Solved

E-mail bounce-back of email user didn't send

Posted on 2013-05-16
6
962 Views
Last Modified: 2013-05-17
I've been seeing a few of these a week in our environment, for different users.

But what happens is someone will get an e-mail like this one below, but they don't have anything in their Sent Items (Outlook 2010 or OWA) on the date/time of the timestamp, so I'm not sure why they're getting it or where it could be coming from.


-----Original Message-----
From: postmaster@ourdomain.com [mailto:postmaster@ourdomain.com]
Sent: Thursday, May 16, 2013 10:25 AM
To: David Johnson
Subject: Delivery Notification - New Secure Message

The message or an attachment did not reach the intended recipient(s).!
Subject: New Secure Message
From: narcsqp@anotherdomain.com
To: djohnson@ourdomain.com
Date: Thu, 16 May 2013 09:24:36 -0600
Reason: attachment type policy violation (SecureMessage.exe)
Action: quarantine
0
Comment
Question by:garryshape
6 Comments
 
LVL 16

Expert Comment

by:Rajitha Chimmani
ID: 39172796
Check your server logs which could give information of any attempts. You could also get the source of these emails from the logs.
0
 
LVL 20

Assisted Solution

by:edster9999
edster9999 earned 125 total points
ID: 39172935
Bounce back emails are used by spammers for two different tasks.

The first one - they need a 'from' address to send from.  They are not going to use their own address and if they send a million emails from xyz@example.com this will get black listed before they even reach the end of the list.
So their get round is to use emails in the mailing list as 'from'.  They send a small amount from address 1 and then move on.  That person will then receive some bounce backs or some real mails saying 'go away' etc.
You can fake an email address VERY easily.  The email comes from whatever name and email you put it from.

The second method is to use the 'bounce' emails as a method of sending.
If they find a server that bounces emails either because the person doesn't exist or because it looks like spam then they can use this to SEND spam to other people.
Say the company bounces the mail back (maybe even with attachments) if it doesn't know the name.
If the company is called 'example.com'
and I want to send you a spam to 'garryshape@ourcompany.com'

then I send an email saying :

To : no-body-here@example.com
From : garryshape@ourcompany.com
Body : Hi garryshape would you like some viag.......etc etc etc

The company then bounces this back to the from address which is really your address and they have just sent out a spam.

The cure - read up on filtering spam.  You can set up DNS entries for your own domain that will only allow it to come from set IPs (like your mail servers) and you can filter incoming addresses by blacklist/whitelists or by keywords.
0
 
LVL 83

Assisted Solution

by:Dave Baldwin
Dave Baldwin earned 125 total points
ID: 39173243
It's most likely "Bounce back" or NDR spam.  It's become a common method because a lot of people tend to open them thinking that they actually sent it out.
0
Network it in WD Red

There's an industry-leading WD Red drive for every compatible NAS system to help fulfill your data storage needs. With drives up to 8TB, WD Red offers a wide array of solutions for customers looking to build the biggest, best-performing NAS storage solution.  

 
LVL 23

Assisted Solution

by:Malli Boppe
Malli Boppe earned 125 total points
ID: 39173881
Only thing I can think of stopping this is having an SPF record for your domain.
0
 
LVL 76

Accepted Solution

by:
Alan Hardisty earned 125 total points
ID: 39173957
It's spam and if you have a decent anti-spam program such as Vamsoft ORF Fusion (www.vamsoft.com) installed and configured, you won't see this arriving.

Setting up an SPF record correctly as advised above will also help the problem.

Alan
0
 

Author Closing Comment

by:garryshape
ID: 39175571
Thanks, guys. Makes sense to me. Will explore solutions based on findings.
0

Featured Post

New My Cloud Pro Series - organize everything!

With space to keep virtually everything, the My Cloud Pro Series offers your team the network storage to edit, save and share production files from anywhere with an internet connection. Compatible with both Mac and PC, you're able to protect your content regardless of OS.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In 2017, ransomware will become so virulent and widespread that if you aren’t a victim yourself, you will know someone who is.
A customer recently asked me about anti-malware and the different deployment options available for his business. Daily news about cyberattacks, zero-day vulnerabilities, and companies that suffered a security breach made him wonder if the endpoint a…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now