Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have been having some issues with my AOL e-mail address (I know, nobody should be using AOL etc. but we have since I was a kid and we fear change). I have received countless mailer daemon notifications of failed delivery of e-mails to addresses in my AOL address book. The problem is that I didn't send the e-mails. Clearly someone has managed to get access to my e-mail address and address book, either by hacking AOL or my computer.

I contacted my ISP a few times but they had little advice to offer.

Now, however, I have received one of these spam e-mails myself at a different e-mail address and have a complete list of server headers. Unfortunately my expertise (if I may call it that) is in web development and not server/sysadmin, so the headers mean very little to me. I will post them below and if anyone can help me unpack it and try to trace this annoying phreaker, I would be most appreciative. I have of course sent these to AOL as well. The message is a link to a site which I have not been silly enough to visit.

Edit: headers removed - comment about giving my address out to the masses was right on the money.

share|improve this question

migrated from serverfault.com Aug 5 '10 at 13:13

This question came from our site for professional system and network administrators.

1  
by posting your email multiple times like that you've just become spambait for about a billion other spambots. congratulations! –  Nick Kavadias Aug 4 '10 at 14:21
    
Problem is that the email address now lives until the end of time in the revision history :) –  Mark Henderson Aug 5 '10 at 0:59

4 Answers 4

Two quick notes. One, it doesn't mean that someone clearly broke into your account. I used to send mails to a friend from God@heaven.com using telnet for giggles (yes, he knew about it, I was demonstrating spoofing to him). If I send email to a server with crap verification using your email address as a reply-to, it may very well bounce to your actual account. There's nothing you can do about it.

Second, there are countless people who end up getting into a situation like this. A spammer probably set your address as the bounce or reply address. You can't stop it, and it usually declines or goes away after awhile. The best thing I've found to do that leads to minimal hassle (or at least minimal hairloss) is to create a filter on my mail client that will delete the messages, moving them to another folder and/or erasing them at logout. Other times you can train a spam filter to catch these messages and hide them for you but it may lead to missing actual bounce messages.

Look in the headers for a common line (or if you're lucky it has a common message body) and create a filter rule or train a spam filter system to treat them as junk.

Worst case scenario? A person (forgot her name) has a writeup on the Internet where she (think it was a she) described how her email address was used by one of the famous Internet malware worms as a return address, and it flooded her email as people were foolish enough to reply to it, along with bounces. I think she ended up changing her email address to ditching the old box as bounces grew to the thousands a day.

Usually it never gets to that point, though. First try filtering method.

EDIT: I'll also add that even if you did track down the source, chances are slim anything would be done about it. If it's a botnet, you can't find one source, it's coming from some idgit' that probably doesn't know or care that their computer is zombied. If it is from some idiot who thinks spam is legitimate marketing, they sure as @#% aren't going to listen to your complaints (you're "collateral damage.") If it's a foreign ISP, well, again...they don't care. The only one who might care is AOL, and if you forwarded the information to them and they shrugged their shoulders, you already know they don't care. They might even have been turned off the moment you said your account was "hacked"). ISP's typically know if someone is sending spam. They can make some money off it and are already shady because they know it leads to blackhole lists and counter-spammers bugging them. AOL probably paid just enough attention to your report to verify it wasn't originating from within their network and then shrugged you off...

share|improve this answer
    
I take your point about spoofing and understand how to do it, but I can still be sure of having been hacked because the addresses receiving the spoofed e-mails are ones in my AOL address book and not random ones. So the person doing it knows that these addresses are associated with my e-mail address. I am less concerned about the incoming mail as I am about the fact that some of the addresses are businesses and I don't want to end up blacklisted by them. –  Anonymous Aug 4 '10 at 11:25
    
Then the first thing to know is where these addresses are stored; on an AOL webmail server, or your local computer? –  Bart Silverstrim Aug 4 '10 at 11:59
    
Are all the addresses from your address book only (going to Aunt Tilly as well as your boss, who don't know each other) or is there someone else that would have your email address in their book and also know everyone you see the bounces from? And for that matter, why are they bouncing if they're only sending to your address book addresses, which I'd presume are known good addresses? Kind of odd, unless your computer itself is infected with malware and actively zombied. –  Bart Silverstrim Aug 4 '10 at 12:01
    
AOL's address book automatically adds any addresses that you receive non-spam from or that you send e-mails to, and I've been using this SN for well in excess of 5 years, so there are loads of addresses, some now defunct. The e-mails are going to any and all addresses - personal and business. The address book is stored on AOL's server - I know this because there are many addresses accessible in it that predate the purchase of my current laptop. –  Anonymous Aug 4 '10 at 13:12
    
A random spammer probably didn't target you in particular, because it's more effort than random harvesting. Addresses are either randomly generated or harvested using bots most of the time. It's simply easier than targeting John Doe for his particular information. Scan your own computer for malware using tools like ad-aware and spybot to see what's on your system. Check your router if it has outgoing connection logs. Also, you might have had your account info taken if you logged into it from a system that was infected. –  Bart Silverstrim Aug 4 '10 at 14:45

It looks to me like the email originated from ip address 118.136.169.35 which nslookup shows to be host fm-ip-118.136.169.35.fast.net.id, which is probably the ip address doled out by an ISP to one of their customers. Is this ip address yours? You can find out by going to www.ipchicken.com and seeing what ip address is reported.

If it is, then I'd say these emails are originating from your computer\network. I would run an antmalware scan on your computer(s).

share|improve this answer
    
Don't forget that if the IP is an ISP customer on dialup or cable modem (etc) that it could just be a zombie. It would have to match across all the mails (or most) to see if they're coming from a botnet or an idiot marketing host, unless like you said, the IP is the OP's...kind of surprised your ISP isn't blocking outgoing port 25 with all the problems ISP's have with spammers and botnets. –  Bart Silverstrim Aug 4 '10 at 12:45
    
I checked at ipchicken.com and my IP address is not the one in the headers. However, I suspect that AOL assigns a random temporary IP address to users when they first connect in a day/however AOL defines a usage session. I will test this later. I have run a Spybot scan and a full McAfee scan in the last week. –  Anonymous Aug 4 '10 at 13:14
    
And you changed your passwords, yes? –  Bart Silverstrim Aug 4 '10 at 14:46

Congratulations, you've been sent Backscatter spam. This is a very common method of getting around spam blocks and whatnot.

share|improve this answer

I had the same problem and I don't think it's spoofing as I understand it. Not only did I get the bounce backs (old addresses in my address book) but I actually have the outgoing emails in my sent folder. So someone must have hacked my address book.

They seemed to have gone down the list in alphabetical order and send multiple emails. Each email was sent to 5 or 6 addresses at a time. McAfee detected a trojan EXPLOITS-CVE2010-0840. It was quarantined and I deleted it.

McAfee is still reporting that they detected a trojan but there's no quarantine this time. The emails in the early morning hours 2 days in a row. I locked my firewall the next night and no emails the next morning. The 4th morning it sent emails around 7 AM but most bounced back probably because my firewall was locked.

The emails message has verbiage like "You'll look like superstar!.." followed by a link. The subject line in the outgoing emails says "RE:" followed by a number. Each email has a different number.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.