So I'm completely out of my element here. I don't even know where to begin solving this. Two times in the past couple of days I have gotten long lists of mail delivery subsystem messages on my primary gmail account with delivery status notification (failure) tags on them.
It seems I have encountered some sort of bug/virus/spoof/who knows what, that is taking large samples of my gmail address book and sending mass emails with links such as this: http://jivopiji.t35.com/
(I haven't clicked on this and wouldn't recommend clicking on it but if this helps with solving the problem then great.)
this is the original message as reported by google (with personal info blocked out)
Return-Path: <**MYEMAILADDRESS**>
Received-SPF: pass (google.com: domain of **MYEMAILADDRESS** designates 10.216.180.200 as permitted sender) client-ip=10.216.180.200;
Authentication-Results: mr.google.com; spf=pass (google.com: domain of **MYEMAILADDRESS** designates 10.216.180.200 as permitted sender) smtp.mail=**MYEMAILADDRESS**; dkim=pass header.i=**MYEMAILADDRESS**
Received: from mr.google.com ([10.216.180.200])
by 10.216.180.200 with SMTP id j50mr6599797wem.36.1285022292847 (num_hops = 1);
Mon, 20 Sep 2010 15:38:12 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=domainkey-signature:mime-version:received:received:date:message-id
:subject:from:to:content-type;
bh=8qvx2NI5Ulhx89ITpuKfFzjpHFP4R/nUOrFBKKUsxj0=;
b=Fc9gjiUs/tLwDDI0zAujXDEZfjU8OT7AxffW5YyDnNOUW1GGKG1zip+gjLYP7bOaZ8
BUsWiIN5od5mX60/WRRzqqJNH3lD8zhbjqjDDNWpfWwzPl8frecE2WBi+Vkuv91/BUVo
/0LqZr7hv9zhGSexnYQEi4y1ruuJP7QeHZVwA=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=gamma;
h=mime-version:date:message-id:subject:from:to:content-type;
b=g+YoaI2+okNKcEPtKs/oKpKgH0VPYqO9Z/9PzoIyptFov76oRSeesoy1HPhOUoUqu/
4v7GEslG1zklkeXCUybneVTSf7Dbr5fFy4S3q2ETumMebQwAPC7VRwBGZkyOUr0+RVUP
LTMP3R98RgQRTHc0R3fR+mdcb1n9gPtE+Bxfw=
MIME-Version: 1.0
Received: by 10.216.180.200 with SMTP id j50mr4928335wem.36.1285022292817;
Mon, 20 Sep 2010 15:38:12 -0700 (PDT)
Received: by 10.216.134.93 with HTTP; Mon, 20 Sep 2010 15:38:12 -0700 (PDT)
Date: Mon, 20 Sep 2010 17:38:12 -0500
Message-ID: <[email protected]>
Subject:
any known way to end this spoofing? what are my options here?