My account is sending spam emails • Hacker News Board

Re: My account is sending spam emails

#11

Post by aquova » Sun, Apr 22, 2018, 5:46 AM UTC

I had some of these earlier today as well. Mine wasn't from telus however, it was from some .science account. I use a password manager and have 2FA enabled, but I quickly switched my password just to make sure. Sure enough, a few hours later I got another one, for about 5 in total. They seemed to have stopped however.

Re: My account is sending spam emails

#12

Post by coleschifer » Sun, Apr 22, 2018, 5:46 AM UTC

Keverw wrote: post #8

I got 2 of these a hour ago. "This may be a spoofed message" Google says, I clicked spam even though it's from myself. It was to me and a bunch of other emails. Wasn't in my sent folder though and no one else has accessed my account. "Sexy Girls Asian Girls Looking for US Men" is the subject and says it's sent from "----------------- via telus.com" Really odd, seems to be some ISP in Canada and I live in the USA... W…

I encountered the same thing, but different adverts.

Re: My account is sending spam emails

#13

Post by SyneRyder » Sun, Apr 22, 2018, 5:48 AM UTC

Another HN thread with more comments about this: https://news.ycombinator.com/item?id=16894593

Re: My account is sending spam emails

#14

Post by jimrandomh » Sun, Apr 22, 2018, 5:49 AM UTC

If you have a suspicious or spoofed email and you want people to analyze what happened, it helps a lot if you include the full headers. To do this in gmail, open the menu and pick "Show Original". Particularly useful are the lines that start with "Received:".

Re: My account is sending spam emails

#15

Post by CivilEngineer » Sun, Apr 22, 2018, 5:50 AM UTC

Operyl wrote: post #10

DEFCON28 wrote: post #7

Earlier quoted context omitted.

Read the thread before you comment! People are reporting these messages are in their sent mail folder! Now it's possible that gmail makes it looks like it was "sent mail" if it receives a message "from you" even if you didn't send it, but it's also possible that google has been hacked in a big way. And some of the people reporting this are knowledgeable people who know what spoofing is, and who have good unique passw…

I did read it before I commented. I just proved what I said below (before you commented). "If I remember correctly, if you are the recipient of an email from "yourself" Google automatically puts it in the sent items label as well." Google threw it in my Sent Items despite me not sending it from gmail itself.

So you read the thread and then edited your statement to make you look like you read it! First class work.

Re: My account is sending spam emails

#16

Post by ninjaranter » Sun, Apr 22, 2018, 5:59 AM UTC

I had the same thing in my account (same relay through Telus). Here're my headers

  Delivered-To: 
  Received: by 10.74.77.209 with SMTP id p78csp1252253ood;
          Sat, 21 Apr 2018 19:48:30 -0700 (PDT)
  X-Google-Smtp-Source: AB8JxZrx9G5VDRbvtvoQWl5sUYm3w7k1TQ5f+Sd3g74T+fFLkrWnEV7qhVmFTr7X0pBQCd5q+my5
  X-Received: by 2002:a6b:6f01:: with SMTP id k1-v6mr16819882ioc.221.1524365310928;
          Sat, 21 Apr 2018 19:48:30 -0700 (PDT)
  ARC-Seal: i=1; a=rsa-sha256; t=1524365310; cv=none;
          d=google.com; s=arc-20160816;
          b=Ry11M99U7ldzJoPvejp48dePTM/MlHI4xQTc2jrwZR3CeugDTEfUpA783hpLnaw0gg
           NCsTVBtObV1GYioVRQDSxWAczHFiPQGld0u5afD+xpb2eGpr7/eZxTwvJPHYpl/FLwNk
           pNXj3w7VObPIyj43K4Zkf9rgNF1TRCYx4RbRvesaBcHMADJS1vDRB5TAsJ8DV6dF7gOB
           +O59qvWZzg0nE265rBJ1b8fWXWuQb4KpdVdwolZ3T3fqFDGY2cHnsmZMWTRzcjsLFWuD
           86+fIW1ccWf1eIjNh3LvecY6B0zzW9LjfgQw+0IvrkEdbwDc1EAbNhWI6kilOPIsDJGD
           Lzng==
  ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
          h=date:message-id:subject:to:from:arc-authentication-results;
          bh=4oe6QhhObsHLHbjLfsZs16iUEYy2rMdtn0ju3umolqQ=;
          b=FoRwZqhc5F7H6pItUYqZ2y/OxsZQkWNDEhj4Ody6uJ1vaC3DzUbXqa4mw1Pb0AgfZe
           QaBcfWaloNJJXBBWIjERShMCo3wYb/wcXtdOlT4x3o7uhAxQJ5sGBQqnVQ4QfH/d9pIh
           DaqTXWcaEieX3tsVDXO8UtZviUTsA7FjO2YGkk/f4rj1K9VOkxqiyECGyQf1uDAI/55d
           7O1t76oCpYr/qyAAx2YGBnz87ShD4bORPOg8iHwb9f4zAq7tfwOoF/Z3blPFR8EA2Xam
           q9x+2OIRsA2oX+t/HNsdrYOkWPkYwhiHwptl0vQZDHZn3E4Uue8DofG5sRLoAFM1rVYJ
           e5RA==
  ARC-Authentication-Results: i=1; mx.google.com;
         spf=pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) smtp.mailfrom=Reply@telus.com;
         dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
  Return-Path: 
  Received: from shop.eseonew.com (static-ip-69-64-35-11.inaddr.ip-pool.com. [69.64.35.11])
          by mx.google.com with ESMTP id v64-v6si7872516iof.146.2018.04.21.19.48.30
          for >;
          Sat, 21 Apr 2018 19:48:30 -0700 (PDT)
  Received-SPF: pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) client-ip=69.64.35.11;
  Authentication-Results: mx.google.com;
         spf=pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) smtp.mailfrom=Reply@telus.com;
         dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
  Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. )
          by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14
          for >;
          Fri, 20 Apr 2018 00:37:14 -0700 (PDT)
  Received-SPF: softfail (google.com: domain of transitioning nkhpw@google.com does not designate 69.64.35.11 as permitted sender) client-ip=13.58.85.245;
  from: ABC Shark Tank >
  To: , , , , , , , , 
  Subject: Exclusive Limited Time Online Offer Shark Tank Success Story
  Message-ID: 
  Content-Type: multipart/report; boundary="f4f5e80f07d80f991b056a2936a0"; report-type=delivery-status
  X-EMMAIL: >
  Date: Sat, 21 Apr 2018 22:48:30 -0400  

  --f4f5e80f07d80f991b056a2936a0

Re: My account is sending spam emails

#17

Post by lukeholder » Sun, Apr 22, 2018, 6:01 AM UTC

My father and I have been getting these all evening.

Re: My account is sending spam emails

#18

Post by mediocrejoker » Sun, Apr 22, 2018, 6:08 AM UTC

I had the same thing happen today. At least 6-8 emails in my inbox over the course of an hour or two, from my email address. Mostly ads for "dating" sites with photos of scantily-clad women. The to list includes my address, as well as about 8-10 other addresses, including one at rei.com and another at nih.gov.

Mine are showing Telus in the relay as well. None show up in the sent folder, and I use 2FA on the account.

Re: My account is sending spam emails

#19

Post by foota » Sun, Apr 22, 2018, 6:12 AM UTC

FuckOffNeemo wrote: post #6

My house mate has had the same issue today on both of his Google accounts. He is both the sender and recipient and there were several other nonsensical email addresses being CC'd in. SMTP headers show the emails are relayed from Telus. I'll provide the SMTP headers when I get home. = = = No unauthorised attempts to log in from third party sources, seperate passwords and MFA on both services. It doesn't seem to me tha…

What do the DKIM and SPF checks say?

Re: My account is sending spam emails

#20

Post by jeroenheijmans » Sun, Apr 22, 2018, 6:12 AM UTC

Perhaps it's a browser extension/plugin that got hacked?