Amazon SES Custom MAIL FROM Domain Setup SUCCESS in AWS Region ...

Question

I've received several emails with the subject "Amazon SES Custom MAIL FROM Domain Setup SUCCESS in AWS Region ..." and the message:

"Congratulations! Amazon SES has successfully detected the MX record required to use {domain}as a custom MAIL FROM domain for verified identity wzyigou.com in AWS region {region}." where {domain} is nothing I have ever heard of and {region} is something I don't have resources in.

There are also SES identities appearing that I have to delete and other messages about DKIM.  I'm afraid I don't know much about this as I never use any of it.  It looks like some form of spam and someone has some sort of access to my account.

Any advice on how to stop this and clean it up?

Accepted Answer

1. Immediately change your AWS root account password
2. Enable Multi-Factor Authentication (MFA) on your AWS root account
3. Go to your AWS IAM console and delete any existing access keys for your root account.

first and then

Amazon SES console and check all verified identities. and

It's highly recommended to contact AWS support immediately. Provide them with the details of the emails, any specific information about the unknown identities, and suspicious activity you may have found. They can help you investigate further and secure your account.

Amazon SES Custom MAIL FROM Domain Setup SUCCESS in AWS Region ...

Relevanter Inhalt