Tell me more ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.
up vote 0 down vote favorite

My yahoo email account was sending spams at about 6:40pm today. I immediately updated my password.

I also checked "Recent Login Activity", but all recorded locations and IP addresses from 4:47 PM yesterday till now are my own. I wonder how my account was possible to send spams while the recorded login acctivities are normal?

Thanks!

ADDED: header of one spam sent and saved in my "Sent" folder

From Tim Thu Jun 14 15:42:07 2012
X-YMail-OSG: ivy79oIVM1k8kPIPgi4nfJh2JPdWcnzc7If0UmOfBQtmnkB
 nEmfLnPHJ
Received: from [187.41.82.250] by web162602.mail.bf1.yahoo.com via HTTP; Thu, 14 Jun 2012 15:42:07 PDT
X-Mailer: YahooMailWebService/0.8.118.349524
Message-ID: <1339713727.16968.BPMail_high_noncarrier@web162602.mail.bf1.yahoo.com>
Date: Thu, 14 Jun 2012 15:42:07 -0700 (PDT)
From: Tim <tim@yahoo.com>
Subject: HI
To: bankofamerica@replies.em.bankofamerica.com
Bcc: xxx@hotmail.com, xxx@yahoo.com, 
    xxx@gmail.com, 
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Length: 71

Yahoo notice of failure to deliver the spam to some intended address

Sorry, we were unable to deliver your message to the following address.

<bankofamerica@replies.em.bankofamerica.com>:
Remote host said: 550 5.1.1 <bankofamerica@replies.em.bankofamerica.com> User unknown; rejecting [RCPT_TO]

--- Below this line is a copy of the message.

Received: from [98.139.212.148] by nm21.bullet.mail.bf1.yahoo.com with NNFMP; 14 Jun 2012 22:42:08 -0000
Received: from [98.139.212.214] by tm5.bullet.mail.bf1.yahoo.com with NNFMP; 14 Jun 2012 22:42:08 -0000
Received: from [127.0.0.1] by omp1023.mail.bf1.yahoo.com with NNFMP; 14 Jun 2012 22:42:08 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 395299.5507.bm@omp1023.mail.bf1.yahoo.com
Received: (qmail 91992 invoked by uid 60001); 14 Jun 2012 22:42:08 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1339713728; bh=3k5IzdOBwo7Jx0VjjcU11ALbzymfvrJ2SheLqHngG7s=; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:MIME-Version:Content-Type; b=mk5ksTksAaA1u+2GJaaQoJaClM5AQeOmUn4A9e3xYyJVpER/mKvPB6e5NJlZ2WG1zhOvnrMUHGgqwxMMa7lf3K9tHzGxhbLddTxfM0udgCC2Ws4d7ebgACo2lT/92A9qGxxPIXQCSAEiK8/C7P5rQ6ZAOGOv5xMHuSMY3lUzs9Y=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.com;
  h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Subject:To:MIME-Version:Content-Type;
  b=enSetbkOfQmTtzS221NeSMw+dVAbV6y4iFhhSye/tdOobEqExxBebaFrFsehnXbU10/kB00lr3EVDJFCcYoJT5Sp9a7bz1r9L3CezVCrqeolUUNSN4R9qjreJCxk3YxcTnm9f//PvAIPDsqadFmZyDXcT5FyUEfiwb0cyERbL90=;
X-YMail-OSG: ivy79oIVM1k8kPIPgi4nfJh2JPdWcnzc7If0UmOfBQtmnkB
nEmfLnPHJ
Received: from [187.41.82.250] by web162602.mail.bf1.yahoo.com via HTTP; Thu, 14 Jun 2012 15:42:07 PDT
X-Mailer: YahooMailWebService/0.8.118.349524
Message-ID: <1339713727.16968.BPMail_high_noncarrier@web162602.mail.bf1.yahoo.com>
Date: Thu, 14 Jun 2012 15:42:07 -0700 (PDT)
From: Tim <tim@yahoo.com>
Subject: HI
To: bankofamerica@replies.em.bankofamerica.com
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
share|improve this question

3 Answers

up vote 3 down vote accepted
  1. You can have a virus. The one that sends e-mails. If you have at least one spam e-mail try to track computers that had received it in Received header. If it tracks down to your computer - you are vulnerable.
  2. They can just use your e-mail when sending spam. Nothing you can do unless your mail provider (Yahoo) would use something like DKIM or SPF.
share|improve this answer
Thanks! (1) My OS is Ubuntu. I think it is very unlikely to have virus? How can I know if it has? (2) The sent spams can be seen in my "Sent" folder, and does that mean that the spams are actually sent from my account? – Tim Jun 15 '12 at 9:49
Can you show headers at least for one suck e-mail? – kworr Jun 15 '12 at 9:57
See my update to my original post. Thanks! – Tim Jun 15 '12 at 10:18
Look at the Received line for IP address. Is this your address or are you related to it? – kworr Jun 15 '12 at 10:40
You meant "187.41.82.250"? It is from a different country. Does that mean my original password was not compromised, and my account hasn't been accessed by a different person? – Tim Jun 15 '12 at 10:46
show 5 more comments
up vote 0 down vote

In ubuntu you can add a good firewall. That will be the complete protection that a linux user can have. One of the firewall that I would recommend is firestarter for linux and avast anti-virus for windows. Avast is a free and very good anti-virus

share|improve this answer
Thanks! What can a firewall do for my computer? – Tim Jun 15 '12 at 14:30
It can monitor the incoming and outgoing connection in your computer so that data is not transmitted from suspicious IP addresses. In short it guarantees you that no insecure connection will be made and no chance of virus from internet. – Pranit Bauva Jun 15 '12 at 17:14
up vote 0 down vote

It could be the original email was sent with false headers. As the target is Bank of America it could also be part of a DDOS attack on them.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.