Welcome to the MacNN Forums.

Apple Pro Underwear · Jan 18, 2005, 05:31 PM

They spoofed my email and now i got 5,000 returned spam!

how did this happen!

argh! what can i do?

ManOfSteal · Jan 18, 2005, 05:51 PM

Sorry about that, I'll take you back off the list for now.

effgee · Jan 18, 2005, 06:08 PM

Originally posted by Apple Pro Underwear:
... argh! what can i do?

Congratulations - you've been "joe-job'ed". What you can do? Not much, actually ... call your ISP, explain the situation and ask if they can block the bounces at the router (I doubt they'll do this - it's quite the hassle), if you get your mail through your own website and can administer some aspects of your mail server set up filters for all the obvious subject headers ("returned mail", "message undeliverable", etc.), if you don't have any of the options above you're going to have to filter out the crap in your mail app.

That's pretty much all the options you have.

kmkkid · Jan 18, 2005, 06:19 PM

Congrats,

I just recieved an annoying voice ad via my cell for the first time.

Apple Pro Underwear · Jan 18, 2005, 07:58 PM

i am getting 5 bounce backs a second.

SCREW THE CAN SPAM ACT. it's more useless than front teeth to a crack whore!

i turned off my email and used a autoreply that says to email me back 2 days from now...

Sherwin · Jan 18, 2005, 08:13 PM

Hmmm... Don't know if this'd work or not, just guessing.

Any legitimate email bounced back to you must be a reply to something you've sent. Every email you send has got an ID in it showing your machine as the sender.
For example, when someone replies to an email you've sent:

"In-Reply-To: <009101c49f38$ed1ca940$0300a8c0@lovelymac>"

Just bounce any "undeliverable" messages which don't have "In-Reply-To: <*@lovelymac>" in the headers?

Apple Pro Underwear · Jan 18, 2005, 08:18 PM

Originally posted by Sherwin:
Hmmm... Don't know if this'd work or not, just guessing.

Any legitimate email bounced back to you must be a reply to something you've sent. Every email you send has got an ID in it showing your machine as the sender.
For example, when someone replies to an email you've sent:

"In-Reply-To: <009101c49f38$ed1ca940$0300a8c0@lovelymac>"

Just bounce any "undeliverable" messages which don't have "In-Reply-To: <*@lovelymac>" in the headers?

i am bouncing everything via a recipe. i also have a recipe with an auto-reply too saying i will be back in 2 days.

i dont get that many emails a day so i think i should be good.

KeriVit · Jan 18, 2005, 08:18 PM

DANGER! WARNING!

Turn off that Auto-Reply! Speaking from experience- that will make it worse!!!

I was in tears after that!

Apple Pro Underwear · Jan 18, 2005, 08:24 PM

Originally posted by KeriVit:
DANGER! WARNING!

Turn off that Auto-Reply! Speaking from experience- that will make it worse!!!

I was in tears after that!

ok i did that

but now i suppose my friends will think this email is dead

ARGH!

KeriVit · Jan 18, 2005, 08:28 PM

Originally posted by Apple Pro Underwear:
ok i did that

but now i suppose my friends will think this email is dead

ARGH!

Can you send an email to your address book to tell them (or most of em)? Tell them you'll let them know when you get it wrapped up. Anyone not in your address book probably wouldn't send you an urgent email in the next few days....

CharlesS · 08:39 PM

Remember how people on here used to be recommending to use the Bounce to Sender feature on spam e-mails all the time, and going on about how this was supposedly a way to reduce spam?

Example: http://forums.macnn.com/showthread.p...am#post1556856

Well, folks, this is what you really accomplish when you do that.

edit: added a link

Apple Pro Underwear · Jan 18, 2005, 08:33 PM

yup, you bounce back to the unsuspecting spoofed person

i blame the bastards who wrote the CAN SPAM ACT. make us opt in and make monetary punishment.

anyone of you guys can be the next target and since there is no enforcement, you probably will be next!

Sherwin · Jan 18, 2005, 08:34 PM

Originally posted by Apple Pro Underwear:
i am bouncing everything via a recipe. i also have a recipe with an auto-reply too saying i will be back in 2 days.

i dont get that many emails a day so i think i should be good.

OK... I had a look at how easy it would be to do my earlier suggestion in Mail.app (10.2.8). Easy (no idea how easy/hard in 10.3). Just set up a rule:

If All of the following conditions are met:

In-Reply-To: does not contain your host name
Message body: contains undeliverable
Delete message.

Should work.

Apple Pro Underwear · Jan 18, 2005, 08:53 PM

Originally posted by Sherwin:
OK... I had a look at how easy it would be to do my earlier suggestion in Mail.app (10.2.8). Easy (no idea how easy/hard in 10.3). Just set up a rule:

If All of the following conditions are met:

In-Reply-To: does not contain your host name
Message body: contains undeliverable
Delete message.

Should work.

thanks but they do contain my host name and the bounce backs are varied to each and every ISP

since i got close to 8,000 in 4 hours, i think i would still be screwed

it's bouncing everything now but i hope it lasts for a day or so and goes away. if this lasts forever i dont know what to do.

Apple Pro Underwear · Jan 18, 2005, 08:53 PM

Originally posted by KeriVit:
DANGER! WARNING!

Turn off that Auto-Reply! Speaking from experience- that will make it worse!!!

I was in tears after that!

how long did yours last?

PurpleGiant · Jan 18, 2005, 09:11 PM

APU is this your own server, a web host, work or your isp that you get your email via?

KeriVit · Jan 18, 2005, 09:58 PM

Originally posted by Apple Pro Underwear:
how long did yours last?

Honestly- after a few days it died down, but I ended up changing my email anyway. Both of us in the house got fed up even with 50 a day.... sorry. If someone knows a solotuion- please share.

Apple Pro Underwear · Jan 19, 2005, 05:53 AM

Originally posted by PurpleGiant:
APU is this your own server, a web host, work or your isp that you get your email via?

web host

pair.com

i have no idea how they grabbed my name. it must be random because i don't advertise my address

effgee · Jan 19, 2005, 06:30 AM

Jeebus guys, aside from filtering out all the bounces there's nothing you can do to stop this. The bounces are generated automatically by the server who's sending them to you either because the initial spam was recognized as such or because the spammer's mailing list contains lots of old/non-existent addresses (maybe he's using a dictionary tool to generate addresses as well).

You can not stop them - setting your mail app to bounce the bounces is just about the dumbest thing you could do because

a) you generate even more unnecessary traffic
b) in the worst case, if sufficiently pissed because you bounce thousands of bounces back at them, a sysadmin might just add you to their blacklist in which case that'd have been the last time they accept mail from you/your domain.

Just filter 'em out and leave it be.

As to how you got into that mess in the first place - back in the days, joe-jobbing was a common retaliatory measure with which spammers "punished" folks who gave them grief (investigating where the spam came from, having their dial-up/hosting accounts canceled). These days it's just bad luck, nothing else. Happened to me before, yes it sucks but there's nothing you can do about it.

Apple Pro Underwear · Jan 19, 2005, 08:26 AM

Originally posted by effgee:

Just filter 'em out and leave it be.

i am not using a mail client...

i am having my mail forwarded to gmail. having probably 500,000 emails by morning is not a good thing so that is why i am bouncing them all

I AM NOT KIDDING about getting that much, i was literally deleting them and while it refreshed 5 more went into my spam box

EDIT: also in the bounced statement, it says I am having tech difficulties, please email or call me 2 days from now...

effgee · Jan 19, 2005, 09:08 AM

I didn't mean filter 'em out in your mail app - that is only the "desperate alternative". Your site and thus your mail are hosted with pair, right? While I don't know pair's services, you should have access to some kind of "control panel" where you can set certain prefs regarding your web site and email - add users, aliases, password protect directories, etc.

The "control panel" of my hosting service allows me to access a spam filter where I can filter out mail by IP address, subject line, content, etc. If yours offers a similar functionality you might be able to filter the bounces (or the vast majority of them) before they ever get forwarded to your gmail account.

RAILhead · Jan 19, 2005, 09:26 AM

Originally posted by Apple Pro Underwear:
web host

pair.com

i have no idea how they grabbed my name. it must be random because i don't advertise my address

Just email pair and tell them what's gong on -- they can take care of it. And than, drop them like a bad habit and go with media temple.net.

Apple Pro Underwear · Jan 19, 2005, 10:15 AM

Originally posted by effgee:
I didn't mean filter 'em out in your mail app - that is only the "desperate alternative". Your site and thus your mail are hosted with pair, right? While I don't know pair's services, you should have access to some kind of "control panel" where you can set certain prefs regarding your web site and email - add users, aliases, password protect directories, etc.

The "control panel" of my hosting service allows me to access a spam filter where I can filter out mail by IP address, subject line, content, etc. If yours offers a similar functionality you might be able to filter the bounces (or the vast majority of them) before they ever get forwarded to your gmail account.

i can't do that because the thousands of people he sent out spam with under my name all have thousands of different IPs coming back without the origin info

they are often "auto-reply" or mail undeliveravle with no header info.

i will send pair a email but in the past when i alerted them someone was spoofing me they said to spam it out but at that point i was dealing with 2 a day. now it's 200,000!

effgee · Jan 19, 2005, 10:29 AM

Originally posted by Apple Pro Underwear:
i can't do that because the thousands of people he sent out spam with under my name all have thousands of different IPs coming back without the origin info

they are often "auto-reply" or mail undeliveravle with no header info.

i will send pair a email but in the past when i alerted them someone was spoofing me they said to spam it out but at that point i was dealing with 2 a day. now it's 200,000!

They don't allow you to filter mail by subject line/content? Then it's time to go with Rail's recommendation - dump their butt. Pronto.

My condolences.

nerd · Jan 19, 2005, 10:37 AM

I get about 2 bounces a week from my .mac address. Not the 200,000 your talking about.

Brad

Apple Pro Underwear · Jan 19, 2005, 10:44 AM

Originally posted by effgee:
They don't allow you to filter mail by subject line/content? Then it's time to go with Rail's recommendation - dump their butt. Pronto.

My condolences.

they do but for the hundreds of thousands i get, they still vary distinctly from isp to isp to webhost to webhost...

i would be entering 50 plus and still getting thousands. plus i dont have time to do that!

effgee · Jan 19, 2005, 10:59 AM

Originally posted by Apple Pro Underwear:
they do but for the hundreds of thousands i get, they still vary distinctly from isp to isp to webhost to webhost...

i would be entering 50 plus and still getting thousands. plus i dont have time to do that!

Well, I feel for you - happened to me twice before. I understand that it's a pain in the behind to try and filter them (even though you'd probably be fine with about 20 definitions or so) - I'll keep my fingers crossed that no sysadmin gets pouty with you bouncing their bounces.

And of course that it'll all be over soon!

Appleman · Jan 19, 2005, 11:01 AM

Originally posted by KeriVit:
DANGER! WARNING!

Turn off that Auto-Reply! Speaking from experience- that will make it worse!!!

I was in tears after that!

Indeed that is the most stupid thing you can do: it will show you do exist!

I recently are receiving spam, and when using the "Bounce"-button in Apple's Mail.app I always get a return the emailaddress doesn't exist (Mail delivery blah).
So I just add it to the junk filter in Mail.app, and that's it.

It really depends on your ISP though, as my former ISP (UPC - Chello here in The Netherlands) was always LOADED!!! with spam, while Demon (also in UK) does in my opinion a very good job, since I hardly get any mail, though never ever hear from regular contacts their mail doesn't get trough!