6

I noticed yesterday that I had received spam e-mail, but my own e-mail address was listed as the sender. Naturally, I changed my password. This is probably a spoof, but I don't know enough about SMTP to understand the e-mail's headers and be sure of it.

I have two questions:

  • Was my e-mail account compromised?
  • Why would a spammer send mail to me that lists myself as the sender?
  • 4
    Getting spam from "yourself" is pretty common. They likely spoofed your address as the sender. – schroeder Nov 5 '15 at 22:46
  • That's weird. I've been using this e-mail address for four years, and I've never gotten spam from "myself" until this week. – JesseTG Nov 5 '15 at 22:55
  • 1
    in the mail source you can se the real sender, info displayed can be faked – Froggiz Nov 5 '15 at 23:05
  • There was no need for you to change your account password. This was just your address which was used, and everyone can do this easily :). – daniel Azuelos Jan 14 '16 at 23:21
11

SMTP messages have a host of header values that are used by mail servers (Qmail) and mail clients (Outlook, Gmail) for different things. It's possible your email was set as either the From or the Sender value which was displayed by your mail client.

Here's some info on SMTP from and sender headers: http://tools.ietf.org/html/rfc4021#section-2.1.2

As for your questions...

Question 1: No idea. Getting emails from yourself isn't a guarantee that your account was compromised.

Question 2: If I were a spammer I would look for ways to confuse digital and organic anti-spam systems. You could imagine anti-spam filters that automatically whitelist emails that come from the account holder and you can imagine people that get curious about messages that look like they came from themselves. Those types of messages might be more likely to slip past spam filters and get clicked.

If you want to know more about the message you can investigate the mail headers. That will show you the sender, the from, the return-path. You should also be able to see what server your mail server received the message from so that might be a clue.

You could also look in your Sent mail folder. If someone did compromise your account and send you mail and forgot to hide their tracks, you might see a copy of the message in there. If you do find a copy in your Sent folder, that's a pretty strong indicator that something is wrong...

3

You didn't specify, so I assumed it was a bounce message. If so, there are two possible options here:

a) The spammer sent spam using your address as the reply-to. This is called Backscatter, and it's pretty common.

b) The email is actually spam, disguised as a bounce message. People are more likely to open bounce messages than they are undisguised spam, so this technique is sometimes used. This is called Deliberate Bounce.

This topic is dealt with more deeply here: https://blog.malwarebytes.org/online-security/2015/11/backscatter-or-misdirected-bounces/

1

To reduce these backscatter email messages, look at the SPF record for your domain

https://www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard/

You can change the SPF policy to -all where the minus sign means enforce all receiving MTAs to only accept email from non-spoofed addresses.

You can go a step further and add DKIM signing with a DMARC policy to prevent this from occurring.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.