I have an on-site Exchange Server 2013 environment.

We use sendgrid for outgoing e-mail delivery.

I was just browsing through our sendgrid account (I don’t do that often), and I noticed a LOT of “deferred” emails in the activity feed. More concerning is that so many of them appear to be bogus or BS emails.

Any idea on how I can start backtracking the source of these emails?

It seems somewhere my system is compromised, but it could be the sendgrid account, or the Exchange server, or perhaps an individual e-mail client/PC.

Here is a small example of the email addresses I’m seeing in the “Deferred” queue (note that this is a professional organization that has nothing to do with any of these keywords):

Deferred   beautiful-arabian-girls@said3moo.oadrail.top   May 18, 2016 12:54:43 AM  
Deferred   jessicasimpsonslimfigure@gruai7se.grudgeq.top   May 18, 2016 12:49:36 AM  
Deferred   military-overstock@sound4ek.steamyg.top   May 18, 2016 12:35:00 AM  
Deferred   privatejet@carlineat.download   May 18, 2016 12:32:46 AM  
Deferred   people-anti-aging@cder45guh.stubxlo.top   May 18, 2016 12:26:42 AM  
Deferred   yourbusinessfunds@muteds3aa.freakye.top   May 17, 2016 11:52:18 PM  
Deferred   asiangirlfriends@eyfde3ai.ruledy.top   May 17, 2016 11:42:39 PM  
Deferred   businessloans@fastnessdo.download   May 17, 2016 11:34:55 PM
Deferred   privateairplanecharter@leaf11uio.restede.top   May 17, 2016 11:31:57 PM  
Deferred   walkintub@bimorphby.download   May 17, 2016 11:14:14 PM  
Deferred   moonjana29@static.vnpt.vn   May 17, 2016 10:43:05 PM  
Deferred   diabetescure@uknwaurs.net   May 17, 2016 10:30:28 PM  
Deferred   gnc-force-factor@livee4aa.oadhop.top   May 17, 2016 10:29:58 PM  
Deferred   breastenlargementchoices@ga7jitresa.jtmecca.top   May 17, 2016 10:17:30 PM 
  • 1
    Have you checked your Exchange SMTP logs to see if any of these show up there? – Todd Wilcox May 18 '16 at 13:30
  • Additionally, have you checked your SendGrid IP Access Logs to see if unknown IPs are accessing your account? – jacobmovingfwd May 18 '16 at 18:01

Have you check if these aren't just non-delivery notices sent in responses from spam that was sent to invalid internal email addresses ?


I'd bet that these are NDRs send by Exchange. Its common practice to disable such messages. In order to do so follow these resources:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.