Print Page - Spammers have hijacked two of my email addresses

Archives => 2009 => Topic started by: chriskleeman on November 09, 2008, 09:58:54 AM

Title: Spammers have hijacked two of my email addresses
Post by: chriskleeman on November 09, 2008, 09:58:54 AM

So,

I know we've dealt with some of this in previous threads, but any current strategies to combat this would be much appreciated.

I've got two email addresses that seem to be pretty well compromised. I can't get my spam program to block them, because the mail look like it's actually coming from two of my valid email addresses. So it's like I'm sending myself these messages.

From what I can tell, the only thing I can do is to change/disable these two addresses. Which will be a real pain, because one of them is my main address that I use for just about everything.

TIA,

Chris K

Title: Spammers have hijacked two of my email addresses
Post by: Xairbusdriver on November 09, 2008, 07:41:49 PM

What anti-SPAM program are you using?

Title: Spammers have hijacked two of my email addresses
Post by: kimmer on November 09, 2008, 08:09:38 PM

Are you sure someone has hijacked your addy's? Isn't there a PC virus that does this stuff? I know I've received mail supposedly from myself (and all the headers traced right back to me) and it was always a piece of virus junk from a PC pal not smart enough to be running virus software.

Well, that's the end of my tips. I'm totally clueless about all this stuff. I'm so old school. I'm lost these days. *sigh* And this isn't helping you one bit. Maybe I should go make pancakes and drown them in Maple Syrup. I'd at least feel happy.

Title: Spammers have hijacked two of my email addresses
Post by: Paddy on November 09, 2008, 10:47:42 PM

I agree with kimmer, Chris - it's probably someone who has you in their address book or somewhere in their inbox and they have a virus which is sending out mail with forged headers. Send me the complete header and I'll run it through SpamCop for you and figure out where it's really from, if it's not apparent on first look. I think it's very unlikely that someone actually has gotten into your main account, and if they had, you could simply change the password and shut 'em down, assuming your ISP requires authentication to send mail (mine does).

Title: Spammers have hijacked two of my email addresses
Post by: chriskleeman on November 09, 2008, 10:48:03 PM

The program is called Postini.

Recently, the volume of these emails has picked up quite a bit. And they always say:

QUOTE

About this mailing:
You are receiving this e-mail because you subscribed to MSN Featured Offers. Microsoft respects your privacy. If you do not wish to receive this MSN Featured Offers e-mail, please click the "Unsubscribe" link below. This will not unsubscribe you from e-mail communications from third-party advertisers that may appear in MSN Feature Offers. This shall not constitute an offer by MSN. MSN shall not be responsible or liable for the advertisers' content nor any of the goods or service advertised. Prices and item availability subject to change without notice.

?2008 Microsoft | Unsubscribe | More Newsletters | Privacy

Microsoft Corporation, One Microsoft Way, Redmond, WA 98052

I can't shut them off because I can't block my own email addy... that's the problem.

And they're coming in with two of my addresses.

CK

P.S. Whoops! Paddy, you posted as I was writing this... I'll send you the header right now. Thanks.

Title: Spammers have hijacked two of my email addresses
Post by: Paddy on November 10, 2008, 01:16:03 AM

From looking at the headers, I'd say that it's not a case of hijacking, but a case of forged headers. According to SpamCop, the email is originating at a Gmail addy with a Gambian IP. The return path for the email is in icqmail.com email address, with some similarity to Chris' real email address. I have no idea if it's got anything to do with this or not, or whether it too is forged.

Chris, you can block IP numbers with Postini? If so, check the headers of a few of the spam emails you've received and see if they're coming from the same IP.

Title: Spammers have hijacked two of my email addresses
Post by: sandbox on November 10, 2008, 03:30:08 AM

It's a simple thing to just add a return address in the header to anyone including the receiver. You need to look at the map of IP addresses and stop it at the transfer from their server to you.

Title: Spammers have hijacked two of my email addresses
Post by: Paddy on November 10, 2008, 08:52:57 AM

SB, does Postini allow one to block by IP source? I don't have it, so can't advise there.

One thing I just discovered - in Mail, you can add Header criteria, and then use them to filter your mail. So you can add "received" and then add the "from source ([212.60.73.48])" as the criteria in the rules. That will work if much of the spam is coming from the same IP. Of course, that's simply dealing with it once it lands in your inbox - if Postini can keep it out, which I would think it should if the spammers have been using a consistent IP, then that's far better.

You could also add "return path" as one of the header criteria - again, if they're consistently using that ICQ email addy that doesn't in fact belong to you.

Title: Spammers have hijacked two of my email addresses
Post by: Thomas S. England on November 10, 2008, 09:41:16 AM

I recently signed up with AIM because I needed to get a screen name to use while iChatting. Since then my spam has increased dramatically, with many of them from aim.com addresses.

I'm also getting a bunch which list my email address as the "From" address. Here are the internet headers from one of those:

Return-Path: <someone@someplace.com>
X-Original-To: someoneelse@someplace.com
Delivered-To: aperson?@dogbark.net
Received: from mx02-01.sublimemail.com (mx02-01.sublimemail.com [208.65.30.86])
   by atree.dogbark.com (Postfix) with ESMTP id D3BB312C2F2
   for <someoneelse@someplace.com>; Mon, 10 Nov 2008 08:13:47 -0600 (CST)
Received: by mx02-01.sublimemail.com (Postfix, from userid 777)
   id 7E25D49B65E; Mon, 10 Nov 2008 08:13:16 -0600 (CST)
Received: from homeuser77.43.161.184.ccl.perm.ru (homeuser77.43.161.184.ccl.perm.ru [77.43.161.184])
   by mx02-01.sublimemail.com (Postfix) with SMTP id BC2FB49B647
   for <someoneelse@someplace.com>; Mon, 10 Nov 2008 08:12:51 -0600 (CST)
X-Originating-IP: [83.6.15.1]
X-Originating-Email: [someoneelse@someplace.com]
X-Sender: someoneelse@someplace.com
To: <someoneelse@someplace.com>
Subject:RE: Doctor Q&A Colby Hawkins
From:<someoneelse@someplace.com>
MIME-Version: 1.0
Content-Type: text/html
Message-Id: <20081110141254.BC2FB49B647@mx02-01.sublimemail.com>
Date: Mon, 10 Nov 2008 08:12:51 -0600 (CST)
X-Filtered-By: SublimeMail (http://sublimemail.com)

Title: Spammers have hijacked two of my email addresses
Post by: Jack W on November 10, 2008, 10:22:07 AM

Hey Tom,

You have a bunch of valid email addresses in that last post.

You may want to consider masking them.

- Jack

Title: Spammers have hijacked two of my email addresses
Post by: kimmer on November 10, 2008, 12:56:20 PM

I changed all the email addys. Not sure if any of the IP numbers needed to be weeded out as well.

--Kim

Title: Spammers have hijacked two of my email addresses
Post by: Paddy on November 10, 2008, 02:14:02 PM

IPs are fine - they're either internal ones or they belong to the spammer, who is using a Russian IP at the moment. Looks exactly like the crap that Chris is getting, btw.

Title: Spammers have hijacked two of my email addresses
Post by: sandbox on November 11, 2008, 02:36:34 AM

Paddy I don't use whatever it was you mentioned.

if you don't send email to yourself just block email coming from yourself, I do.
Go to the server and block your own address. done

as far as IP blocking goes i trust my server.

Somewhere in the list you'll see your server receiving something from some other server like this below.

Received: from joeblow.isp.att.net ([217.145.11.00]:50201)
   by myserver.asmallorange.com with esmtp (Exim 2.34)
   (envelope-from <someone@bellsouth.net>)
   id 1TpYXQ-1234vk-Re
   for me@athome.com; Mon, 10 Nov 2008 09:00:31 -0500

The ([217.145.11.00.]:50201) or anything with a ([---[) coming to my server is a real IP address

I block either the IP or the whole range of or the IP depending on the moon, stars and how I feel about Poland that day.

In Thomas's case I could block the single IP 208.65.30.86 or
NetRange: 208.65.28.0-208.65.31.255 or
CIDR: 208.65.28.0/22

It's a judgment call. if I'm getting a lot of spam from a country I block the whole country Until spamassasin catches up or the illegal activity is stopped by others. You can always go back and remove the blocks. Just look at your logs to see if your getting a lot of activity from an IP and if it stops. Sometimes the countries themselves will stop it because they know we will block them from access. I don't do business in Russia so I could block it without a a care, or any place for the matter.

Title: Spammers have hijacked two of my email addresses
Post by: chriskleeman on November 11, 2008, 11:05:40 AM

Well, the IP addresses I've been seeing are all over the place. I have narrowed one source down to a single IP, but there seems to be no rhyme or reason unless I'm not looking in the right spot.

Here's one of them, and I've substituted <myemailaddress@somewhere.net> in those places where the valid email address shows up. And I've removed the domain name in the Return-Path, but it belongs to an private IP provider, clarity.net

From - Sun Nov 9 11:23:43 2008
X-Account-Key: account3
X-UIDL: "%,!!(c7"!4RN"!jG?"!
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <kleeman@somewhere.net>
Received: from psmtp.com (exprod7mx230.postini.com [64.18.2.183])
   by yoda.vermontel.net (8.13.8/8.13.8) with SMTP id mA9GCGSD090676
   for <myemailaddress@somewhere.net>; Sun, 9 Nov 2008 11:12:17 -0500 (EST)
   (envelope-from kleeman@clarity.net)
Date: Sun, 9 Nov 2008 11:12:16 -0500 (EST)
Message-Id: <200811091612.mA9GCGSD090676@yoda.vermontel.net>
Received: from source ([93.120.176.55]) by exprod7mx230.postini.com ([64.18.6.14]) with SMTP;
   Sun, 09 Nov 2008 08:11:10 PST
X-Originating-IP: [729.6.48.3]
X-Originating-Email: [myemailaddress@somewhere.net]
X-Sender: myemailaddress@somewhere.net
To: <myemailaddress@somewhere.net>
Subject: RE: zr.Doctor Harlan
From: <myemailaddress@somewhere.net>
MIME-Version: 1.0
Importance: High
Content-Type: text/html
X-pstn-levels: (S: 0.00000/86.03780 CV:99.9999 R:95.9108 P:95.9108 M:95.5423 C:98.6951 )
X-pstn-settings: 2 (0.5000:0.5000) s cv gt3 gt2 gt1 r p m c
X-pstn-addresses: from <myemailaddress@somewhere.net> forward (user good) [3996/158]
X-UIDL: "%,!!(c7"!4RN"!jG?"!

Title: Spammers have hijacked two of my email addresses
Post by: RHPConsult on November 11, 2008, 11:18:26 AM

I'm really over my head, here, too, Kimmer.

However, if I can add a current puzzle along the same lines, here it is. (If I should post this separately, please so inform me)

• • •

I also have several e-addresses. My principal one is on Earthlink. (I've kept it because it seems too big a job to tell everyone in my address book to switch)

The other day one of my favorite correspondents (also a Mac-ster, also using MAIL, also on Earthlink) presumably sent me a message that, henceforth, I needed to be pre-approved (once) in order to have my mail get into his mailbox. And, of course, click here to begin the process. You betcha!

The jerk sending this was too smart by half. My pal is on vacation and has been sending me photos and messages from his MB Pro from various hotels around the West. So, the "warning" made no sense.

He'll be home by tomorrow and will be talking to Earthlink (lotsa luck).

Any idea how this happened, what he might do to hose it? I am, to date, the only one of his correspondents so "infected", "afflicted", whatever!

Title: Spammers have hijacked two of my email addresses
Post by: sandbox on November 11, 2008, 12:44:39 PM

QUOTE(chriskleeman @ Nov 11 2008, 01:05 PM) <{POST_SNAPBACK}>

Chris, all of this from the bottom is added…there is no such IP address over 255. 255.255.255 so this is BS [729.6.48.3] pay close attention to RECEIVED FROM: in this case =psmtp.com http://www.robtex.com/dns/psmtp.com.html

Sun, 09 Nov 2008 08:11:10 PST
X-Originating-IP: [729.6.48.3]
X-Originating-Email: [myemailaddress@somewhere.net]
X-Sender: myemailaddress@somewhere.net
To: <myemailaddress@somewhere.net>
Subject: RE: zr.Doctor Harlan
From: <myemailaddress@somewhere.net>
MIME-Version: 1.0
Importance: High
Content-Type: text/html
X-pstn-levels: (S: 0.00000/86.03780 CV:99.9999 R:95.9108 P:95.9108 M:95.5423 C:98.6951 )
X-pstn-settings: 2 (0.5000:0.5000) s cv gt3 gt2 gt1 r p m c
X-pstn-addresses: from <myemailaddress@somewhere.net> forward (user good) [3996/158]
X-UIDL: "%,!!(c7"!4RN"!jG?"!

Then we come to this where ([64……receives data from ([93……..who happens to be Russian
Received: from source ([93.120.176.55]) by exprod7mx230.postini.com ([64.18.6.14]) with SMTP;
Sun, 09 Nov 2008 08:11:10 PST

inetnum: 93.120.128.0 - 93.120.191.255
netname: DYNAMIC-BRAS-POOL5-NNOVVT
descr: Network for OJSC VolgaTelecom
descr: N.Novgorod Branch BRAS dynamic IP pools
descr: About abuse activity please
descr: e-mail to abuse@nnov.vt.ru
country: RU
admin-c: VT-RU
tech-c: VT-RU
status: ASSIGNED PA
mnt-by: NMTS-MNT
source: RIPE # Filtered

I just checked robtex http://www.robtex.com/dns/psmtp.com.html and found that psmtp.com= 64.18…..is on the spam list and your filters should be catching this stuff.

NetRange: 64.18.0.0 - 64.18.15.255
CIDR: 64.18.0.0/20

Title: Spammers have hijacked two of my email addresses
Post by: Xairbusdriver on November 11, 2008, 12:53:44 PM

HA! Another "feature" less respected than it should be by lowly users!

There is a setting at EarthLink/Mindspring that allows you to 'protect' yourself from some body by ~~forcing~~asking them to use that process. I'm sure your friend started it in good faith hoping to get less SPAM. But it also causes some one-time work for all his pals. I tried it once until I realized how paranoid it made me look and the trouble it caused others, even if it was only a one-time event. It is basically a way for the ISP to create a 'good' address list for each customer. It's not an infection, affliction, etc. just a one-time annoyance.

And, you can use it to annoy your friends, too!

Then, there are the automagic "Vacation" messages that keep all the forums full of "Sorry, I'm away..." messages...

And how about the request to "Acknowledge Receipt?"

"Yes, I got those images of little Johnny playing in the dog mess!"

Title: Spammers have hijacked two of my email addresses
Post by: sandbox on November 11, 2008, 12:55:09 PM

QUOTE(RHPConsult @ Nov 11 2008, 01:18 PM) <{POST_SNAPBACK}>

I'm really over my head, here, too, Kimmer.

However, if I can add a current puzzle along the same lines, here it is. (If I should post this separately, please so inform me)

• • •

Dick, you know there is a pre-approval option in the highest levels of earthlink security right? I used to set mine on High when I was out of town many years ago, before I knew better. He may have set it to high and didn't add you to the Good Guy list.

Let's assume he didn't, the address is earthlink internal and can be checked with their fact checking software on the webpage. To stop abuse just report it to earthlink right away.

Title: Spammers have hijacked two of my email addresses
Post by: sandbox on November 11, 2008, 01:12:21 PM

It is important that you report any spam as soon as you suspect it, it will be places on a list and the Spam software around the world will tag it for abuse. They rarely make mistakes so don't worry if you think someone's server is being abused and that they will be wrongfully charged.

Again, if you don't send yourself email block RECEIVED: From you@yours.com or have it redirected to a special folder on your server. I have a folder that I call junk, it empties on auto pilot every 10 days. I check it when i think of it any only once have i found an email in there that had some value.

If you want to send stuff to yourself you can use another address FROM to send it TO yourself.

If you need help setting up server side Redirects or folders just let me know and I'll try to guide you to a spam free existence.

Title: Spammers have hijacked two of my email addresses
Post by: Paddy on November 11, 2008, 05:23:11 PM

SB, the "Received: from psmtp.com (exprod7mx230.postini.com [64.18.2.183])" is Postini - the spam filter that the email is being sent through (I'm not sure if it's Chris' ISP that is doing it or whether he does it) They're on the red list because they're on the following lists: postmaster.rfc-ignorant.org, abuse.rfc-ignorant.org, and whois.rfc-ignorant.org which in no way shape or form means that they're spammers. They simply do not have abuse@psmtp.com and postmaster@psmtp.com (or postini.com...whatever) and don't have what RFC defines as adequate contact information in their whois info. It in no way means that they're blacklisted for being spammers. I'm not sure how many ISPs actually use their lists to block email - I would hope that it isn't many, as it has nothing to do with spam. Frankly, I've always had trouble with the "requirement" for a postmaster@yourdomain email address for any domain with email addresses - it's a sure-fire way to get inundated with absolutely ridiculous amounts of spam. In theory, TS could land on that list, if I understand it correctly. If we did, we'd join the illustrious company of Amazon, Microsoft, Gap, the Toronto District School Board, The Boston Globe, MSN, Yahoo, eBay...and those were just a few I tried looking up!! (They lacked either or both an "abuse@" or a "postmaster@")

Title: Spammers have hijacked two of my email addresses
Post by: chriskleeman on November 11, 2008, 05:43:21 PM

My ISP provides Postini as a part of their service, fyi.

CK

Title: Spammers have hijacked two of my email addresses
Post by: Paddy on November 11, 2008, 09:16:07 PM

Clearly the issue is that Postini is configured to ignore certain things - like email ostensibly from the same person it's being sent to, even if that email is originating from a spammer in reality. I would assume it applies a set of rules - some of which override the others and this is why this sort of thing slips through. You should contact your ISP with several examples (full headers) of the stuff you've been getting to see if there is some way they can adjust the filters on Postini.

Title: Spammers have hijacked two of my email addresses
Post by: sandbox on November 12, 2008, 12:34:20 AM

Thanks Paddy, it's hard to read these things when the addresses are altered. You can't do traceroutes or pings.

You've seen the real header? In any case..moving on.....I redirect all mail from me to me to a junk folder on the server. This is an old trick, I've had these blocks and redirects setup on my addresses for years. I don't send email to myself so there is no downside. if I need to send something to myself I will send it from metwo@myplace. com to me@myplace. com so there are no block rules to engage.

I remove Postmaster and Webmaster email addresses from my list on all domain accounts. They used to come with both, then only Webmaster. I do not use real names, like tom, dick, or harry@myplace. com Often add a number in with the letters, like 1toU@myplace. A well thought out plan and address is worth a thousand hours of spam you won't ever see. C
Since i'm a slow learner it took me 2thounsand hours of spam to figure out a plan but I've been spam free for sometime now and run an open address on some of my websites.

Title: Spammers have hijacked two of my email addresses
Post by: chriskleeman on November 12, 2008, 07:38:33 AM

FYI,

I began forwarding all the headers as they come in to Postini yesterday.

So, we'll see what happens.

I can block domains, I can block senders, and as a last resort, will block those two addresses if they can't figure it out.

And, thanks for all the info!

Title: Spammers have hijacked two of my email addresses
Post by: sandbox on November 12, 2008, 02:16:47 PM

Title: Spammers have hijacked two of my email addresses
Post by: Gregg on November 12, 2008, 06:49:00 PM

Maybe this news will make you feel a little better.

Title: Spammers have hijacked two of my email addresses
Post by: sandbox on November 13, 2008, 12:10:30 AM

topic #1 How to build a police state.

If you don't have an enemy or criminal you don't need an army or police force.

They knew where the McColo spammers were operating but choose not to interfere.

Justification: we got them where we want them? horsefeathers.

There are many who benefit from spammers including anti-spam companies and expanding government agencies.

Claiming that the laws governing spam and porn stopped them from doing their jobs was a reach and reason to create new laws and extend more power to agencies who exercise selective enforcement.

Let the criminals run amuck waiting for public outcry and Mother Against Spam Spawning M_A.S.S. to rise up from under the piles of spam with their cyber-army, robocops and new legislation to bust anyone spamming without a license. Now if you get spam from a sanctioned criminal it's OK, like some pharmaceutical company or non-profit, or or or the lord of the pings....from their crystal_meth_cathedrals .....what's a mother to do?

If I send an email it can be traced, if I get an email it can be traced. They can trace and prosecute spammers if they choose to, and they do, selectively.

Title: Spammers have hijacked two of my email addresses
Post by: chriskleeman on January 03, 2009, 11:23:34 AM

An update to this situation:

Postini will not let me block my own addresses. VTel Internet's answer (my ISP) was to change my password. Did that, didn't help, now I'm getting some of the same stuff with another header sometimes, "Re-password change"... with the same crap in the message body... go figure, something is pretty weird here...

So, I'm going to bite the bullet some time in the next couple of weeks and get rid of both addresses and change them.

In the meantime, I've begun asking those who send out open addresses on their emails to either "bcc" me or not send at all.

Chris K

Title: Spammers have hijacked two of my email addresses
Post by: Xairbusdriver on January 03, 2009, 01:56:01 PM

QUOTE

asking those who send out open addresses on their emails to [...] "bcc" me

To which most of my senders say, "What's 'BCC:'?" or "Why?"

It's a hopeless attempt to educate the 'world,' IMHO. Just trash the old addresses and create some new ones. Or leave the old one 'alive' for a few weeks and respond with an automatic sig that alerts them to use the new one or be out-of-contact forever. The ones who change are the ones who really want to stay in touch. You probably don't really need the others!

Do it sooner than later. Just remember to change the address any place you may have used it for any kind of "registration." Probably best to create an alias address explicitly for those kinds of situations, anyway.

Title: Spammers have hijacked two of my email addresses
Post by: chriskleeman on January 03, 2009, 04:47:43 PM

QUOTE(Xairbusdriver @ Jan 3 2009, 02:56 PM) <{POST_SNAPBACK}>

QUOTE

asking those who send out open addresses on their emails to [...] "bcc" me

To which most of my senders say, "What's 'BCC:'?" or "Why?"

It's a hopeless attempt to educate the 'world,' IMHO. Do it sooner than later. Just remember to change the address any place you may have used it for any kind of "registration." Probably best to create an alias address explicitly for those kinds of situations, anyway.

That's precisely why I am waiting for a chunk of time to do this... I'm already compiling a list of places where that address is registered, because that's the real pain in the rear end, making sure you don't forget to change those places, especially if you're signed up for some kind of "e-statement"!!!

Oops, Amex, sorry I changed my email address and forgot about my statement.... can you forgive those late charges please???

CK

And, oddly enough, no spam from those two addresses for 36 hours for some reason. Maybe there's a rotten piece of fruit at my ISP???

And the amount of spam in my spam filter is about 75% reduced over the last few days, maybe just blind luck!

Title: Spammers have hijacked two of my email addresses
Post by: Xairbusdriver on January 03, 2009, 05:04:59 PM

QUOTE

maybe just blind luck!

More likely just SPAMmers out spending the Christmas money!

Or, setting up new computers.

Techsurvivors

Archives => 2009 => Topic started by: chriskleeman on November 09, 2008, 09:58:54 AM