Re:Ask HN: Help with spam "originating" from my website
by sendos on Sunday December 01, 2013 @02:20PM
(#6828733)
> I'd bet good money that you have a compromised or vulnerable mailer script on your machine somewhere
This must be the case. I turned on SPF and DKIM and the spam emails slowed down for a while, but are now back in full force.
It looks like I will need to torch the whole VPS (I have backed up the important data)
You should google and implement SPF and DKIM for your domain. SPF is just a DNS change that says what hosts are allowed to send email for your domain, and DKIM is a DNS + mailserver change that will sign legit outbound email with a key that MTAs can verify to make sure that the email is legit (and bounce it if it's not). That will stop the vast majority of fraudulent email in its tracks.
Looking at the email you provided:
I'd bet good money that you have a compromised or vulnerable mailer script on your machine somewhere and it's being exploited in an automated fashion. Check all of your mailers for known vulnerabilities and patches.It may be wise to assume that the box is compromised, save your known good data and code, torch the whole thing and rebuild it piece by piece, validating the pieces as you go. That's extreme, but when dealing with a potential machine breach, you can't really ever be sure that you're clean without nuking it from orbit.