Two users on my domain are receiving spam emails that have both of their emails in either the To: and/or CC: fields. There are many other users on the domain, but only these two are receiving spam emails. The two accounts are not exclusively linked or associated (eg. only two of them belonging in the same group)
Over the last few days, both have received hundreds of messages (the same messages essentially). There is a spam filter on the mail server in place but its the fact that they're both getting the same spam messages that I'm wondering about.
The headers indicate that they're coming from spam servers all over the world. Each email is different (sample copied below, replaced private information with
Received: from max (18.104.22.168) by --mail.mydomain.com-- (X.X.X.X) with Microsoft SMTP Server id X.X.X.X; Fri, 27 Sep 2013 04:48:43 -0700 Received: (from root@localhost) by mail0.wiktionary.org (8.11.3/8.11.3) id k8V5OhN08473; Fri, 27 Sep 2013 11:48:43 -0300 (PDT envelope-from root) Date: Fri, 27 Sep 2013 10:55:07 -0300 Message-ID: <80252799905272.ZBiaUKfUeG@smithereens> X-Mailer: phpmailer [version 1.41] X-BeenThere: email@example.com X-Kaspersky: Checking Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable To: <--firstname.lastname@example.org-->, <--email@example.com--> From: Get BIGGER with Free trial <firstname.lastname@example.org> Subject: Disappointed at your lack of performance? MIME-Version: 1.0 Return-Path: email@example.com X-MS-Exchange-Organization-AuthSource: --mail.mydomain.com-- X-MS-Exchange-Organization-AuthAs: Anonymous
My question is what is the most reasonable explanation for both users to be in the To: and CC: fields of spam?
At first, I thought domain attack, but then why only two users? Or if it is a single user being compromised, then why is it only spamming one other user when it has a whole address book? Another idea is that this is a targeted attack against the two, but is that possible? Is there some spam machine that someone could dunk two names into and be put on a list to be spammed together? I could understand both being on the same list and spamming individually, but together? It seems incredibly bizarre.