Spammers have hijacked two of my email addresses

[chriskleeman]

So,

I know we've dealt with some of this in previous threads, but any current strategies to combat this would be much appreciated.

I've got two email addresses that seem to be pretty well  compromised. I can't get my spam program to block them, because the mail look like it's actually coming from two of my valid email addresses. So it's like I'm sending myself these messages.

From what I can tell, the only thing I can do is to change/disable these two addresses. Which will be a real pain, because one of them is my main address that I use for just about everything.

TIA,

Chris K

[Xairbusdriver]

What anti-SPAM program are you using?

[kimmer]

Are you sure someone has hijacked your addy's? Isn't there a PC virus that does this stuff? I know I've received mail supposedly from myself (and all the headers traced right back to me) and it was always a piece of virus junk from a PC pal not smart enough to be running virus software.

Well, that's the end of my tips. I'm totally clueless about all this stuff. I'm so old school. I'm lost these days. *sigh* And this isn't helping you one bit. Maybe I should go make pancakes and drown them in Maple Syrup. I'd at least feel happy.

[Paddy]

I agree with kimmer, Chris - it's probably someone who has you in their address book or somewhere in their inbox and they have a virus which is sending out mail with forged headers. Send me the complete header and I'll run it through SpamCop for you and figure out where it's really from, if it's not apparent on first look. I think it's very unlikely that someone actually has gotten into your main account, and if they had, you could simply change the password and shut 'em down, assuming your ISP requires authentication to send mail (mine does).

[chriskleeman]

The program is called Postini.

Recently, the volume of these emails has picked up quite a bit. And they always say:

QUOTE

About this mailing:
You are receiving this e-mail because you subscribed to MSN Featured Offers. Microsoft respects your privacy. If you do not wish to receive this MSN Featured Offers e-mail, please click the "Unsubscribe" link below. This will not unsubscribe you from e-mail communications from third-party advertisers that may appear in MSN Feature Offers. This shall not constitute an offer by MSN. MSN shall not be responsible or liable for the advertisers' content nor any of the goods or service advertised. Prices and item availability subject to change without notice.

?2008 Microsoft | Unsubscribe | More Newsletters | Privacy

Microsoft Corporation, One Microsoft Way, Redmond, WA 98052

I can't shut them off because I can't block my own email addy... that's the problem.  

And they're coming in with two of my addresses.

CK

P.S. Whoops! Paddy, you posted as I was writing this... I'll send you the header right now. Thanks.

[Paddy]

From looking at the headers, I'd say that it's not a case of hijacking, but a case of forged headers. According to SpamCop, the email is originating at a Gmail addy with a Gambian IP. The return path for the email is in icqmail.com email address, with some similarity to Chris' real email address. I have no idea if it's got anything to do with this or not, or whether it too is forged.

Chris, you can block IP numbers with Postini? If so, check the headers of a few of the spam emails you've received and see if they're coming from the same IP.

[sandbox]

It's a simple thing to just add a return address in the header to anyone including the receiver. You need to look at the map of IP addresses and stop it at the transfer from their server to you.

[Paddy]

SB, does Postini allow one to block by IP source? I don't have it, so can't advise there.

One thing I just discovered - in Mail, you can add Header criteria, and then use them to filter your mail. So you can add "received" and then add the "from source ([212.60.73.48])" as the criteria in the rules. That will work if much of the spam is coming from the same IP. Of course, that's simply dealing with it once it lands in your inbox - if Postini can keep it out, which I would think it should if the spammers have been using a consistent IP, then that's far better.

You could also add "return path" as one of the header criteria - again, if they're consistently using that ICQ email addy that doesn't in fact belong to you.

[Thomas S. England]

I recently signed up with AIM because I needed to get a screen name to use while iChatting. Since then my spam has increased dramatically, with many of them from aim.com addresses.

I'm also getting a bunch which list my email address as the "From" address. Here are the internet headers from one of those:

Return-Path: <someone@someplace.com>
X-Original-To: someoneelse@someplace.com
Delivered-To: aperson?@dogbark.net
Received: from mx02-01.sublimemail.com (mx02-01.sublimemail.com [208.65.30.86])
   by atree.dogbark.com (Postfix) with ESMTP id D3BB312C2F2
   for <someoneelse@someplace.com>; Mon, 10 Nov 2008 08:13:47 -0600 (CST)
Received: by mx02-01.sublimemail.com (Postfix, from userid 777)
   id 7E25D49B65E; Mon, 10 Nov 2008 08:13:16 -0600 (CST)
Received: from homeuser77.43.161.184.ccl.perm.ru (homeuser77.43.161.184.ccl.perm.ru [77.43.161.184])
   by mx02-01.sublimemail.com (Postfix) with SMTP id BC2FB49B647
   for <someoneelse@someplace.com>; Mon, 10 Nov 2008 08:12:51 -0600 (CST)
X-Originating-IP: [83.6.15.1]
X-Originating-Email: [someoneelse@someplace.com]
X-Sender: someoneelse@someplace.com
To: <someoneelse@someplace.com>
Subject:RE:  Doctor Q&A  Colby Hawkins
From:<someoneelse@someplace.com>
MIME-Version: 1.0
Content-Type: text/html
Message-Id: <20081110141254.BC2FB49B647@mx02-01.sublimemail.com>
Date: Mon, 10 Nov 2008 08:12:51 -0600 (CST)
X-Filtered-By: SublimeMail (http://sublimemail.com)

[Jack W]

Hey Tom,

You have a bunch of valid email addresses in that last post.

You may want to consider masking them.

- Jack

[kimmer]

I changed all the email addys. Not sure if any of the IP numbers needed to be weeded out as well.

--Kim

[Paddy]

IPs are fine - they're either internal ones or they belong to the spammer, who is using a Russian IP at the moment. Looks exactly like the crap that Chris is getting, btw.

[sandbox]

Paddy I don't use whatever it was you mentioned.

if you don't send email to yourself just block email coming from yourself, I do.
Go to the server and block your own address. done

as far as IP blocking goes i trust my server.

Somewhere in the list you'll see your server receiving something from some other server like this below.

Received: from joeblow.isp.att.net ([217.145.11.00]:50201)
   by myserver.asmallorange.com with esmtp (Exim 2.34)
   (envelope-from <someone@bellsouth.net>)
   id 1TpYXQ-1234vk-Re
   for me@athome.com; Mon, 10 Nov 2008 09:00:31 -0500

The ([217.145.11.00.]:50201)  or anything with a ([---[) coming to my server is a real IP address

I block either the IP or the whole range of or the IP depending on the moon, stars and how I feel about Poland that day.

In Thomas's case I could block the single IP 208.65.30.86 or
NetRange:   208.65.28.0-208.65.31.255 or
CIDR:       208.65.28.0/22

It's a judgment call. if I'm getting a lot of spam from a country I block the whole country Until spamassasin catches up or the illegal activity is stopped by others. You can always go back and remove the blocks. Just look at your logs to see if your getting a lot of activity from an IP and if it stops. Sometimes the countries themselves will stop it because they know we will block them from access.  I don't do business in Russia so I could block it without a a care, or any place for the matter.

[chriskleeman]

Well, the IP addresses I've been seeing are all over the place. I have narrowed one source down to a single IP, but there seems to be no rhyme or reason unless I'm not looking in the right spot.

Here's one of them, and I've substituted <myemailaddress@somewhere.net> in those places where the valid email address shows up. And I've removed the domain name in the Return-Path, but it belongs to an private IP provider, clarity.net

From - Sun Nov  9 11:23:43 2008
X-Account-Key: account3
X-UIDL: "%,!!(c7"!4RN"!jG?"!
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:                                                                                
Return-Path: <kleeman@somewhere.net>
Received: from psmtp.com (exprod7mx230.postini.com [64.18.2.183])
   by yoda.vermontel.net (8.13.8/8.13. with SMTP id mA9GCGSD090676
   for <myemailaddress@somewhere.net>; Sun, 9 Nov 2008 11:12:17 -0500 (EST)
   (envelope-from kleeman@clarity.net)
Date: Sun, 9 Nov 2008 11:12:16 -0500 (EST)
Message-Id: <200811091612.mA9GCGSD090676@yoda.vermontel.net>
Received: from source ([93.120.176.55]) by exprod7mx230.postini.com ([64.18.6.14]) with SMTP;
   Sun, 09 Nov 2008 08:11:10 PST
X-Originating-IP: [729.6.48.3]
X-Originating-Email: [myemailaddress@somewhere.net]
X-Sender: myemailaddress@somewhere.net
To: <myemailaddress@somewhere.net>
Subject: RE: zr.Doctor Harlan
From: <myemailaddress@somewhere.net>
MIME-Version: 1.0
Importance: High
Content-Type: text/html
X-pstn-levels:     (S: 0.00000/86.03780 CV:99.9999 R:95.9108 P:95.9108 M:95.5423 C:98.6951 )
X-pstn-settings: 2 (0.5000:0.5000) s cv gt3 gt2 gt1 r p m c
X-pstn-addresses: from <myemailaddress@somewhere.net> forward (user good) [3996/158]
X-UIDL: "%,!!(c7"!4RN"!jG?"!

[RHPConsult]

I'm really over my head, here, too, Kimmer.

However, if I can add a current puzzle along the same lines, here it is. (If I should post this separately, please so inform me)

• • •

I also have several e-addresses. My principal one is on Earthlink. (I've kept it because it seems too big a job to tell everyone in my address book to switch)

The other day one of my favorite correspondents (also a Mac-ster, also using MAIL, also on Earthlink) presumably sent me a message that, henceforth, I needed to be pre-approved (once) in order to have my mail get into his mailbox. And, of course, click here to begin the process. You betcha!

The jerk sending this was too smart by half. My pal is on vacation and has been sending me photos and messages from his MB Pro from various hotels around the West. So, the "warning" made no sense.

He'll be home by tomorrow and will be talking to Earthlink (lotsa luck).

Any idea how this happened, what he might do to hose it? I am, to date, the only one of his correspondents so "infected", "afflicted", whatever!