0

I've been having a recurring problem at work: My boss's contacts keep receiving emails with links sent by a fake adress. The adress always has my boss's name + a different domain name every time. Example: MyBossName@DifferentDomainEverytime

The links in the emails are always existing domain name + something.php. For example : www.ExistingDomain.com/example.php

This has been happening almost weekly. Everytime, I check the fake emails' headers and the IP addresses found in them. So far, I've found very different origins / transit points for those fake emails: Japan, USA, Germany, Saudi Arabia, Morocco, Indonesia, etc. It's never the same.

My questions are:

What could be causing those fake emails? Is it a known bot? A virus my boss got that copied his contacts? Or someone that is messing with him?

No doubt a very naive question: what's the purpose of sending those emails? Just to keep bothering people? The links in the emails don't direct to unsafe websites, clicking on them doesn't launch the download of a malware, etc.

How do we deal with this problem? I've got the IPs, but what do I do with them? Any idea on how to make those fake emails stop?

Improve this question
2
  • 1
    what happens when you click on the links(as you have already tried it)?. you should not be clicking on those links
    – JOW
    Sep 24, 2015 at 14:24
  • Nothing happens. The links don't exist, so I get an error from the browsers. I've googled the links before clicking on them and checked to which page they directed (if the link in the message is www.example.com, that it goes to message.com's website). I clicked on the links only on an old computer that no one uses anymore and that isn't connected to the network (we don't use USB drives, etc on it)anymore).
    – Popeuch
    Sep 25, 2015 at 18:08

1 Answer 1

Reset to default
1

It sounds like it's some spambot that is sending out the emails. I can't explain why the links are dead or what the purpose of them is. It may be that the links were valid at one point and are now dead or it may have been set up in error.

As the IPs keep changing, blocking them is likely not useful. It may even be the case that blocking those IPs will block real mail coming from the same IPs.

How your boss's contact list got exposed is something that will take a lot of research to figure out. One of your boss's computers may have had/has a virus on it. It may just be that the spambot is acquiring a list of email addresses and grouping the spam to people in a single domain to make the email look more reasonable.

As far as what can you do, not much. Make sure that all your computers are up to date and have updated antivirus on them. Perhaps there are products/services/freeware that can help you filter these emails out based on content or something. Otherwise, just live with it and be happy that you're living through a time with such wonderful growth of the internet :D

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .