suspicious outgoing emails from my Microsoft Exchange Server 2013 box (sendgrid)

Question

I have an on-site Exchange Server 2013 environment.

We use sendgrid for outgoing e-mail delivery.

I was just browsing through our sendgrid account (I don’t do that often), and I noticed a LOT of “deferred” emails in the activity feed. More concerning is that so many of them appear to be bogus or BS emails.

Any idea on how I can start backtracking the source of these emails?

It seems somewhere my system is compromised, but it could be the sendgrid account, or the Exchange server, or perhaps an individual e-mail client/PC.

Here is a small example of the email addresses I’m seeing in the “Deferred” queue (note that this is a professional organization that has nothing to do with any of these keywords):

Deferred   beautiful-arabian-girls@said3moo.oadrail.top   May 18, 2016 12:54:43 AM  
Deferred   jessicasimpsonslimfigure@gruai7se.grudgeq.top   May 18, 2016 12:49:36 AM  
Deferred   military-overstock@sound4ek.steamyg.top   May 18, 2016 12:35:00 AM  
Deferred   privatejet@carlineat.download   May 18, 2016 12:32:46 AM  
Deferred   people-anti-aging@cder45guh.stubxlo.top   May 18, 2016 12:26:42 AM  
Deferred   yourbusinessfunds@muteds3aa.freakye.top   May 17, 2016 11:52:18 PM  
Deferred   asiangirlfriends@eyfde3ai.ruledy.top   May 17, 2016 11:42:39 PM  
Deferred   businessloans@fastnessdo.download   May 17, 2016 11:34:55 PM
Deferred   privateairplanecharter@leaf11uio.restede.top   May 17, 2016 11:31:57 PM  
Deferred   walkintub@bimorphby.download   May 17, 2016 11:14:14 PM  
Deferred   moonjana29@static.vnpt.vn   May 17, 2016 10:43:05 PM  
Deferred   diabetescure@uknwaurs.net   May 17, 2016 10:30:28 PM  
Deferred   gnc-force-factor@livee4aa.oadhop.top   May 17, 2016 10:29:58 PM  
Deferred   breastenlargementchoices@ga7jitresa.jtmecca.top   May 17, 2016 10:17:30 PM

Have you checked your Exchange SMTP logs to see if any of these show up there? — Todd Wilcox, May 18 '16 at 13:30
Additionally, have you checked your SendGrid [IP Access Logs](https://app.sendgrid.com/settings/access) to see if unknown IPs are accessing your account? — jacobmovingfwd, May 18 '16 at 18:01

score 1 · Answer 1 · answered May 18 '16 at 11:36

1

Have you check if these aren't just non-delivery notices sent in responses from spam that was sent to invalid internal email addresses ?

answered May 18 '16 at 11:36

Stephane

6,432
3
26
47

score 0 · Answer 2 · answered Jun 08 '16 at 08:28

I'd bet that these are NDRs send by Exchange. Its common practice to disable such messages. In order to do so follow these resources:

suspicious outgoing emails from my Microsoft Exchange Server 2013 box (sendgrid)

2 Answers2