Feh - some spammer is annoying me

Life, the universe, and everything.
Forum rules
- No personal attacks against players or staff members - please be civil!
- No posting of mature images/links, keep content SFW. If it's NSFW, don't post it on these forums.
Corth
Sojourner
Posts: 6002
Joined: Sat Jan 27, 2001 6:01 am
Location: NY, USA

Feh - some spammer is annoying me

Postby Corth » Tue Nov 16, 2010 3:50 pm

Some spammer is sending out hundreds of emails purportedly from my gmail account. He is not actually logging into my account. Just sending emails that show the "from" address as mine. So consequentially I get a bunch of automatic replies etc which are clogging up my inbox. Anyone have any ideas on how to address this? I prefer not to switch email addresses but it's starting to get annoying.
Having said all that, the situation has been handled, so this thread is pretty much at an end. -Kossuth

Goddamned slippery mage.
Sarvis
Sojourner
Posts: 6369
Joined: Fri Jan 26, 2001 6:01 am
Location: Buffalo, NY, USA
Contact:

Re: Feh - some spammer is annoying me

Postby Sarvis » Tue Nov 16, 2010 4:14 pm

Corth wrote:Some spammer is sending out hundreds of emails purportedly from my gmail account. He is not actually logging into my account. Just sending emails that show the "from" address as mine. So consequentially I get a bunch of automatic replies etc which are clogging up my inbox. Anyone have any ideas on how to address this? I prefer not to switch email addresses but it's starting to get annoying.


Wait for the Invisible Hand of the Free Market to make spamming unprofitable? ;)

Seriously though are you sure he's not logging into your account? I'd be mildly surprised (really, just mildly) to find out Google allowed relaying from an email address without authentication. Have you tried just saving your password?
<a href="http://www.code-haven.com">Code Haven</a> - For all your programming needs.

I detest what you write, but I would give my life to make it possible for you to continue to write. - Some Guy Who Paraphrased Voltaire
Corth
Sojourner
Posts: 6002
Joined: Sat Jan 27, 2001 6:01 am
Location: NY, USA

Re: Feh - some spammer is annoying me

Postby Corth » Tue Nov 16, 2010 4:49 pm

None of the spam emails are showing up in my 'sent messages' folder. That is the basis for my belief he isn't logging into my account. I will change the password to see if that works but I really doubt it. Besides, wouldn't he have changed my password already if he actually had it?
Having said all that, the situation has been handled, so this thread is pretty much at an end. -Kossuth



Goddamned slippery mage.
Sarvis
Sojourner
Posts: 6369
Joined: Fri Jan 26, 2001 6:01 am
Location: Buffalo, NY, USA
Contact:

Re: Feh - some spammer is annoying me

Postby Sarvis » Tue Nov 16, 2010 5:01 pm

Corth wrote:None of the spam emails are showing up in my 'sent messages' folder. That is the basis for my belief he isn't logging into my account. I will change the password to see if that works but I really doubt it. Besides, wouldn't he have changed my password already if he actually had it?


He probably wouldn't change your password. That would result in a notification to you, and you taking steps to get your password changed back and such. He can likely email longer off an account, especially if it's an inactive/dummy account, by not calling that attention to himself.

You may be right though since things aren't showing up in your sent folder...

If he's relaying off some other server and just plugging in your email, there may not be anything you can do.
<a href="http://www.code-haven.com">Code Haven</a> - For all your programming needs.

I detest what you write, but I would give my life to make it possible for you to continue to write. - Some Guy Who Paraphrased Voltaire
Vikaz
Sojourner
Posts: 92
Joined: Mon Feb 10, 2003 4:22 am
Contact:

Re: Feh - some spammer is annoying me

Postby Vikaz » Tue Nov 16, 2010 5:28 pm

Forging email headers is trivial. He's probably using his own mail server to send out the spam. At most what you can do is search the email headers and file a complaint against the ISP the mail server is hosted on.
V
Corth
Sojourner
Posts: 6002
Joined: Sat Jan 27, 2001 6:01 am
Location: NY, USA

Re: Feh - some spammer is annoying me

Postby Corth » Tue Nov 16, 2010 5:47 pm

The following information was in the 'received from' line on one of the emails that was bounced back to me:

Received: from unknown (HELO 148.67.95-108.samtel.ru) (95.67.148.108)

Any idea how I can get ISP information from that?
Having said all that, the situation has been handled, so this thread is pretty much at an end. -Kossuth



Goddamned slippery mage.
Corth
Sojourner
Posts: 6002
Joined: Sat Jan 27, 2001 6:01 am
Location: NY, USA

Re: Feh - some spammer is annoying me

Postby Corth » Tue Nov 16, 2010 6:01 pm

Actually the isp is probably samtel.ru

and there doesn't seem to be an easy way to make a complaint to them. damn.
Having said all that, the situation has been handled, so this thread is pretty much at an end. -Kossuth



Goddamned slippery mage.
Vikaz
Sojourner
Posts: 92
Joined: Mon Feb 10, 2003 4:22 am
Contact:

Re: Feh - some spammer is annoying me

Postby Vikaz » Tue Nov 16, 2010 6:35 pm

$ whois samtel.ru
% By submitting a query to RIPN's Whois Service
% you agree to abide by the following terms of use:
% http://www.ripn.net/about/servpol.html#3.2 (in Russian)
% http://www.ripn.net/about/en/servpol.html#3.2 (in English).

domain: SAMTEL.RU
nserver: ns.samara.net.
nserver: ns1.samtel.ru. 62.213.0.12
nserver: ns2.samtel.ru. 62.213.2.1
state: REGISTERED, DELEGATED, VERIFIED
org: Samara technial electrical communication center
phone: +7 846 2638520
fax-no: +7 846 2637235
e-mail: hostmaster@samtel.ru
registrar: RUCENTER-REG-RIPN
created: 1998.02.03
paid-till: 2011.03.01
source: TCI

Last updated on 2010.11.16 21:30:46 MSK/MSD
V
Teflor Lyorian
Sojourner
Posts: 1273
Joined: Sat Oct 30, 2010 9:39 pm

Re: Feh - some spammer is annoying me

Postby Teflor Lyorian » Tue Nov 16, 2010 8:45 pm

Sarvis wrote:
Corth wrote:Some spammer is sending out hundreds of emails purportedly from my gmail account. He is not actually logging into my account. Just sending emails that show the "from" address as mine. So consequentially I get a bunch of automatic replies etc which are clogging up my inbox. Anyone have any ideas on how to address this? I prefer not to switch email addresses but it's starting to get annoying.


Wait for the Invisible Hand of the Free Market to make spamming unprofitable? ;)

Seriously though are you sure he's not logging into your account? I'd be mildly surprised (really, just mildly) to find out Google allowed relaying from an email address without authentication. Have you tried just saving your password?

The "from" field in e-mails is determined by whoever sends it. E-mails can be sent with your e-mail address in the from field by anybody at any time. There is no identity verification, authentication, or protection from this, except for e-mail providers or e-mail recipients to check the "from" address against the servers that handed off the e-mail (assuming the source and the route the e-mail took roughly matches who the e-mail claims to be from).

E-mail is an open, fully abusable system that shouldn't be used for anything you'd actually rely upon.
"You see, the devil haunts a hungry man.
If you don’t wanna join him, you got to beat him."
- Kris Kristofferson (To Beat the Devil)
Corth
Sojourner
Posts: 6002
Joined: Sat Jan 27, 2001 6:01 am
Location: NY, USA

Re: Feh - some spammer is annoying me

Postby Corth » Tue Nov 16, 2010 8:56 pm

Sent an email to Samtel's hostmaster email address. I'm thinking Sarvis goes Libertarian before this ISP actually does anything to help me. Sound about right?
Having said all that, the situation has been handled, so this thread is pretty much at an end. -Kossuth



Goddamned slippery mage.
Teflor Lyorian
Sojourner
Posts: 1273
Joined: Sat Oct 30, 2010 9:39 pm

Re: Feh - some spammer is annoying me

Postby Teflor Lyorian » Tue Nov 16, 2010 8:59 pm

They might help you. Many Russian organizations and corporations practice good faith in participating on the internet. The trouble there is with lax law enforcement and an attitude that it should be our problem because we have all the money.
"You see, the devil haunts a hungry man.
If you don’t wanna join him, you got to beat him."
- Kris Kristofferson (To Beat the Devil)
Sarvis
Sojourner
Posts: 6369
Joined: Fri Jan 26, 2001 6:01 am
Location: Buffalo, NY, USA
Contact:

Re: Feh - some spammer is annoying me

Postby Sarvis » Tue Nov 16, 2010 8:59 pm

Tell you what, if the Invisible Hand actually does anything about your problem I'll consider it. :P
<a href="http://www.code-haven.com">Code Haven</a> - For all your programming needs.

I detest what you write, but I would give my life to make it possible for you to continue to write. - Some Guy Who Paraphrased Voltaire
Teflor Lyorian
Sojourner
Posts: 1273
Joined: Sat Oct 30, 2010 9:39 pm

Re: Feh - some spammer is annoying me

Postby Teflor Lyorian » Tue Nov 16, 2010 9:00 pm

By the way, you could advise those being targeted by the spam that they could potentially block e-mails from those russian sites, and that should take care of it as well.
"You see, the devil haunts a hungry man.
If you don’t wanna join him, you got to beat him."
- Kris Kristofferson (To Beat the Devil)
Teflor Lyorian
Sojourner
Posts: 1273
Joined: Sat Oct 30, 2010 9:39 pm

Re: Feh - some spammer is annoying me

Postby Teflor Lyorian » Tue Nov 16, 2010 9:01 pm

Sarvis wrote:Tell you what, if the Invisible Hand actually does anything about your problem I'll consider it. :P

They have. It's called any other secure communication protocol.
"You see, the devil haunts a hungry man.
If you don’t wanna join him, you got to beat him."
- Kris Kristofferson (To Beat the Devil)
Sarvis
Sojourner
Posts: 6369
Joined: Fri Jan 26, 2001 6:01 am
Location: Buffalo, NY, USA
Contact:

Re: Feh - some spammer is annoying me

Postby Sarvis » Tue Nov 16, 2010 9:32 pm

Oh Teffie... we're not supposed to fight here remember? And here you are trying to troll me when I'm just joking around with Corth. Tsk tsk.
<a href="http://www.code-haven.com">Code Haven</a> - For all your programming needs.

I detest what you write, but I would give my life to make it possible for you to continue to write. - Some Guy Who Paraphrased Voltaire
Teflor Lyorian
Sojourner
Posts: 1273
Joined: Sat Oct 30, 2010 9:39 pm

Re: Feh - some spammer is annoying me

Postby Teflor Lyorian » Tue Nov 16, 2010 9:51 pm

Sarvis wrote:Oh Teffie... we're not supposed to fight here remember? And here you are trying to troll me when I'm just joking around with Corth. Tsk tsk.

wth are you going on about?
"You see, the devil haunts a hungry man.
If you don’t wanna join him, you got to beat him."
- Kris Kristofferson (To Beat the Devil)
Khalil
Sojourner
Posts: 9
Joined: Sat Nov 10, 2001 6:01 am

Re: Feh - some spammer is annoying me

Postby Khalil » Wed Nov 17, 2010 3:22 am

I dont really have an answer to your problem Corth, I just wanted to let you know that im kind of upset im not being spammed by your account....almost feel left out, like how I used to get left out of all the good groups.....sniff....
Corth
Sojourner
Posts: 6002
Joined: Sat Jan 27, 2001 6:01 am
Location: NY, USA

Re: Feh - some spammer is annoying me

Postby Corth » Wed Nov 17, 2010 3:44 am

Khalil wrote:I dont really have an answer to your problem Corth, I just wanted to let you know that im kind of upset im not being spammed by your account....almost feel left out, like how I used to get left out of all the good groups.....sniff....


I'm sorry you feel that way Khalil. If it makes you feel any better I can post some of the spam for you right here!

---------- Forwarded message ----------
From: "Mae Hogan" <XXXXXXXX@gmail.com>
To: "<"<info@argentinaglobalrent.com>
Date: Tue, 16 Nov 2010 12:01:45 -0300
Subject: t FOR YOUR HEALTH upvtak
http://www.klaus-wieprecht.de/xZkqc27XRA.html


























k lkavj v

qjysrvjcfeo wwaqn

ezpgdl ljbf

lkjudejlw w

ehfwxb adca

ggugxzwp tp

hdvdbkyf beuto
Having said all that, the situation has been handled, so this thread is pretty much at an end. -Kossuth



Goddamned slippery mage.
Corth
Sojourner
Posts: 6002
Joined: Sat Jan 27, 2001 6:01 am
Location: NY, USA

Re: Feh - some spammer is annoying me

Postby Corth » Wed Nov 17, 2010 3:47 am

So here is something else I can't figure out. Why use someone's existing email address? Why not just make something up entirely? The only thing I can think of is that maybe there is some anti-spam software that takes into account the 'reputation' of the email address that sent a particular message. Thus spammers would have an incentive to spoof real email addresses that are known to be legitimate. Anyone have any ideas or can confirm/reject this theory?
Having said all that, the situation has been handled, so this thread is pretty much at an end. -Kossuth



Goddamned slippery mage.
Teflor Lyorian
Sojourner
Posts: 1273
Joined: Sat Oct 30, 2010 9:39 pm

Re: Feh - some spammer is annoying me

Postby Teflor Lyorian » Wed Nov 17, 2010 2:07 pm

Why not use existing e-mail addresses? They're much less likely to be blocked.
"You see, the devil haunts a hungry man.
If you don’t wanna join him, you got to beat him."
- Kris Kristofferson (To Beat the Devil)
Corth
Sojourner
Posts: 6002
Joined: Sat Jan 27, 2001 6:01 am
Location: NY, USA

Re: Feh - some spammer is annoying me

Postby Corth » Wed Nov 17, 2010 3:42 pm

That's what I'm asking - whether an existing email is less likely to be blocked. So you are confirming that anti-spam programs take into account the 'reputation' of an email address?
Having said all that, the situation has been handled, so this thread is pretty much at an end. -Kossuth



Goddamned slippery mage.
kiryan
Sojourner
Posts: 7275
Joined: Sat Apr 14, 2001 5:01 am
Location: Los Angeles, CA and Flagstaff, AZ
Contact:

Re: Feh - some spammer is annoying me

Postby kiryan » Wed Nov 17, 2010 6:42 pm

I manage email and anti spam for 500k customers. I fight spam on a daily basis. If you want to send me some email headers, I can give you some advice.

What you are getting is known as "backscatter". Its the errors and undeliverables that result from certain spamming techniques. I'm surprised google isn't dropping backscatter, I do (some still slips through). The message you copied looks entirely random other than the link so its probably designed to get past content filters.

There is some sender reputation stuff, but its at the domain level not the user account level and almost exclusively blacklist. I am not aware of any sender reputation stuff that happens at an individual account level as a whitelist on a widescale basis. Every ISP has a private blacklist of addresses that have been spammy in the past. I've got a list of about 500 IPs and email addresses that I just drop.

Some email providers do verify accounts exist before accepting mail purported to be from them and most require the message to originate from the domain they are purportedly from (or use an authenticated account). For example, I won't accept mail from gmail.com unless it comes from gmail or my customer uses his username and password to submit the message as if it came from gmail.

The reason folks spoof a real address is typically for 2 reasons. It adds legitimacy or they've compromised your account (and your ISP's rules reject spoofing using authenitcated accounts). For legitimacy reasons, they would setup a forwarder (email to your account is forwarded/copied to another account) or be phishing (using your business/reputation). The other reason is they've compromised your account and don't care about returns because the payload is in the original message (like a web link usually, less often a directive to email me at my "private" address abc@123.com"). You should verify that there isn't a forwarded configured on your gmail account (and in your mail client, much less likely).

I can't think of a good reason why they would specifically target your account from remote through a non google server. Unless you pissed someone off. More than likely he is actually sending the spam through your computer or through google's servers with your username and password (either actively he knows your password or passively through cached/automated logins/cookies). There would be no record in your sent because they would send it with their own mailer program (either running on your computer, proxied through your computer, or on their computer directly to google's servers).

ISPs are constantly putting in place new anti spam measures and spammers are constantly finding ways around them. If your account is being targetted, then more than likely there is something special about it (like they have compromised your account or password or google has excluded you from certain rules because of their internal reputation for your account). The invisible hand of the market is in there somewhere Sarvis.

I use mxtoolbox.com quite frequently to lookup domains and IPs for blacklist information. They aggregate data from a hundred or so "anti spam" vendors and give you a picutre of the reputation of the source of the spam. I did a lookup on samtel.ru, its listed 3x, but not with any of the major players like spamhaus or barracuda. However both IP addresses listed 95.67.148.108 and 148.67.95-108.samtel.ru. These are both listed with the majors. The Point of Contact for my network is the NY VP, you can guess how much of that email gets addressed if you aren't a subpoena or the policia. Abuse@ goes to a ticketing system checked by a senior manager, unless its an active phishing scam I don't hear about it.
Sarvis
Sojourner
Posts: 6369
Joined: Fri Jan 26, 2001 6:01 am
Location: Buffalo, NY, USA
Contact:

Re: Feh - some spammer is annoying me

Postby Sarvis » Wed Nov 17, 2010 9:16 pm

kiryan wrote:The invisible hand of the market is in there somewhere Sarvis.



Sure, it's giving the spammers plenty of motive to annoy Corth... and spam-protectors plenty of motive to ineffectually combat spam. :P
<a href="http://www.code-haven.com">Code Haven</a> - For all your programming needs.

I detest what you write, but I would give my life to make it possible for you to continue to write. - Some Guy Who Paraphrased Voltaire
Teflor Lyorian
Sojourner
Posts: 1273
Joined: Sat Oct 30, 2010 9:39 pm

Re: Feh - some spammer is annoying me

Postby Teflor Lyorian » Wed Nov 17, 2010 10:02 pm

Corth wrote:That's what I'm asking - whether an existing email is less likely to be blocked. So you are confirming that anti-spam programs take into account the 'reputation' of an email address?

No, generally people don't keep e-mail addresses that get blocked a lot.
"You see, the devil haunts a hungry man.
If you don’t wanna join him, you got to beat him."
- Kris Kristofferson (To Beat the Devil)
Teflor Lyorian
Sojourner
Posts: 1273
Joined: Sat Oct 30, 2010 9:39 pm

Re: Feh - some spammer is annoying me

Postby Teflor Lyorian » Wed Nov 17, 2010 10:15 pm

Generally, anti-spam operates off of black/white lists (pseudo-reputation), pattern recognition, filtering rules. I suppose there may be a product out there that considers the reputation of a single e-mail address, but I doubt this information is generally made available.
"You see, the devil haunts a hungry man.
If you don’t wanna join him, you got to beat him."
- Kris Kristofferson (To Beat the Devil)
Corth
Sojourner
Posts: 6002
Joined: Sat Jan 27, 2001 6:01 am
Location: NY, USA

Re: Feh - some spammer is annoying me

Postby Corth » Thu Nov 18, 2010 6:19 am

Thanks for all the advice guys. Really appreciate it.

Kiryan, I sent you a PM with three full email headers from some of the bounced emails. Most of them, btw, end up in my gmail spam folder. Some in my inbox.

FYI - I changed my google password yesterday and it is still happening today.
Having said all that, the situation has been handled, so this thread is pretty much at an end. -Kossuth



Goddamned slippery mage.
kiryan
Sojourner
Posts: 7275
Joined: Sat Apr 14, 2001 5:01 am
Location: Los Angeles, CA and Flagstaff, AZ
Contact:

Re: Feh - some spammer is annoying me

Postby kiryan » Thu Nov 18, 2010 11:39 pm

You're getting backscatter. It does all appear to be originating in Russia and from the equivalent of residential cable customers so you shouldn't worry about your PC being hacked. It does not appear to be using "authentication" so your account is probably not hacked either.

I'm kind of surprised that google accepts email without validating domain. Mail systems often won't accept email from their domain originating on a 3rd party domain/IP (without authenticated account).

The good news is that I've noticed more antispam vendors blocking the IPs and the content of the messages from your headers... from the beginning of the day to now. You will probably continue to get backscatter for up to 5 more days, probably most within 48 hours after which point it should stop... until they start a new attack... hopefully they'll give you a break.

I can't see any reason to use your specific email address in the first place, especially since they spoof different senders in different emails... The only reason I can think of to do this is to annoy you intentionally. There are other benefits to using your account, but they all really require way too much effort for a spammer, its just not worth their time unless somehow they know thousands of people whitelist you and they email those people.

One interesting thing I learned about while looking at this is google has a "account activity" link in gmail. I'd click it and make sure you don't see yourself logging in from Russia. There is really not much you can do other than setup a rule to move those "failures" and undeliverables to another location.

also you should've gotten two wierd looking emails from me with probably blank To and From. I was testing how google accepts email from remote because I couldn't believe they'd actually let me connect to them and say I was a gmail account. or Google may have dropped them without an error... no sense giving the enemy intel. Let me know if you didn't get any test messages.
Corth
Sojourner
Posts: 6002
Joined: Sat Jan 27, 2001 6:01 am
Location: NY, USA

Re: Feh - some spammer is annoying me

Postby Corth » Fri Nov 19, 2010 3:48 am

Thanks Kiryan. I really appreciate you looking into this for me.

I did receive both of your test messages - gmail put them into my spam folder automatically.

I can't think of any russians I have pissed off lately. And I doubt that I am intentionally whitelisted by many people. I don't have any connection (as far as I know) with any of the people receiving the spammed emails. There must be some reason they are going out of their way to spoof an existing email address. Hell, they could simply make their own gmail address if they really wanted to. I think you may be right about the backscatter subsiding. I haven't received any of it since yesterday. But it's been going on at least a couple of weeks now and at least on one previous occasion they left me alone a day or two, so it remains to be seen. Maybe some Russian spammer holiday or something. :)
Having said all that, the situation has been handled, so this thread is pretty much at an end. -Kossuth



Goddamned slippery mage.

Return to “T2 General Discussion Archive”

Who is online

Users browsing this forum: No registered users and 17 guests