We just received mails not for us

Posted by systonia_@reddit | sysadmin | View on Reddit | 11 comments

So ... I just got multiple calls from people suddenly receiving like 30-100 Mails withing a few seconds from unknown senders. Looking around a little, these looked like legit mails, but just not for us. Looking at the mail headers, our recipients were not in there. The only thing hinting to us was [smtp.rcpttodomain=ourdomain.com](http://smtp.rcpttodomain=ourdomain.com) . This is on o365. So I guess after the last days of fucking things up at MS, they finally hit the bottom and managed to deliver random mails to the wrong receipients ? Anyone else has this ?

Reply to Post

11 Comments

[-]

ForOursAndYours2137@reddit

Maybe it's a spambomb?

[-]

systonia_@reddit (OP)

spam usually has a purpose of getting you to interact, sell you shit etc. these were conversations between some company and a client. Some registration confirmation mails. Some status mails, invoices etc. Normal stuff you'd find in a inbox

[-]

ForOursAndYours2137@reddit

Spambomb is there so that you interact with the malicious email, or that you don't notice a "notification of password change" email.

[-]

Tymanthius@reddit

No, a spambomb is to overwhelm you so that you DO interact w/ the one bad one that looks more ok than the rest.

[-]

Admin4CIG@reddit

Wow. Where there any encrypted email that isn't yours and that you \*can\* open? That would be wild. We're under the impression that encrypted email will remain protected even if delivered to the wrong party, but then maybe it's not so protected if the unintended recipient is able to decrypt it regardless.

[-]

cdrobb@reddit

So a fairly common attack is to use external distribution lists to spam emails. Atacker gets hold of an account, adds a list of emails to the contact list, sets up a group with an internal email address then emails the internal address which sends out to the external contacts. Trivial to do and is really annoying to track. I suppose the next annoying step would be to put in an auto forward. Probably wouldn't be picked up by policy as the forward is to an internal address and I don't think MS would then pick up the contacts to block.

[-]

systonia_@reddit (OP)

all that would include the users mail in the headers. Which isnt there

[-]

USarpe@reddit

Maybee they refer to your ip, you you can check it with nslookup type mx

[-]

JonesTheBond@reddit

Are the emails addressed to a company with a similar domain? Just wondering if someone has screwed up their Mx records or something...

[-]

systonia_@reddit (OP)

no. neither the users name nor the domain is even close. Even if someone did that, the receive connector would discard the mails as the receipients are not in our tenant.

[-]

JonesTheBond@reddit

Ah yep of course.