Community

Email address is added automatically

Se
Sergio #1

Hello
I have the following problem:
Looking at the email queue, I see some messages that say “deferred.” I tried sending emails and checking the queue at the same time to see what anomalies I found.
Interestingly, in the “recipients” column, I found an email address to which I didn’t send anything; I don’t even know it. This account is “perresilvio@gmail.com
And it presents the following error:

[{“address":"perresilvio@gmail.com”,“delay_reason”:“host alt1.gmail-smtp-in.l.google.com[64.233.184.26] said: 450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. gsmtp (in reply to RCPT TO command)”}]

The funny thing is that I tried several accounts from different domains, and the same thing happens several times (only that Gmail address is added).
Is it possible that the server has malware or a virus or something?
How do I fix it?

Thank you very much.

1
FT
Fiodor Tupolev Asimov #2

I also had a similar case with a company account that was redirecting emails from a sales executive to this malicious email address:

This makes perresilvio@gmail.com a highly suspicious Indicator of Compromise (IOC).

Is this the hacker's email?

It cannot yet be stated definitively that the visible owner of this account is necessarily the attacker. It could be:

an account directly controlled by the attacker;
a stolen account;
a ​​collection mailbox;
an address used by malware or automated scripts;
an address inserted through a known vulnerability or compromised administrative credentials.

However, operationally, we must treat it as an unauthorized malicious destination.

Sign in to reply