vote up 3 vote down star
3

In my Gmail account, I get messages exactly like the following, daily.

To me, it looks like a spammer (89.203.134.130, although this IP changes) is trying to spoof spam email FROM my Gmail account and send it TO my University (ufl.edu) email address, both of which have the same username, but that my University is rejecting the email on account of it being spam/Viagra.

But I don't see how that could happen. Gmail obviously would authenticate users before passing mail off as them from their own servers, right?

It may also be relevant to note that my @ufl.edu email address is being fed into my Gmail account via POP. I've read that the +caf_= notation that Gmail is sending this message to has to do with forwarding email.

I've changed both passwords relatively recently are both are good/secure passwords.

What is actually happening here? Why are both my email addresses involved?

What, if anything, can be done to prevent it from happening? (If "nothing" is the answer, that's fine, but I want to understand what's happening here. Please read my comments on existing answers).

FROM: Mail Delivery Subsystem <mailer-daemon@googlemail.com>
TO:   MYUSERNAME+caf_=MYUSERNAME=ufl.edu@gmail.com
DATE: Mon, Nov 16, 2009 at 11:29 AM
SUBJECT: Delivery Status Notification (Failure)

Delivery to the following recipient failed permanently:
MYUSERNAME@ufl.edu

Technical details of permanent failure:
Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 550 550 5.7.0 This message looks too much like SPAM to accept. (state 18).

----- Original message -----

Received: by 10.229.39.69 with SMTP id f5mr1036036qce.107.1258388958645;
       Mon, 16 Nov 2009 08:29:18 -0800 (PST)
X-Forwarded-To: MYUSERNAME@ufl.edu
X-Forwarded-For: MYUSERNAME@gmail.com MYUSERNAME@ufl.edu
Delivered-To: MYUSERNAME@gmail.com
Received: by 10.229.81.72 with SMTP id w8cs131477qck;
       Mon, 16 Nov 2009 08:29:18 -0800 (PST)
Received: by 10.220.125.69 with SMTP id x5mr8170562vcr.91.1258388957927;
       Mon, 16 Nov 2009 08:29:17 -0800 (PST)
Return-Path: <MYUSERNAME@gmail.com>
Received: from ?89.203.134.130? ([89.203.134.130])
       by mx.google.com with ESMTP id 38si10405353vws.31.2009.11.16.08.29.17;
       Mon, 16 Nov 2009 08:29:17 -0800 (PST)
Received-SPF: softfail (google.com: best guess record for domain of transitioning MYUSERNAME@gmail.com does not designate 89.203.134.130 as permitted sender) client-ip=89.203.134.130;
Authentication-Results: mx.google.com; spf=softfail (google.com: best guess record for domain of transitioning MYUSERNAME@gmail.com does not designate 89.203.134.130 as permitted sender) smtp.mail= MYUSERNAME@gmail.com
Date: Mon, 16 Nov 2009 08:29:17 -0800 (PST)
Message-Id: <4b017ddd.a615f10a.07ec.ffffd4a1SMTPIN_ADDED@mx.google.com>
From: VIAGRA � Reseller <MYUSERNAME@gmail.com>
To: MYUSERNAME@gmail.com
Subject: Dear MYUSERNAME@gmail.com receive 80% OFF on Pfizer
MIME-Version: 1.0
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
flag
FYI: Email addresses are incredibly easy to spoof. See fakesend.com which will let you send and email that appears to come from another address. (However, any good spamfilter/software will detect this as the email still does not come from the Gmail servers) – joshhunt Nov 18 at 2:37

5 Answers

vote up 6 vote down check

This segment:

Received: from ?89.203.134.130? ([89.203.134.130])
       by mx.google.com with ESMTP id 38si10405353vws.31.2009.11.16.08.29.17;
       Mon, 16 Nov 2009 08:29:17 -0800 (PST)

shows that google received the email, but it was sent by 89.203.134.130. That IP may have even been spoofed. Mail servers do not require a password to send mail to them, only send mail from them. For example, if I have a yahoo.com address, you don't need a yahoo.com password to send me email. All you need to do is lookup the MX record on DNS to find the name of the server that accepts email for that domain (mx.goolge.com in this case). Then, open the SMTP port of that server and tell it you're sending a new email. Then the entire content of the email is sent b(including most headers). Many spammers use the same To: and From: address for this. And that's what happened here:

From: VIAGRA � Reseller <MYUSERNAME@gmail.com>
To: MYUSERNAME@gmail.com

POP probably added this, not the spammer:

TO:   MYUSERNAME+caf_=MYUSERNAME=ufl.edu@gmail.com
link|flag
But if it was a simple spoofed email to my Gmail ("from myself"), then why would my ufl.edu email be involved at all (both in the TO field and in the message saying ufl rejected my email). My ufl mail is POPed into Gmail, not the other way around. Still doesn't make sense to me. – philfreo Nov 19 at 8:02
Any further explanation based on my comment above? – philfreo Nov 29 at 5:54
vote up 2 vote down

Looks like a straightforward spoofing to me. Send SPAM to person A, claiming to be from person B. Now if this is working on a script from a list of addresses, chances are it might go through them in order. Sometimes they do every perm, other times just each one and the address following.

So, if an acquaintance of yours has both your addresses in their address book, or even just both in the TO line of an email in their inbox, and they are infected with a virus which gathers these, your two addresses will end up in the list and one will be spoofed as sender of an email to the other.

link|flag
This makes sense, but I still have one problem with this answer: it looks to me like Gmail is saying it DID SEND the email to the UFL server. My understanding was the incoming mail could be spoofed, but that you couldn't trick Gmail into sending mail from someone else. – philfreo Nov 19 at 15:23
vote up 0 vote down

Yes someone is trying to spam you by basically sending you a message to you from you. But somehow google is forwarding you this to you at ufl.edu. That part is easy, anyone can do that.

This mail is weird in that it claims to be a bounce of a mail that was originally received by google over ESMTP, despite being intended for you at gmail.com from you at gmail.com but that google bounced it to you at gmail.com and then forwarded that bounce to you at ufl.edu, however it could not deliver it to you at ufl.edu (ufl didn't authenticate you as a recipient) and then google emailed you to tell you about that and decided to also forward that to you=ufl.edu at gmail.com.

Generally this looks like you set up some rule in gmail to forward stuff to your account at ufl, but that those messages are getting bounced (due to spam content perhaps?). If by "daily" you mean for the last couple of days, it might be that google retried sending the message over a couple days. This is something normal mail servers will try, usually for up to one week.

link|flag
No, I've been getting these, several times a day, for a long time. I don't have any rules to forward stuff TO my ufl account. I can send mail via Gmail through my UFL, and Gmail pulls in UFL via pop. – philfreo Nov 19 at 8:05
Do you mean you read your UFL mail on gmail.com and compose mail on there to be sent as though from your UFL account (this is normal use) or do you mean that you compose UFL mail elsewhere and send it via gmail's servers (it sounds like you're saying this, but that's confusing). – dlamblin Nov 19 at 23:41
I read and compose both my @ufl and @gmail through the GMail web interface. I'm able to do this because GMail lets me read my @ufl message by pulling them in via POP from my school's servers. My outgoing @ufl mail originates in Gmail and can be sent via GMail's SMTP servers OR ufl's SMTP servers. (I've had it set up both ways recently and nothing chnages; I still get these messages). – philfreo Nov 22 at 16:53
vote up -1 vote down

Yes, they are. In an email, it is extremely easy to claim to be another address, like in physical mail. They don't need to use gmail to send it either. Or they might have a botnet sending mail as you. Just filter the bounced message out to the trash or spam.

link|flag
I'm aware it is easy for email to be spoofed. You haven't dealt with the specifics of my question. – philfreo Nov 26 at 6:22
vote up -2 vote down

See the spelling of SUBJECT in the 4th line of the mail:

SUBKECT: Delivery Status Notification (Failure)

I am suspecting some Virus/Trojan doing this!!!

link|flag
1  
that was a typo :) – philfreo Nov 19 at 8:00
Oh! so does that mean you manually TYPED all the message and didn't copy/paste it? Is there any latest progress on this issue? Are you still getting such mails? – kamleshrao Dec 1 at 14:35
Yes, I'm still getting such mails. I copied and pasted the body of message, with the exception of the TO/FROM/SUBJECT part which I typed. – philfreo Feb 2 at 14:41

Your Answer

Get an OpenID
or
never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.