For the past few days, I’ve been closely monitoring our email server logs and noticed something unusual: two user accounts were repeatedly failing to deliver emails to both the user inbox and Gmail. Initially, I suspected it might be a spam issue, but I wasn’t entirely sure what was going on.
One of the accounts belonged to a high profile individual—a knowledgeable user who might not appreciate being advised on spam issues, especially since he is a lecturer in the IT space. Despite this, the logs were alarming, and I knew something needed to be done.
While trying to interpret the logs and also in a bid to get to the bottom of it, I closed the accounts temporarily and started researching online the key information I was seeing in the logs to see if others too had encountered a similar problem.
Following up with the other email account owner, I found out that the users’ inboxes were flooded with hundreds, even thousands, of “bounce” messages from MAILER-DAEMON. These bounces were responses to spam emails that appeared to be sent from their accounts, but in reality, the users had no idea about these sent messages. The emails were addressed to people they didn’t know, and the sender information had been forged in the email message header.
My online research led me to understand that this type of attack is known as a “joe-job,” where spammers spoof an email address to make it look like spam is coming from a legitimate domain/email address. The result? The real email owner gets bombarded with non-delivery reports (NDRs), also known as backscatter, which can lead to their email address and server being blacklisted.
To mitigate the issue, I took the following steps:
1. Changed the email account passwords.
2. Deleted the NDRs manually, sorting them by subject or sender to make the process easier.
This experience highlighted the importance of staying vigilant with email server logs and taking quick action when something seems off. This is also a reminder that even the most knowledgeable users can be vulnerable to spam attacks.