No rest for weary security manager

17.01.2006
Over the holidays, our state agency was very quiet, and I took a vacation, hoping for rest and tranquility. But I found that I had my own security issues to deal with.

I was surprised to find that one of my personal e-mail accounts was accumulating over 600 bounced messages per day. This account has been associated with my consulting business for years. I was somewhat alarmed to find out that my domain was being used by a spammer and that my "catch-all" e-mail account was accumulating the bounced messages. (If I hadn't created a catch-all account, I would never have known this was occurring.)

I thought that perhaps my domain had been hijacked and was being used for malicious purposes. I quickly visited my personal Web site; everything looked fine.

I opened several of the bounced messages and inspected the headers. The spammer had used a fictitious e-mail address for my domain in the "Reply To" field (for example, horror@mydomain.com). Some messages had the original message intact, so I could tell that the spam was annoying but not pornographic or a phishing scam. I was grateful for that much. Most of the messages were of the "News Alert!" genre, with "advice" about purchasing a particular type of stock.

I wanted to better understand and resolve these issues:

-- What is domain hijacking?