spam email from somewhere but claiming to be my mom

[capawesome9870]

well I have a problem, or more precisely my Mom. I am fairly certain that her email hasn't been hack, in the way the she has lost control of her email, but every now and then people on her contacts list (including me) get weird emails. (below)

The emails claim they are from her email address, but the twist is that they are not. The emails (from what I could tell) start from a server in cascadeaccess.com, then tell/spoof the email client that they are my mom.

I have attached the email source (in plain text)



how do I get this to stop happening.
Anti-Virus AVG hasn't reported any problems
We have changed the password of her email just in case.
Should I “nuke” her laptop and reinstall windows?





x-store-info:J++/JTCzmObr++wNraA4Pa4f5Xd6uensaUSop/gUCq9IjlptURk4vuVn5wMM99Rc5HELDYYyzvCKrSkQGE7FH3QoR/u9rlVSesUrilr/CT4cpiAT++32Kl1pVONxEdf/pQ4rSSQsmQ0=
Authentication-Results: hotmail.com; spf=softfail (sender IP is 72.19.50.12; identity alignment result is fail and alignment mode is relaxed) smtp.mailfrom=123@cascadeaccess.com; dkim=none (identity alignment result is pass and alignment mode is relaxed) header.d=hotmail.com; x-hmca=none header.id=123@hotmailcompany52.com
X-SID-PRA: 123@hotmailcompany52.com
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0w
X-Message-Info: NhFq/7gR1vTVsH9OntToWNVRVv3W6S7wYTRU/0WxO1hmCPQ3B9WAQrkNZ/iYLIIhTZvCezqpT/BgPY1waerb8n/8REvE6ftOBq4qWdpJPYYzSQkk1ife/YwOR6B3f76ZSbH9W+pdiQxqmSCvHL8jxOPq5KtsjMypDpkRsHc2OTs0BYnVgPwjaicg25Jhb1LLiyS+AxQVWi2zC8Rwf2yYA1BSCADbZOYR
Received: from ces-svr-it-mmail2.rcdws.com ([72.19.50.12]) by BAY004-MC2F53.hotmail.com with Microsoft SMTPSVC(7.5.7601.22751);
Mon, 30 Mar 2015 10:33:43 -0700
Received: (qmail 3546 invoked from network); 30 Mar 2015 17:33:40 -0000
Received: from 36-224-78-189.dynamic-ip.hinet.net (HELO cascadeaccess.com) (lkpanus1@cascadeaccess.com@36.224.78.189)
by ces-svr-it-mmail2.rcdws.com with SMTP
(cfed3caa-d702-11e4-bbc2-0f2171e7d1d7); Mon, 30 Mar 2015 10:33:40 -0700
From: "Priscilla 123" <123@hotmailcompany52.com>
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (1.0)
Subject: from: Priscilla 123
Message-Id: <C674D598-AC40-4896-F585-1C122C7B8AB2@cascadeaccess.com>
Date: Mon, 30 Mar 2015 19:33:37 +0200
To: "james 123" <456@hotmailcompany52.com>
X-Mailer: iPhone Mail (10b329)
X-MagicMail-UUID: cfed3caa-d702-11e4-bbc2-0f2171e7d1d7
X-MagicMail-Authenticated: lkpanus1@cascadeaccess.com
X-MagicMail-SourceIP: 36.224.78.189
X-MagicMail-EnvelopeFrom: <123@cascadeaccess.com>
Return-Path: 123@cascadeaccess.com
X-OriginalArrivalTime: 30 Mar 2015 17:33:43.0318 (UTC) FILETIME=[AB1C3B60:01D06B0F]

Hi james

RANDOM LINK TO A SPAM PAGE OF SOME KIND


Priscilla 123

Sent from my iPhone

 

 

 

 

side note: i replace mentions of my last name and email address with 123 and 456 for privacy

[Elliott Game]

Download Malwarebytes and do a scan with that, than remove AVG and install bitdefender free

[minibois]

-snip-

So, lets say your mom's email is: YourMom@gmail.com

Is the spam email the same or something like YourMom@SpamHost.com?

[MrYuriy]

Download Malwarebytes and do a scan with that, than remove AVG and install bitdefender free

 

A damn solid recommendation, IMHO.

 

I would uninstall AVG and download Malwarebytes just as Elliott mentioned. Bit defender isn't a bad touch, either.

 

 

 

PS: Tell her to stop clicking ads on porn sites.. IF that email really is hers. If not, just another stupid spam email thrown into the black hole world of "Spam - Delete Forever".

[dfsdfgfkjsefoiqzemnd]

Also be sure to change her password, just in case.

[Sir Asvald]

X-MagicMail-Authenticated: lkpanus1@cascadeaccess.com

X-MagicMail-SourceIP: 36.224.78.189

 

The IP address is location from Taiwan. The ISP is HiNet.

 

Is that where you live?

[capawesome9870]

Download Malwarebytes and do a scan with that, than remove AVG and install bitdefender free

didn't think of MB

i'll try it and see what pops up

 

 

 

So, lets say your mom's email is: YourMom@gmail.com

Is the spam email the same or something like YourMom@SpamHost.com?

 

the email comes up saying that it is from (using your example) YourMom@gmail.com as if she actually sent me a email. 

 

 

A damn solid recommendation, IMHO.

 

I would uninstall AVG and download Malwarebytes just as Elliott mentioned. Bit defender isn't a bad touch, either.

 

 

 

PS: Tell her to stop clicking ads on porn sites.. IF that email really is hers. If not, just another stupid spam email thrown into the black hole world of "Spam - Delete Forever".

 

ya, i think i will have to give her the talk about no ad clicking and no more obscure porn sites for the really kinky stuff. 

[capawesome9870]

Download Malwarebytes and do a scan with that, than remove AVG and install bitdefender free

didn't think of MB

i'll try it and see what pops up

 

 

 

So, lets say your mom's email is: YourMom@gmail.com

Is the spam email the same or something like YourMom@SpamHost.com?

 

the email comes up saying that it is from (using your example) YourMom@gmail.com as if she actually sent me a email. 

 

 

A damn solid recommendation, IMHO.

 

I would uninstall AVG and download Malwarebytes just as Elliott mentioned. Bit defender isn't a bad touch, either.

 

 

 

PS: Tell her to stop clicking ads on porn sites.. IF that email really is hers. If not, just another stupid spam email thrown into the black hole world of "Spam - Delete Forever".

 

ya, i think i will have to give her the talk about no ad clicking and no more obscure porn sites for the really kinky stuff. 

[capawesome9870]

The IP address is location from Taiwan. The ISP is HiNet.

 

Is that where you live?

 

Missouri, USA

[minibois]

the email comes up saying that it is from (using your example) YourMom@gmail.com as if she actually sent me a email. 

Change Google (or whatever email service she uses) password and do a Malwarebytes scan and another virus scanner's test.

If you don't want to do all that, a Windows reinstall would probably work too.

 

Also:

ya, i think i will have to give her the talk about no ad clicking and no more obscure porn sites for the really kinky stuff. 

lel

[Sir Asvald]

Missouri, USA

I'm sure it's spam. Was is it in your Junk box or was it in your inbox?

[capawesome9870]

Download Malwarebytes and do a scan with that, than remove AVG and install bitdefender free

 

 

A damn solid recommendation, IMHO.

 

I would uninstall AVG and download Malwarebytes just as Elliott mentioned. Bit defender isn't a bad touch, either.

 

 

 

PS: Tell her to stop clicking ads on porn sites.. IF that email really is hers. If not, just another stupid spam email thrown into the black hole world of "Spam - Delete Forever".

 

 

Change Google (or whatever email service she uses) password and do a Malwarebytes scan and another virus scanner's test.

If you don't want to do all that, a Windows reinstall would probably work too.

 

Also:

lel

 

 

I'm sure it's spam. Was is it in your Junk box or was it in your inbox?

 

 

just ran Maleware bytes took 30minutes to run, came up with 0 things wrong

[TheGamingLawNL]

I can't resist but it would be funny if you went up to your mom and ask about it, then she admits and appears to be one of the biggest spammers in the world

[minibois]

just ran Maleware bytes took 30minutes to run, came up with 0 things wrong

And have you changed here password? Maybe she just logged in with her Google account to a wrong site.

[Timopomer]

anyone that has any knowledge of how emails work know that they can be spoofed with ease.

 

he can make a php script send an email that looks to be from your mom

[Beltboy]

If you check her sent emails are they there, if not then her email is prob now secure but they are still using her address as a from address.

 

If you see the second line 

 

 

Authentication-Results: hotmail.com; spf=softfail (sender IP is 72.19.50.12; identity alignment result is fail and alignment mode is relaxed) smtp.mailfrom=123@cascadeaccess.com; dkim=none 

SPF check means your email provider asked "cascadeaccess.com"  if this mail was genuine, softfail means that the response was its not on my list but my list might not be complete (the list is being edited or has not been enforced)

 

If the mail is not showing in her sent items then you can put a filter in your spam check looking for this spf softfail and the domain and you'll stop getting them. It poss means that when they did have access they nabbed her address book though.

[BuntzenB]

well I have a problem, or more precisely my Mom. I am fairly certain that her email hasn't been hack, in the way the she has lost control of her email, but every now and then people on her contacts list (including me) get weird emails. (below)

The emails claim they are from her email address, but the twist is that they are not. The emails (from what I could tell) start from a server in cascadeaccess.com, then tell/spoof the email client that they are my mom.

I have attached the email source (in plain text)

how do I get this to stop happening.

Anti-Virus AVG hasn't reported any problems

We have changed the password of her email just in case.

Should I “nuke” her laptop and reinstall windows?

x-store-info:J++/JTCzmObr++wNraA4Pa4f5Xd6uensaUSop/gUCq9IjlptURk4vuVn5wMM99Rc5HELDYYyzvCKrSkQGE7FH3QoR/u9rlVSesUrilr/CT4cpiAT++32Kl1pVONxEdf/pQ4rSSQsmQ0=

Authentication-Results: hotmail.com; spf=softfail (sender IP is 72.19.50.12; identity alignment result is fail and alignment mode is relaxed) smtp.mailfrom=123@cascadeaccess.com; dkim=none (identity alignment result is pass and alignment mode is relaxed) header.d=hotmail.com; x-hmca=none header.id=123@hotmailcompany52.com

X-SID-PRA: 123@hotmailcompany52.com

X-AUTH-Result: NONE

X-SID-Result: NONE

X-Message-Status: n:n

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0w

X-Message-Info: NhFq/7gR1vTVsH9OntToWNVRVv3W6S7wYTRU/0WxO1hmCPQ3B9WAQrkNZ/iYLIIhTZvCezqpT/BgPY1waerb8n/8REvE6ftOBq4qWdpJPYYzSQkk1ife/YwOR6B3f76ZSbH9W+pdiQxqmSCvHL8jxOPq5KtsjMypDpkRsHc2OTs0BYnVgPwjaicg25Jhb1LLiyS+AxQVWi2zC8Rwf2yYA1BSCADbZOYR

Received: from ces-svr-it-mmail2.rcdws.com ([72.19.50.12]) by BAY004-MC2F53.hotmail.com with Microsoft SMTPSVC(7.5.7601.22751);

Mon, 30 Mar 2015 10:33:43 -0700

Received: (qmail 3546 invoked from network); 30 Mar 2015 17:33:40 -0000

Received: from 36-224-78-189.dynamic-ip.hinet.net (HELO cascadeaccess.com) (lkpanus1@cascadeaccess.com@36.224.78.189)

by ces-svr-it-mmail2.rcdws.com with SMTP

(cfed3caa-d702-11e4-bbc2-0f2171e7d1d7); Mon, 30 Mar 2015 10:33:40 -0700

From: "Priscilla 123" <123@hotmailcompany52.com>

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

Mime-Version: 1.0 (1.0)

Subject: from: Priscilla 123

Message-Id: <C674D598-AC40-4896-F585-1C122C7B8AB2@cascadeaccess.com>

Date: Mon, 30 Mar 2015 19:33:37 +0200

To: "james 123" <456@hotmailcompany52.com>

X-Mailer: iPhone Mail (10b329)

X-MagicMail-UUID: cfed3caa-d702-11e4-bbc2-0f2171e7d1d7

X-MagicMail-Authenticated: lkpanus1@cascadeaccess.com

X-MagicMail-SourceIP: 36.224.78.189

X-MagicMail-EnvelopeFrom: <123@cascadeaccess.com>

Return-Path: 123@cascadeaccess.com

X-OriginalArrivalTime: 30 Mar 2015 17:33:43.0318 (UTC) FILETIME=[AB1C3B60:01D06B0F]

Hi james

RANDOM LINK TO A SPAM PAGE OF SOME KIND

Priscilla 123

Sent from my iPhone

 

 

 

 

side note: i replace mentions of my last name and email address with 123 and 456 for privacy

 

Alrighty so I think what we have here is someone spoofing her account.

We had this problem in my school at the beggining of this year with people pretending to be teachers or students and saying random crap that gets the real peolple into trouble. There are these really shady websites that will spoof the adress and send an email for you. I dont think they actually have acess to the email or her computer.

Here are 2 links explaining how its done http://en.wikipedia.org/wiki/Email_spoofingand http://lifehacker.com/how-spammers-spoof-your-email-address-and-how-to-prote-1579478914

Also here is a site that will do this for you (browse at your own risk Im responsible for nothing you do) http://deadfake.com/Send.aspx

and  here is a site that explains how to prevent it if you are running your own email server https://www.digitalocean.com/community/tutorials/how-to-use-an-spf-record-to-prevent-spoofing-improve-e-mail-reliability

If you are using gmail or other similair thingsand she is too there are 2 ways to stop this spoofer. You can report spam on the top of the fake messages and then also you can send a list of the full header to spam@uce.gov  (here is how to get the full header https://support.google.com/mail/answer/22454)

So the real problem is how they got to your contact list. A possible source is an app that you use that could very possibly have sent your contact list to someone.

Well good luck fixing this!

If you still think that someone is accessing your account you can check the last account activity (this link for help on how to do that https://support.google.com/mail/answer/45938)

[capawesome9870]

And have you changed here password? Maybe she just logged in with her Google account to a wrong site.

yes we did change her password

 

Alrighty so I think what we have here is someone spoofing her account.

We had this problem in my school at the beggining of this year with people pretending to be teachers or students and saying random crap that gets the real peolple into trouble. There are these really shady websites that will spoof the adress and send an email for you. I dont think they actually have acess to the email or her computer.

Here are 2 links explaining how its done http://en.wikipedia.org/wiki/Email_spoofingand http://lifehacker.com/how-spammers-spoof-your-email-address-and-how-to-prote-1579478914

Also here is a site that will do this for you (browse at your own risk Im responsible for nothing you do) http://deadfake.com/Send.aspx

and  here is a site that explains how to prevent it if you are running your own email server https://www.digitalocean.com/community/tutorials/how-to-use-an-spf-record-to-prevent-spoofing-improve-e-mail-reliability

If you are using gmail or other similair things and she is too there are 2 ways to stop this spoofer. You can report spam on the top of the fake messages and then also you can send a list of the full header to spam@uce.gov  (here is how to get the full header https://support.google.com/mail/answer/22454)

So the real problem is how they got to your contact list. A possible source is an app that you use that could very possibly have sent your contact list to someone.

Well good luck fixing this!

If you still think that someone is accessing your account you can check the last account activity (this link for help on how to do that https://support.google.com/mail/answer/45938)

 

 

what i have pasted in the original post is the message header, should i send all of it to the spam@uce.gov or edit (like i did in this post) names and such?

 

 

i do not know how they got her contact either, she checks it using firefox, no other 'apps'. 

tomorrow i'm going to scrub firefox and install a program called Sandboxie which will make it a little easier to make sure bad things do not stay on her computer (if there was something there to begin with). 

[capawesome9870]

The IP address is location from Taiwan. The ISP is HiNet.

 

Is that where you live?

 

i looked at the "recent activity" section and seen that earlier this month some one in germany had a failed attempt at logging in to her account. 

[TristanK]

I don't know how it is in gMail but on Hotmail now Outlook you can block the shit out of those eMails. Just block the email if you can (not familiar with gMail options in that area) and they wont be able to send any more mails from that address

[TristanK]

On outlook you can also block the domain or mails that include certain words  (you make a custom rule what you want to receive and what not)

 

 

...damn....sorry for another post...I edited the one above and than started writing in the wrong window, my bad

Edited April 1, 2015 by TristanK