Solved

E-mail bounce-back of email user didn't send

Posted on 2013-05-16
6
989 Views
Last Modified: 2013-05-17
I've been seeing a few of these a week in our environment, for different users.

But what happens is someone will get an e-mail like this one below, but they don't have anything in their Sent Items (Outlook 2010 or OWA) on the date/time of the timestamp, so I'm not sure why they're getting it or where it could be coming from.


-----Original Message-----
From: postmaster@ourdomain.com [mailto:postmaster@ourdomain.com]
Sent: Thursday, May 16, 2013 10:25 AM
To: David Johnson
Subject: Delivery Notification - New Secure Message

The message or an attachment did not reach the intended recipient(s).!
Subject: New Secure Message
From: narcsqp@anotherdomain.com
To: djohnson@ourdomain.com
Date: Thu, 16 May 2013 09:24:36 -0600
Reason: attachment type policy violation (SecureMessage.exe)
Action: quarantine
0
Comment
Question by:garryshape
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 16

Expert Comment

by:Rajitha Chimmani
ID: 39172796
Check your server logs which could give information of any attempts. You could also get the source of these emails from the logs.
0
 
LVL 20

Assisted Solution

by:edster9999
edster9999 earned 125 total points
ID: 39172935
Bounce back emails are used by spammers for two different tasks.

The first one - they need a 'from' address to send from.  They are not going to use their own address and if they send a million emails from xyz@example.com this will get black listed before they even reach the end of the list.
So their get round is to use emails in the mailing list as 'from'.  They send a small amount from address 1 and then move on.  That person will then receive some bounce backs or some real mails saying 'go away' etc.
You can fake an email address VERY easily.  The email comes from whatever name and email you put it from.

The second method is to use the 'bounce' emails as a method of sending.
If they find a server that bounces emails either because the person doesn't exist or because it looks like spam then they can use this to SEND spam to other people.
Say the company bounces the mail back (maybe even with attachments) if it doesn't know the name.
If the company is called 'example.com'
and I want to send you a spam to 'garryshape@ourcompany.com'

then I send an email saying :

To : no-body-here@example.com
From : garryshape@ourcompany.com
Body : Hi garryshape would you like some viag.......etc etc etc

The company then bounces this back to the from address which is really your address and they have just sent out a spam.

The cure - read up on filtering spam.  You can set up DNS entries for your own domain that will only allow it to come from set IPs (like your mail servers) and you can filter incoming addresses by blacklist/whitelists or by keywords.
0
 
LVL 83

Assisted Solution

by:Dave Baldwin
Dave Baldwin earned 125 total points
ID: 39173243
It's most likely "Bounce back" or NDR spam.  It's become a common method because a lot of people tend to open them thinking that they actually sent it out.
0
Register Today - IoT Current and Future Threats

Are you prepared to protect your organization from current and future IoT Threats?  Join our Wi-Fi expert in episode three of our webinar series for a look at the current state of Wi-Fi IoT and what may lie ahead. Register for our live webinar on April 20th at 9 am PDT!

 
LVL 23

Assisted Solution

by:Malli Boppe
Malli Boppe earned 125 total points
ID: 39173881
Only thing I can think of stopping this is having an SPF record for your domain.
0
 
LVL 76

Accepted Solution

by:
Alan Hardisty earned 125 total points
ID: 39173957
It's spam and if you have a decent anti-spam program such as Vamsoft ORF Fusion (www.vamsoft.com) installed and configured, you won't see this arriving.

Setting up an SPF record correctly as advised above will also help the problem.

Alan
0
 

Author Closing Comment

by:garryshape
ID: 39175571
Thanks, guys. Makes sense to me. Will explore solutions based on findings.
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As cyber crime continues to grow in both numbers and sophistication, a troubling trend of optimization has emerged over the last year.
Active Directory security has been a hot topic of late, and for good reason. With 90% of the world’s organization using this system to manage access to all parts of their IT infrastructure, knowing how to protect against threats and keep vulnerabil…
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…

735 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question