The Sneaky Shadow: Understanding Email Forwarding Compromises

At Mailbaby, we like to keep things delivered but occasionally, we run into some pretty sophisticated bad actors trying to pull a fast one on your inbox. One of the most common—and sneakiest—threats we see is something called an Email Forwarding Compromise.

It sounds technical, but it’s actually a classic case of digital eavesdropping. Here is what is happening behind the scenes and how we are stepping in to stop it.

What Exactly is an Email Forwarding Compromise?

Imagine someone making a secret copy of your house key. You still get into your house just fine, everything looks normal, but someone else is coming in after you leave to look through your mail. That is exactly how this works.

When a control panel (like cPanel or DirectAdmin) gets compromised, a hacker doesn’t always just change your password and lock you out. Instead, they set up a forwarder. They tell the server: “Every time an email comes into this account, deliver it to the user like normal, but also send a hidden copy to this random Gmail address.”

Because you are still getting your emails via your normal POP/IMAP account, you might have no idea that a “shadow copy” of your entire digital life is being sent elsewhere.

The “Why”: Looking for Needles in Haystacks

You might wonder why a hacker cares about your newsletter subscriptions or grocery receipts. The truth is, they are playing a numbers game. They dump massive amounts of forwarded emails into free accounts (like Gmail) and use automated tools to scan for “gold”:

• Login Credentials: Usernames and passwords for other websites.
• Financial Data: Bank statements or invoices.
• The Big Prize: 2FA (Two-Factor Authentication) codes. If they have your email, they can often bypass your other security layers.

How Mailbaby Protects You: “The Baby Bouncer”

We don’t like bullies, and we definitely don’t like digital eavesdroppers. To combat this, we’ve implemented what we affectionately call “The Baby Bouncer” protocol.

Using data from our partners and patterns identified across our network, we can spot when an account is being used for these SRS (Sender Rewriting Scheme) email compromises. When our system identifies a suspicious pattern, it flags the email with:

POSSIBLE_COMPROMISED_SRS_RCPT

Once this flag is triggered, The Baby Bouncer steps in. We suppress these emails, preventing them from being delivered to the hacker’s remote address. This cuts off their data supply and keeps your sensitive information from sitting in a stranger’s “dump” folder.

What Should You Do?

If you see reports of suppressed emails or “Compromised SRS” flags in your logs, it’s time for a security checkup:

• Audit your forwarders: Check your cPanel or DirectAdmin settings to see if there are any email addresses listed that you didn’t put there.
• Rotate your Passwords: Change your control panel and email passwords immediately.
• Enable MFA: If your hosting provider offers Multi-Factor Authentication for your control panel, turn it on!

We’re here to make sure your mail gets where it’s supposed to go—and only where it’s supposed to go. Stay safe out there!