Spam Email Sent from My Email Address...
Posted on 2012-12-27
We have a domain environment running Exchange 2007.
A company owner (of all people) has gotten a few bounce-backs / NDRs at about midnight but he never sent any emails to begin with.
I checked our Barracuda Spam Filter and have verified that no email was sent from his email around that time.
When I look at the bounce-back message, there is obviously all kinds of information in there but I'm not sure what could have caused this to happen.
Here are some tidbits of information from the bounce-back.
Maybe someone can help decipher this.
The internal email address that received this bounce-back is in BOLD below.
Diagnostic information for administrators:
Generating server: mx2.ibc.com.au
220.127.116.11 #<18.104.22.168 #5.1.1 smtp; 550 5.1.1 <firstname.lastname@example.org>: Recipient address rejected: User unknown in virtual mailbox table> #SMTP#
Original message headers:
Received: from localhost (localhost [127.0.0.1]) by mx2.ibc.com.au (Postfix)
with ESMTP id C89EF14167; Thu, 27 Dec 2012 13:26:32 +0800 (WST)
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on turing.ibc.com.au
X-Spam-Status: Yes, score=6.9 required=5.0 tests=BAYES_80,DATE_IN_FUTURE_03_06,
FREEMAIL_FORGED_REPLYTO shortcircuit=no autolearn=no version=3.3.1
X-Spam-Report: * 3.0 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: date
* 2.7 BAYES_80 BODY: Bayes spam probability is 80 to 95%
* [score: 0.9233]
* 1.2 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
X-Virus-Scanned: amavisd-new at weber.ibc.com.au
Received: from mx2.ibc.com.au ([127.0.0.1])
by localhost (turing.ibc.com.au [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 6LWbhzUYhtfq; Thu, 27 Dec 2012 13:26:32 +0800 (WST)
Received: from ks3095542.kimsufi.com (ks3095542.kimsufi.com [22.214.171.124])
by mx2.ibc.com.au (Postfix) with SMTP id 023D314165
for <email@example.com>; Thu, 27 Dec 2012 13:26:31 +0800 (WST)
Subject: *****SPAM***** Search beautiful wives)))
From: UserA <firstname.lastname@example.org>
Content-Type: text/plain; charset="utf-8"
Date: Thu, 27 Dec 2012 06:27:52 -0400
X-Spam-Prev-Subject: Search beautiful wives)))