Someones using my email address to send spam emails - how can I stop it?

[#1]

Or set up a whitelist?

[#2]

I have just had another one of these fake boots survey emails. But this time it came from hello@boots.com but it seems that they have spoofed the sender address.

Claimed sender:

• From: Boots UK hello@boots.com

Actual origin (the real story):

• Sending IP: 212.50.191.124 (a GB-based IP in ASN 12390, but not Boots infrastructure)
• Routed through: mail.enmail.co (91.204.208.8)

Authentication failures:

• SPF: Softfail — the sending IP isn't authorised to send on behalf of boots.com
• DKIM: None — no cryptographic signature
• DMARC: Fail — "No valid SPF, No valid DKIM"

Spam indicators (score 24.10, threshold is 5.00):

• Bayesian filter: 100% spam confidence
• Listed on multiple blacklists (Mailspike, Senderscore, Virusfree Botnet)
• Contains a suspicious URL domain: sosnowski.online
• Neural spam classifier: 98.7% spam probability
• No reverse DNS for sending server

[#3]

Over the last few weeks I’ve had hundreds of Boots Survey emails all supposedly from hello@boots.com. All come into my inbox and aren’t being detected as Spam/Junk ☹️

[#4]

If you could forward the headers to me by PM of one of the emails, I'll pass to our security team.

[#5]

I have also had dozens of emails supposedly from "hello@boots.com" about a feedback survey. Although they have a header "X-Spam: Yes" they have not had [Spam] added to the subject, nor been delivered to my Spam mailbox as they should be.

I have also had hundreds of emails supposedly from "Gift Shop <random email>" with subject "The Number 1 Kitchen K***e in the World", (where K***e is apparently a banned word in this community!) which have header  "X-pn-pstn-db:" Spam99" but do not have the "X-Spam:Yes".

They are both so obviously SPAM , but I have also had more emails than usual that are NOT spam marked with X-Spam:Yes.

Plainly something has gone significantly wrong with the Plusnet spam checker - note I am a Force9 account and have not yet been migrated to Greenby (but will be "from 8th December" whenever that is). 

I will PM @plusnettony with one example of each. 

[#6]

I seems likely that the recent icrease in SPAM is because the mail is now being routed through some parts of Greenby network, even for those who have not yet been migrated. So I started to try and find what facilities Greenby had for their SPAM checking and customisation.

At greenby.com there is a link bottom right to Help & Support. I think the "Common Issues - View All" leads to a list of "How to..." questions, categorised by the same topics that are also listed under "Browse Knowledgebase".

The questions include setting blacklists for emails addresses and domains, domain whitelists, and filters for specific values...

which seems rather more comprehensive than Plusnet offered.

However, I can find no references to SPAM anywhere in the help pages, so I asked the AI bot what spam checking does greenby have?  It replied...

Greenby's email packages include anti-spam and anti-virus protection as standard features.

If you'd like more in-depth details about how the spam checking works, what controls you have over it, or how to adjust spam settings for your account, I'd recommend logging into your Greenby dashboard and checking the email settings section—or feel free to submit a support ticket if you need specific guidance on configuring spam protection.

As I have not yet been migrated, I cannot login to Greenby or raise a support ticket. Does not fill me with confidence though.

I also found - rather worryingly - on the Email Client Settings Reference page...

Ports

• IMAP: 143
• POP3: 110
• SMTP: 25

Note that SSL/TLS/Secure connections should be disabled.

I really hope that is not true, as it would be a major step backwards!

[#7]

---

@mavison wrote:

I also found - rather worryingly - on the Email Client Settings Reference page...

Ports

• IMAP: 143
• POP3: 110
• SMTP: 25

Note that SSL/TLS/Secure connections should be disabled.

I really hope that is not true, as it would be a major step backwards!

---

I think that duff information

has been spotted by @Townman  - but I could be wrong!

[#8]

@mavison 

It is not true, it has been raised.

@plusnettony - are you able to confirm that this inappropriate information (which will lead to confusion and consternation) was flagged to Greenby a while ago, please?

[#9]

Where abouts are you looking? This is the main page ... 

[#10]

@plusnettony I can see the wrong port numbers at:

greenby.com -> Help & Support -> Emaii -> Email Client Settings Reference.

Regarding AntiSpam settings,  I was looking in the Help & Support pages, and I can find no references to SPAM anywhere in the help pages. The AI bot did not seem to know either. I am not sure which 'main page' you are referring to - bear in mind I am not due to migrate until "from 8th Dec" so I cannot yet logon to Greenby. The page you quote gives me hope there is some SPAM filtering with Greenby, but can you confirm there is an option to add [SPAM] to the start of the subject fields like Plusnet does (or at least did until recently)?

[#11]

Thank you - and raised.

[#12]

---

The page you quote gives me hope there is some SPAM filtering with Greenby, but can you confirm there is an option to add [SPAM] to the start of the subject fields like Plusnet does (or at least did until recently)?

---

I've not tested the SPAM filter myself, but also should work as it did previously. 

[#13]

Any news on these latest ones being added to the spam detection as they are still arriving. I noticed that the url to click on to take the survey has changed.

[#14]

Just received an e-mail allegedly from the Customer Support Team with an account suspension notice "due to unusual activity". The link purports to take you to the official Plusnet UK Help and Support" site.

They even have the cheek to add: "For your security, please avoid following links outside the official Plusnet website. "

There is also a nice pink button in PlusNet style inviting me to "Confirm your account".

The website is, of course cloned and FAKE. So of course for my security I will do as advised and avoid....

Oh, for got to mention, for some reason I apparently need to confirm my PlusNet account using a link (allegedly) at Boots....

[#15]

@Batphone That load of  <insert suitable word> has been reported elsewhere.