Welcome to the MacNN Forums.

Powerbook · Jan 8, 2009, 12:02 PM

These idiots keep sending me Chinese iPod-ripoff advertising in the size of megabytes each mail (Excel attachments etc.)!!! And they do so using a real Google gMail account (dumb).

This is going on for a year, I have contacted Google the third time to notify them of spam and to shut down this account! I am not with google, but I left my own e-address. No answer, no change.

Do I really have to take this?

PB.

turtle777 · Jan 8, 2009, 12:09 PM

Stop resisting, China is the future

Other than a server sided spam filter, there is not a lot you can do to reduce the bandwidth of downloading this crap in the first place.

What's your email account with ?
Can you access your mail server via SSH and edit procmail, or set up Spam Assassin ?

-t

Powerbook · Jan 8, 2009, 12:40 PM

Originally Posted by turtle777

Stop resisting, China is the future

Other than a server sided spam filter, there is not a lot you can do to reduce the bandwidth of downloading this crap in the first place.

What's your email account with ?
Can you access your mail server via SSH and edit procmail, or set up Spam Assassin ?

-t

I'm with macnews.de
I don't think they allow any special access or adding own programmes.

Why would I have to take this? Google is an American company under American laws. If I can't reach that Chinese bastard company, I get to the provider. (By the way, I'm sure the gmail general terms prohibit the misuse of their service.)

Regards
PB.

MacNNUK · Jan 8, 2009, 12:47 PM

Why not just set up a rule in Mail, and return / delete these messages ?

With a copy to Google

B Gallagher · Jan 8, 2009, 05:32 PM

Yeah, what MacNNUK said, or even set it up within your server end mail too. Is it all coming from the same email?

besson3c · Jan 8, 2009, 08:38 PM

Have you looked at the full headers of one of these messages to determine that the envelope address is indeed a Google address and you are not just taking the user defined headers at face value? Is the envelope address information the same each time? If so, you could email abuse and postmaster, and let them know that this is actually coming from their network and not just backscatter or something. Be sure tio include the full headers, or else your email to them is pretty much worthless.

Other than that, like Turtle said, you need a sieve/procmail rule on the server to deal with this...

Powerbook · Jan 9, 2009, 07:01 AM

Originally Posted by MacNNUK

Why not just set up a rule in Mail, and return / delete these messages ?
With a copy to Google

I read my mail on different systems/computers + webmailer so a rule in one program is maybe not the way to go...
Point is, I report each spam (virtual and paper) to the would-be contact persons. Had some nice successes over the years and get hardly more than 3 to 4 spam mails a month now. This Chinese bitch is a special case, still I intend to shut it up, rather then just duck away (all people should do that, we take too much crap anyway).

Is there any real google address for misuse to send to???

PB.

Powerbook · 08:46 AM

You folks tell me what you think (mail obfuscation by me):

--
X-Spam-Status: No, hits=1.6 required=5.0
X-Spam-Level: x
Delivered-To: < _ @ macnews . de>
Return-Path: <[email protected]>
Received: from po-out-1718.google.com ([72.14.252.158] verified)
by macnews.de (CommuniGate Pro SMTP 5.1.16)
with ESMTP id 100264230 for _ @ macnews . de; Mon, 05 Jan 2009 20:26:26 +0100
Received-SPF: pass
receiver=macnews . de; client-ip=72.14.252.158; [email protected]
Received: by po-out-1718.google.com with SMTP id y22so5256735pof.2
for <_ @ macnews . de>; Mon, 05 Jan 2009 11:25:58 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=domainkey-signature:received:received:message-id:date:from:sender
:subject:in-reply-to:mime-version:content-type:references
:x-google-sender-auth;
bh=gKBBlXWA5z1VsaqB3SvWWMEFCfk4+57r5rz/vpcftaA=;
b=Rmycx62wlXhMKNhybpvkha37IBt8znITzNhPEqQnhV6or3+q/cK4SFBBaDncrtaVZw
loQGi4VUeU6IBpqY1LR/x7AsGhV7pLnK6oGV2rYbvPIi0A4tVJ2+/IPDsR3a4DdkSZdo
mQXQ3I2lVxXeD/5klj4vPv7L7AvI2n0NchIhU=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=gamma;
h=message-id:date:from:sender:subject:in-reply-to:mime-version
:content-type:references:x-google-sender-auth;
b=p5/Mtn4W8asHMQTaUWaNZJ2DwS64iQp6iR6IwnDYa+heyaPrYm0Fh 6Ivkogu2zvZsQ
uU5YaH5sM2NEysO43T7jyVmUz43a1tse7+g/hq4Y+APowKWTWirEpyWWzLu4CBMTSl5q
3fvK08QznAZyZ0ypRI2la+na0KAONuZGO5BMw=
Received: by 10.140.250.14 with SMTP id x14mr10501063rvh.278.1231183548452;
Mon, 05 Jan 2009 11:25:48 -0800 (PST)
Received: by 10.140.174.1 with HTTP; Mon, 5 Jan 2009 11:25:47 -0800 (PST)
Message-ID: <94ef66e0901051125i5f158df2v95228d1029eb2ebb@mail. gmail.com>
Date: Tue, 6 Jan 2009 03:25:47 +0800
From: "Jack Karis" <[email protected]>
Sender: [email protected]
Subject: Please let me introduce mobile products
In-Reply-To: <1426381479.1231183050912.JavaMail.nobody@sg2005-ap-2>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_183166_30965734.1231183548200"
References: <1426381479.1231183050912.JavaMail.nobody@sg2005-ap-2>
X-Google-Sender-Auth: 9662ea23ea6123d8

OreoCookie · Jan 9, 2009, 07:42 AM

Get Spam Assassin, ever since I got it, I haven't seen much spam (unless I look for it in the Trash

)
The $30 you're investing are very well-spent.

TETENAL · Jan 9, 2009, 08:40 AM

Just set up a rule on the mail server to delete it there. That should be simple to do if the spam is always coming from the same address. That way you never see that message again regardless of whether you are using Mail, Webmail or another computer to access your mail. It's not even in the SPAM folder.

I did the same for some very obnoxious and persistant spammer and it works great.

turtle777 · Jan 9, 2009, 10:06 AM

Originally Posted by OreoCookie

Get Spam Assassin, ever since I got it, I haven't seen much spam (unless I look for it in the Trash

)
The $30 you're investing are very well-spent.

Huh ?

Spam Assassin itself is free.

-t

OreoCookie · Jan 9, 2009, 10:16 AM

You're right, Turtle, of course I meant to write Spam Sieve.

besson3c · Jan 9, 2009, 11:53 AM

Originally Posted by Powerbook

You folks tell me what you think (mail obfuscation by me):

--
X-Spam-Status: No, hits=1.6 required=5.0
X-Spam-Level: x

These flags look like SpamAssassin flags. You should find out whether your email host is interested in having its customers help with running spam through sa-learn to help train SpamAssassin as to what is spam or not. Usually they'll have addresses such as [email protected] and [email protected] setup for this sort of thing.

Delivered-To: < _ @ macnews . de>
Return-Path: <[email protected]>
Received: from po-out-1718.google.com ([72.14.252.158] verified)
by macnews.de (CommuniGate Pro SMTP 5.1.16)
with ESMTP id 100264230 for _ @ macnews . de; Mon, 05 Jan 2009 20:26:26 +0100
Received-SPF: pass

This (particularly the return path) show that the messages indeed were sent via Google, specifically po-out-1718.google.com. So, Google is indeed the host you want to work with in taking corrective action against this account.

These headers of course tell us many other things about these emails, but I've highlighted the relevant parts for you...

besson3c · Jan 9, 2009, 03:38 PM

I should say that the spam headers are X-headers, not flags... It is possible that some other milter inserted these, but these are generated by default with SpamAssassin with this wording/syntax, IIRC...

Thorzdad · Jan 9, 2009, 04:35 PM

You should probably work with your ISP to block the spam at their servers. I doubt you're the only one getting them. Most ISPs have very easy spam flagging, usually through a webmail interface.

Powerbook · Jan 10, 2009, 11:54 AM

Originally Posted by besson3c

This (particularly the return path) show that the messages indeed were sent via Google, specifically po-out-1718.google.com. So, Google is indeed the host you want to work with in taking corrective action against this account.

So were my conclusions exactly. Alas no feedback from Google so far. Don't they have any specific mail address for these things, like complaint @ gmail . com etc!?

besson3c · Jan 10, 2009, 02:59 PM

Have you tried abuse@ and postmaster@?

turtle777 · Jan 10, 2009, 03:05 PM

Originally Posted by besson3c

These flags look like SpamAssassin flags.

Indeed. But what's curious about it:

SA always includes

Code:
X-Spam-Checker-Version: Spamassassin 3.x.x

as well. Since this is missing, I'm not so sure it it's a plain vanilla SA.

-t

besson3c · Jan 10, 2009, 03:26 PM

turtle: no it doesn't, not when it is invoked via amavisd, for instance...