Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Categories

In this Discussion

› › Getting spam from my own email address
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Getting spam from my own email address

machine123machine123 Member
in Help

Hello guys,

Some douche bag is spamming me non-stop on my personal gmail account, and the emails are coming from my own email address so I can't even mark it as spam (it might flag my email as spam). Here is one of the messages source:

Delivered-To: [email protected]
Received: by 10.236.180.19 with SMTP id f19csp2528884pjr;
        Sat, 21 Apr 2018 19:32:19 -0700 (PDT)
X-Google-Smtp-Source: AIpwx4/MBZOkCOlumOidd1UAqg3WM4zQyK3BXCj+jL1/zWKj3J1hl1OcmacPBNzqhplTQ5vYHfKX
X-Received: by 2002:ac8:3488:: with SMTP id w8-v6mr18306709qtb.278.1524364339058;
        Sat, 21 Apr 2018 19:32:19 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1524364339; cv=none;
        d=google.com; s=arc-20160816;
        b=zTzBnhxBCpIMe7gzeG4lgZ6JLBd4ujzlPntcikdzGcyT4mSZfYagrSOoYeaqYvmAfi
         BKrzOLGiqYG/+KyYqYtBh4DLjWQl3pUvH2rywgrb0eK5oqyyDJXmufHG98igmMHb/iVu
         ahgXux4HTAZSK0YsQtkgIOMJf6skUUMtKG3/7GUvkdmydwTtoAHvqhuY8KEASTRZNB7H
         XEZg1JydYQeORfBlVh2Ry6J0qgTvOu8c6jRl8vkvjkVew1gjLfHcdM4dUIWWUf8MYPd6
         a3cAyXBxf0gJHiiywBF9UoZ1r5+I1RKMhnaVXJ9SStbLP1HhTBQrdCUafrUF37/rhFmm
         cLQg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=date:message-id:subject:to:from:arc-authentication-results;
        bh=e9D0rlZHq51n3B4mRj4EfKnNKsv8i1UrXVRpskBltKg=;
        b=Nnzej7WNDZ880oeNoZGr8w9A+vH+zD1+DGTkthyaUigApvDYo4Wcnk2Lk7/APNGyvN
         FWkkZSOGCLZvlf+Xv2qYYLX3lS7Ksjuff3+P0FOaP8EacC+Mjgf9lOhalKyFWFhRgQtP
         genSyeuOW7ESsxtQ/AySvKD0T6/uZcj3i8vbfTmbzh0KgZJm1RWl3c6iaLdMGMHVLW7Y
         jmN/hp52fZreXhkGluGCs0SSElSaihlvCF+mtxL0tqt8ur9nVq7SIjyGYNU7Xo43txXI
         Uf1/wHSSDzq0F1VHS0OSILGujGTFFR98fyBzFx0tBiQDsrP+Ld7lc7Lnw70aL4pieIAM
         Py4g==
ARC-Authentication-Results: i=1; mx.google.com;
       spf=pass (google.com: domain of [email protected] designates 18.221.134.164 as permitted sender) [email protected];
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Return-Path: <[email protected]>
Received: from cloud-fork.com (ec2-18-221-134-164.us-east-2.compute.amazonaws.com. [18.221.134.164])
        by mx.google.com with ESMTP id m41si892092qkh.35.2018.04.21.19.32.18
        for <[email protected]>;
        Sat, 21 Apr 2018 19:32:19 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 18.221.134.164 as permitted sender) client-ip=18.221.134.164;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of [email protected] designates 18.221.134.164 as permitted sender) [email protected];
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. )
        by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14
        for <[email protected]>;
        Fri, 20 Apr 2018 00:37:14 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 18.221.134.164 as permitted sender) client-ip=13.58.85.245;
from: Bitcoin Loophole <[email protected]>
To: <[email protected]>, <[email protected]>, <[email protected]>, <[email protected]>, <[email protected]>, <[email protected]>, <[email protected]>, <[email protected]>, <[email protected]>
Subject: Who is hotter: Saasha or Clara?
Message-ID: <[email protected]=Mx.google.com>
Content-Type: multipart/report; boundary="f4f5e80f07d80f991b056a2936a0"; report-type=delivery-status
X-EMMAIL: <@googlemail.fr [email protected]>
Date: Sat, 21 Apr 2018 22:32:19 -0400

--f4f5e80f07d80f991b056a2936a0
Content-Type: text/html; charset="UTF-8"

Any ideas how to stop this?

Comments

  • jsgjsg Member, Resident Benchmarker

    Simply filter by Return-To. And remember that the from header can be faked easily and isn't of much help in terms of filtering spam.

  • TriJetScudTriJetScud Member

    Yep, I see this all the time on my domains which had it's WHOIS information public.

    This got so bad that I had to put in postfix rules where if the From: field has stuff coming from my own domains and the user connected to the smtp box isn't from my trusted relay servers...

  • machine123machine123 Member

    jsg said: Simply filter by Return-To. And remember that the from header can be faked easily and isn't of much help in terms of filtering spam.

    Thanks, gmail doesn't seem to create a filter on "Return-To", just "From", any ideas?

  • AluminatAluminat Member
    edited April 2018

    This. Last night, I received a lot of spam email coming from my own address.

    Gmail's filter seems could not stop it.

    E: These email coming from telus.com.

    Thanked by 1machine123
  • cpsdcpsd Member

    They all came from a woman who is in love with you.

    Thanked by 6pechspilz hostdare ehab Janevski dedipromo cassa
  • TriJetScudTriJetScud Member

    @Aluminat said:
    This. Last night, I received a lot of spam email coming from my own address.

    Gmail's filter seems could not stop it.

    E: These email coming from telus.com.

    What's more interesting with it is on the first sample that @machine123 posted was it passed SPF checks for some reason. Or the headers that passed such SPF checks were falsified by one of the upstream mail gateways to make it look legitimate.

  • AluminatAluminat Member

    @TriJetScud Mine was passed as well

    https://pastebin.com/ADEiuC96

    Received-SPF: pass (google.com: domain of [email protected] designates 13.59.99.137 as permitted sender) client-ip=13.59.99.137;

  • donlidonli Member

    Thanked by 2Aidan Janevski
  • TriJetScudTriJetScud Member

    Well, after I decided to dig around, it seems like they set their spf record to softfail if it doesn't match up correctly.

    Or one of their DNS servers got popped and somebody managed to insert an AWS address in there,

    Thanked by 2machine123 Aluminat
  • pikepike Veteran

    Wait, they manage to not get marked as spam but my small MIAB setup always goes into the spam inbox. Thank you gmail...

  • angstromangstrom Moderator

    Did the person at least send photos of Saasha and Clara to compensate for the inconvenience caused?

  • angstromangstrom Moderator

    In the old days, a complaint sent to postmaster AT telus DOT com would probably have helped, but if the whole purpose of that server is to spam, this probably wouldn't help here.

    Alternatively, you could try to send a complaint to the datacenter where the server is hosted.

    Another possibility is to send a complaint to the registrar for telus DOT com.

    (All time-consuming, I agree, but if you want to try to fight back ...)

  • ClaraSClaraS Member

    My name is Clara, I just joined because I seen your post. I have had the same thing happen to me ?? :(

  • JanevskiJanevski Member

    @Aliminat Aluminati confirmed.

    Thanked by 1pullangcubo
  • saibalsaibal Member

    @ClaraS said:
    My name is Clara, I just joined because I seen your post. I have had the same thing happen to me ?? :(

    Do you happen to know a Sasha?

  • cubedatacubedata Member, Patron Provider

    Do they happen to know the can-spam act that makes it a crime to spam? Tell them to look here and enjoy the FTC(Federal Trade Commission)'s wrath https://www.lexisnexis.com/lexis-practice-advisor/the-journal/b/lpa/archive/2016/11/08/complying-with-the-can-spam-act.aspx

  • donlidonli Member

    @cubedata said:
    Do they happen to know the can-spam act that makes it a crime to spam?

    After 15 years I've concluded the "can spam" act was completely appropriately named.

    Thanked by 2Aidan jackb
  • doughmanesdoughmanes Member
    edited April 2018

    lololol citing CAN-SPAM when I get telemarketer calls all day long because telemarketing is illegal also

  • TomTom Member

    With gmail? They were having some problems involving your own address, I think they're resolved now. I can't find the Tweet but someone was tweeting about it.

    Thanked by 1machine123
  • abjrabjr Member
    edited April 2018

    It's not just you. This is a known issue right now:

    https://news.ycombinator.com/item?id=16894735

    Thanked by 1machine123
  • machine123machine123 Member

    Oh great, I thought my account was compromised somewhere. Glad it's not just me.

  • sarahsarah Member

    This is a very wide problem : https://productforums.google.com/forum/#!topic/gmail/jtXGmic9dkc;context-place=forum/gmail

  • Ole_JuulOle_Juul Member

    doughmanes said: lololol citing CAN-SPAM when I get telemarketer calls all day long because telemarketing is illegal also

    Yeah, there's no stopping people from breaking laws. Perhaps a law that says it's illegal to break the law - which seems to be the way lawmakers are approaching it. Anyway, I've had exactly one telemarketer in the last 4 years. I put a block on all my numbers where you have to push a number to complete the call. Telemarketers and their bots don't seem to want to go past that point.

  • huntercophuntercop Member

    No spam for me, no love for me. :'(

  • atomiatomi Member

    Dont say it so loud, someone might hear and soon you will get spam and love

  • korphostingkorphosting Member
    edited April 2018

    machine123 said: Subject: Who is hotter: Saasha or Clara?

    Huh?

  • snickerpopsnickerpop Member

    What the heck is going on here
    Same thing happened to me. I thought I was hacked for a bit.

    This is really annoying because it shows up as being sent from my account like when you go to sent messages

  • jiggawattjiggawatt Member

    It was a bug: http://bgr.com/2018/04/23/gmail-spam-in-sent-hackers-email/

  • atomiatomi Member

    Really nasty bug I would say, specially since they appear in 'sent' folder

Sign In or Register to comment.