlad Eugen Nitu Sep 8 '16 at 8:53
  • See if that email was created where you have your emails hosted. And assuming you have CPanel and root access, you can check logs > /var/log/exim_mainlog /var/log/maillog And lastly, it may be an sql injection sending out the spam. :/ – norcal johnny Sep 8 '16 at 9:08
1

Check for the email account on the website or email control panel. As suggested by others you can also check logs to see if someone unauthorized accessed the control panel.

However, there are ways to write scripts that send out emails that do not exist. So it is not completely preventable.

When I was initially working with php, I would always send the form queries with an email like response-bot@company.com which was not actually created. You would however get the email with that email ID.

When you say you tried sending emails to that address and the server response was that it did not exist, it was probably sent the same way as I mentioned above.

As for damage control, it is better if you inform the clients/users that the particular email is fake or unauthorized and it is best if you start using some form of encoding in your bills and letter heads that outsiders cannot have access to.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.