Someones using my email address to send spam emails - how can I stop it?

[#1]

@PhilipHeyes Looking at the ones I have received, they do not actually appear at first glance to be spam - they are 'sent from' PN addresses via avasout - I have obviously no idea how the outbound/inbound filters  work, but whatever these originators are doing is enough to fool the filters.

[#2]

We recieved one on monday, it was neither sent to a Plusnet account, nor sent from a Plusnet account.

Does that help ?

[#3]

@Champnet Do you still have it? That is interesting.

[#4]

 

@jab1  Here's the graphic, which you won't see.....

Moderator's note:
The graphiv adds nothing to the discussion and has been rejected

[#5]

@jab1  And here's the details.............

Return-Path: <TeamSupport@uovp-f2f41.firebaseapp.com>
Delivered-To: noddy@bigears.co.uk
Received: from cp162176.hpdns.net
by cp162176.hpdns.net with LMTP
id qImrE5wL7Wg/Cz8ATcwJtA
(envelope-from <TeamSupport@uovp-f2f41.firebaseapp.com>)
for <noddy@bigears.co.uk>; Mon, 13 Oct 2025 15:24:28 +0100
Return-path: <TeamSupport@uovp-f2f41.firebaseapp.com>
Envelope-to: noddy@bigears.co.uk
Delivery-date: Mon, 13 Oct 2025 15:24:28 +0100
Received: from mail-ua1-f69.google.com ([209.85.222.69]:42026)
by cp162176.hpdns.net with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2)
(envelope-from <TeamSupport@uovp-f2f41.firebaseapp.com>)
id 1v8JTO-0000000HPxP-0Umc
for noddy@bigears.co.uk;
Mon, 13 Oct 2025 15:24:25 +0100
Received: by mail-ua1-f69.google.com with SMTP id a1e0cc1a2514c-90bceb0908eso10982904241.0
for <noddy@bigears.co.uk>; Mon, 13 Oct 2025 07:24:25 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=firebaseapp.com; s=20230601; t=1760365464; x=1760970264; darn=bigears.co.uk;
h=to:from:subject:date:message-id:mime-version:from:to:cc:subject
:date:message-id:reply-to;
bh=HpN5wSRJ8vuuh3azT9Tsb27I+zRCbyclsOvRIt99M0M=;
b=iFrFB5m1frHmFjPYiO0igS52aGn3OEr+J1uKUMtaUDGj2xRfNAzZ5k3F84VdKJBXpt
uFO0QdhL7gS/+4oWWmo1dpqMTMEzlUcro6h8UJdd7weXmtfSaFimqSlR+MKe0GEjnj6T
XV4w4dO4JOQBIF+X3OYKHBkMUXxhZmAE1p0S+12wU1y0KgCdVE2+V3ms07a/VmixoQZv
lxTetZV2M1H/v6FbV2A9qunvEjhCDB7GK9tH9j+3sPO+PeSCwMScVs5rRJqXXCK3Aamh
Da0OffC8LWDsc02jlbEybHlmLMARo9cIHeoFr+A8l3LNLikkVJmA9KTiX4MF08jaFDsv
N5jw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1760365464; x=1760970264;
h=to:from:subject:date:message-id:mime-version:x-gm-message-state
:from:to:cc:subject:date:message-id:reply-to;
bh=HpN5wSRJ8vuuh3azT9Tsb27I+zRCbyclsOvRIt99M0M=;
b=reUqdX5KREk9RUvRWyEHcqjwmU2+iedzGU6zMoJM+Obie+yGdrypnIf0pGQGs8soSP
qMHgVvyIboAUE4/RFLjg2JvSplAIhJbYwIEk/jPxWkpX/qm7o2pTnuLeSIeGdGVqR51r
BtDlgEV2DkTb11wlmio8EPoPC/6qdFTS06rCymRs5i1c9/7Txt3q7jF4E0w/SsjbfMU1
Z1tVpR+hKevXYxaUWw3lvPTLfo4DJSiKmF1Q/0tm4Axt4m8ACIoeP2ZN2BeaKr+I+Rly
zq2N04w1YMIeb8GpCpv5lWybFQEJhtJLlWPKU85FOIsR/jL9aj0dltflFlwsYgl34yv3
iIrQ==
X-Gm-Message-State: AOJu0YwruVJhd+BHyOyynx09LF0j/iT6Cx/HP9yQE1DSbUsEuadEhLdW
Jw44V9Bt56HsBiH/wc+ypTz+g/0SLglQucVquk3Clbpf3yTd2nFyA95IdIB4BiQWOKJI+DWGgd2
adUvVSrGqow==
X-Google-Smtp-Source: AGHT+IGy0lh/0FUlgtWc1wlSfQyiC9hQLBjU5UrZwzQAgKm+TsBCxRXgE3wdR5ln0wd3tOz1M03B6o2IUIUNE3s=
MIME-Version: 1.0
X-Received: by 2002:a05:6102:6209:10b0:5d5:f6ae:3913 with SMTP id
ada2fe7eead31-5d5f6ae3dd5mr5580721137.21.1760365464184; Mon, 13 Oct 2025
07:24:24 -0700 (PDT)
Message-ID: <0000000000002ae85c06410b0657@google.com>
Date: Mon, 13 Oct 2025 14:24:24 +0000
Subject: Act Now: Limited Spots Left for Exclusive Savings!
From: Survey about Boots <TeamSupport@uovp-f2f41.firebaseapp.com>
To: noddy@bigears.co.uk
Content-Type: multipart/alternative; boundary="0000000000002ae85406410b0654"
X-YourOrg-MailScanner-Information: Please contact the ISP for more information
X-YourOrg-MailScanner-ID: 1v8JTO-0000000HPxP-0Umc
X-YourOrg-MailScanner: Found to be clean
X-YourOrg-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
score=8.521, required 10, ACT_NOW_CAPS 0.10, BAYES_99 5.00,
DKIM_SIGNED 0.10, DKIM_VALID -0.10, EMPTY_MESSAGE 2.32,
HTML_MESSAGE 0.00, MIME_HTML_MOSTLY 0.10, MPART_ALT_DIFF 0.79,
SPF_PASS -0.00, T_REMOTE_IMAGE 0.01, URIBL_CT_SURBL 0.10,
URIBL_DBL_BLOCKED 0.00, URI_HEX 0.10)
X-YourOrg-MailScanner-SpamScore: ssssssss
X-YourOrg-MailScanner-From: teamsupport@uovp-f2f41.firebaseapp.com
X-Spam-Status: No

[#6]

Interesting, @Champnet . looks like Google are suffering the same kind of attack as PN , despite their 'anti-spam' measures that caused so much stress around here.

[#7]

By what magic do folks think these variants should automatically be detected as spam?

A human can make a spot judgement call, usually based on personal knowledge of having no known association with the sender.  How do folks expect an essentially dumb computer to make the same assessment?  I can already hear the cries of horror over all those emails marked as spam which are not spam.

These emails are spoofed to come from Plusnet addresses sent through Plusnet’s SMTP servers and therefore will pass SPF / DKIM / DMARC verification thus there are no typical grounds for suspecting spam.

Thereafter it’s down to learning if enough folks report the email as being spam: a signature in terms of subject and other markers can be created to assist the determination.  Such however is the flaw by which legitimate email of this ilk becomes blocked consequently to users who have subscribed to such services deciding they no longer want the content, reporting it as spam instead of unsubscribing.  That does lead to those who need those communications not receiving them.

Be careful about what magic you ask for.

[#8]

Back in post 154 @baldrick wrote : "The graphiv adds nothing to the discussion and has been rejected"

The graphic contained serious red flags.

1) Click here to unsubscribe. Why should anyone unsubscribe from a mailing list they haven't subscibed to ? 

2) Why should Boots, a UK Company, use a mailing Company based in Utah US to email customers or potential customers here in the UK.

3) A full address is given so those without access to a computer can write to unsubscribe

As @Townman implies : We have to learn to make judgement calls

[#9]

Boots? I'm not sure it really is a UK company anymore.

https://en.wikipedia.org/wiki/Boots_(company)

[#10]

And that adds to helping this issue how, @grumble ?

[#11]

An individual cannot stop such stuff. An individual can chose to ignore such stuff. or JHD (just hit delete).; the spammers preferred 'solution'.

At least Microsoft is still trying to get a solution. Even if the solution is irritating to some (but possibly less irritating for the average 'joe').

Just my opinion. (which are like orifices)

[#12]

Yesterday had another Boots spam email sent from a <name>@<account>.plus.com

I posted in the email header info for reference and I see that has been almost instantly deleted.

[#13]

@PhilipHeyes I too received a 'Boots' spam mail yesterday - passed in its entirety to a relevant individual. The 'sender' in mine was a PN addressee, too.

[#14]

Reading the info i regularly recieve emails addresses and other related personal details are being harvested by the billion so it's more than possible some Plusnet emails addresses are out there...

Anyone check the sent from email addresses actually exist ?  https://email-checker.net/ 

[#15]

I haven't, @Champnet , but thanks for that useful little tool. I'll run yesterdays rubbish through it later.