Spam emails being sent/received

[#1]

I am receiving thousands of "mail delivery failed" messages in my inbox for emails I didn't send. I think someone is using my email address to send out spam.

There are no sent messages that suggests they have hacked my plusnet email account and sending the messages from there.

It seems they have some way of sending out spam emails and any failed deliveries or replies get sent back to my email address.

With the few that have responses, I can see the spammer uses random senders names (not mine) when they send the emails but they all have my email address as the sender.

HELP! Any ideas how to stop this or suggestions what to do would be very much appreciated please...

[#2]

@visionfields the chances are that they haven't actually hacked your account but I'd change your email password just in case.

They have 'harvested' your email address from somewhere and are just sending emails with your address as the sender, its all too easy to do. Most of the sent email will get bounced but as you've discovered that means that you get the bounce messages.

There's little you can do I'm afraid, wheoever it is will probably get bored using your email address and move on to someone elses eventually

[#3]

@visionfields 

Depending on your email client it might be possible to create a rule so all the failed delivery messages are automatically moved to a folder of your choice.

Outlook is an example of an email client.

[#4]

Thanks for the suggestions. I created a rule in Outlook on laptop which cleaned things up there, but hasn't synchronized with iphone so still have '000's in iphone inbox. Any ideas how to force outlook to update mail on iphone please?

I don't go onto to Plusnet Webmail, but I've just gone on to that and the last email in the webmail inbox is from July! How can this be possible?

[#5]

Are you using POP or IMAP? For multiple clients I would to use IMAP

IMAP leaves the emails on the server whereas POP depending on the setting will leave them on the server for a set time period before they are deleted. or they are deleted immediately. 

It is not advised to mix POP and IMAP across clients

Regarding the rule it is local to the client being used, how ever on synchronising I would expect the emails to have been moved. Does the folder created appear on the iPhone?

[#6]

Thanks, I'll check the settings between POP and IMAP.

The rule in Outlook is just sending them to the Junk folder. Maybe if I create a new folder to send them in it will replicate on iphone and may work?

[#7]

hi @Dan_the_Van thanks for suggestions,

I went to change my Outlook connection to IMAP but now can't connect to plusnet email server as it seems they've blacklisted my email address (probably because of all the undeliverable emails received due to the spoofing problem)!

Doesn't seem to be anyway with iphone Mail to set email rules and now I can't connect via Oulook to set them either...

Plus, can't seem to raise email issues on the Plusnet portal..... Any suggestions please?

@plusnet  can you help?

[#8]

I believe most mailservers won't bounce mail back to the sender if they think it's spam and/or has a forged sender address. If they did, we'd be receiving hundreds of bounces per day.

The server bouncing them either thinks the mail is legitimate (passes SPF etc), so does it's best to inform the sender

or is itself misconfigured and bouces spam.

If the former, I'd look closely at where the bounced messages originated (you should be able to glean that from headers of the original msg if attached).

If the latter, I think you may find all these bounces are coming from the same server(s) in which case configure your mail client to move/mark read.

If the mail does originated from an allowed source, then something is up.

[#9]

---

@visionfields wrote:

I think someone is using my email address to send out spam.

---

You have not indicated the nature of YOUR ADDRESS - is it a hosted domain name email address or you@youraccount.plus.com?

If the latter then one would hope that the remote services are at worst returning SPF / DKIM reports.  If not then there is the risk that these emails are originating on Plusnet's network / through their SMTP service.  There is even the possibility that rouge software on your device is sending the email.  What anti-virus software do you use?

If a hosted domain name, where is the name server for the domain - elsewhere or on Plusnet?  Does the domain have SPF configured?

[#10]

Thank you @Townman for your response to my issue. Unfortunately I'm getting a bit out of my depth technically to try some of the things being suggested, but I can confirm my email address that has been compromised is my plusnet one - name@username.plus.com.

I only really use an iphone and I don't think it has any anti-virus software running. My partner used an old laptop which has Outlook on the create a rule to push all the delivery failure messages into the Junk folder, but this din't replicate on my iphone.

Since calling Plusnet yesterday the '000's of delivery failure emails has stopped but now although I am still receiving normal emails, I can no longer send any. They remain in my outbox on iphone. On plusnet webmail is shows as sent but they are not being received. On the old laptop my partner tried switching the connection in Outlook from POP to IMAP, and now we can no longer connect to the mail servers. The test email comes back with:

 

which looks like whatever Plusnet may have done to stop me being bombarded with the bogus delivery failure emails has also potential created a problem in me sending any emails from my Plusnet account.

From searching on-line I believe may be victim of a Spoof attack where someone creates spam/malicious emails that look as though they have come from a ligitimate source (in this case my email address). I have no idea how this is done, but the undelivered emails I get look like the one below:

 The email the "spoofer" sent out is shown below (which are attached to the delivery failure emails). Out of the '00's failed delivery emails I've received 2-3 are actual replies from people the "spoofer" has targetted and based on their rude comments I suspect they had potentially clicked on the links sent in the email:

I'll try calling Plusnet tomorrow to see if they can tell me what they have done to stop the message failure emails all coming through and why I can no longer send any emails.

I'd be interested in any further insights you may be able to share too!

Thanks, 

[#11 · Accepted solution]

I have now escalated this issue.

[#12]

I'm getting frequent spam emails purporting to be from Boots re a survey and giveaway.

All the sender addresses are from plus.com. None are known to me: I've blocked all, obviously.

Either PN webmail is being hacked in real time or it's been hacked and the entire list stolen.

Anyone else having the same problem?

Any thoughts, especially from PN?

[#13]

Already under investigation.

[#14]

Yep, same problem, I have just received my third one

[#15]

Just started another thread because I didn't see this one, but have been getting the "Boots store survey" e-mails since yesterday evening. Can't say I have had "thousands", just a handful to both of my PlusNet addresses.