cancel
Showing results for 
Search instead for 
Did you mean: 

spam from myself

the_groundsman
Rising Star
Posts: 488
Thanks: 24
Fixes: 2
Registered: ‎12-08-2007

spam from myself

I have today received a spam email with a bogus .xlsx attachment that appears to have been sent by me to me. alarming. any advice? Plusnet marked it as spam correctly but it still is a worry.
8 REPLIES 8
spraxyt
Resting Legend
Posts: 10,063
Thanks: 674
Fixes: 75
Registered: ‎06-04-2007

Re: spam from myself

The "From" address is easily spoofed - and most email systems treat the content as "text". If you look at the email headers you will probably find the "Return path" header, which is the real "from" is something different.
By setting "From" as your address the sender is trying to bypass some simple anti-spam measures. However the cloudmarks were not fooled.
Anyone else receiving the message has likely found their own address in the From field just as you did. It's not something to be worried about.
David
HairyMcbiker
All Star
Posts: 6,792
Thanks: 266
Fixes: 21
Registered: ‎16-02-2009

Re: spam from myself

My spam box is full of messages from "me", in various guises. Just ignore it as was said above, it is just a spoofed header.
the_groundsman
Rising Star
Posts: 488
Thanks: 24
Fixes: 2
Registered: ‎12-08-2007

Re: spam from myself

thanks, but the return path in the internet header is my address
HairyMcbiker
All Star
Posts: 6,792
Thanks: 266
Fixes: 21
Registered: ‎16-02-2009

Re: spam from myself

Just remember that the from field is NOT checked by the host when sending, only receiving. You can have anything in the from field.
Most likely your email address has been harvested from somewhere and used as the to/from headers.
Anotherone
Champion
Posts: 19,107
Thanks: 457
Fixes: 21
Registered: ‎31-08-2007

Re: spam from myself

You are right about the "From:" field never being checked. I get particularly annoyed with false positives where the mail has come from a legitimate organisation and just because it contains text and a link it gets marked as spam.
bobpullen
Community Gaffer
Community Gaffer
Posts: 16,869
Thanks: 4,950
Fixes: 315
Registered: ‎04-04-2007

Re: spam from myself

Quote from: Hairy
Just remember that the from field is NOT checked by the host when sending, only receiving.

Not strictly true Tongue
~$ telnet relay.plus.net 25
Trying 212.159.9.107...
Connected to relay.plus.net.
Escape character is '^]'.
220 avasout03 smtp relay.plus.net
ehlo relay
250-avasout03 hello [84.93.219.165], pleased to meet you
250-HELP
250-AUTH LOGIN PLAIN
250-SIZE 104857600
250-PIPELINING
250-8BITMIME
250 OK
mail from:<iamnotreal@thisdomaindoesntexist.com>
550 <iamnotreal@thisdomaindoesntexist.com> sender rejected - invalid domain (no MX or A record)

Bob Pullen
Plusnet Product Team
If I've been helpful then please give thanks ⤵

Anotherone
Champion
Posts: 19,107
Thanks: 457
Fixes: 21
Registered: ‎31-08-2007

Re: spam from myself

Thanks for that bit of clarity Bob, sorry to add my "confusion".
HairyMcbiker
All Star
Posts: 6,792
Thanks: 266
Fixes: 21
Registered: ‎16-02-2009

Re: spam from myself

OK rephrase. On OPEN relay's the from field isn't checked. The PN ones require you to have a PN account to send mail from it.