10

I work at a small nonprofit and woke up to find that many of our email addresses have been sending spam asking recipients to open an attachment (doc file). We have a local network that all of our computers are connected by. I'm not sure about the security of it. We also have our website and emails managed by a third party.

Is this issue more likely to be caused by our local network being compromised or the web server?

closed as too broad by Tobi Nary, ISMSDEV, Anders, crovers, Rory Alsop Nov 9 '17 at 17:03

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • How did you wake up to this information? Were you monitoring network traffic, or were you getting replies to your inbox? – voices Nov 11 '17 at 7:28
29

Email addresses do not send spam. Email servers do.

Anybody can forge your email address as the From address without hacking you at all. That's how you get spam all the time that says it comes from you. You can however tell from the email headers what servers it was sent through.

Best thing to do would be to contact the third party that is hosting your email. Ideally, send them a copy of the headers from one of these spam emails. They will be able to tell where the emails are coming from.

In fact, if they are coming from your website or a local computer sending email, they'll probably be contacting you eventually, since it will start getting their mail servers blacklisted eventually.

  • 5
    I'd suggest contacting your e-mail host quickly. If your e-mail domain gets identified as a spamming domain, it can get blacklisted. I've never had to deal with that but I know someone who has. It was a colossal pain to get that fixed. – baldPrussian Nov 7 '17 at 22:05
  • Definitely need to get on it sooner than later, some blacklists (I'm looking at you, AOL) are notorious for behaving very aggressively. – user41341 Nov 7 '17 at 23:58
  • "Anybody can forge your email address" - actually, that's only true if you don't have an "SPF" record. An SPF record basically says that mail from anyone@example.com can only come from mailserver-1.example.com or mailserver-3.example.com. If an email from spammer.example.org has a From: address of @example.com, the receiver knows it's fraudulent. – MSalters Nov 8 '17 at 10:18
  • 12
    @MSalters That's somewhat oversimplifying things. It's still true that anyone can forge your email address; what technologies like SPF, DKIM, and DMARC do is provide a mechanism for receiving servers to detect those forgeries. If you have an SPF record configured correctly and set to "hard fail", then many hosts will automatically reject most forged emails; but it's definitely not as simple as "I have an SPF record now, nobody can impersonate me ever again". – IMSoP Nov 8 '17 at 10:53
5

Most likely they were the victim of phishing (likely the exact same phishing template as the spam being sent) and their accounts were compromised. However, it's also possible that they have gained domain admin access and is using that to send spam. Also, depending on your mail security, authentication could be IP based, which means being in the network allows you to send email.

The answer is that it's impossible to tell without more details and an investigation.

Not the answer you're looking for? Browse other questions tagged or ask your own question.