Menu
Reply
squirrel23
  • 13
  • 1
  • 0
On our wavelength
593 Views
Message 1 of 14
Flag for a moderator

Cloned email address

Shortly after my email address was stolen in the Easyjet hack my ntlworld address has been modified by deleting @ntlworld.com and adding ntlworld.com@mlsaccess.xyz. This is then being used to receive spam and to generate outgoing emails to addresses which are not recognised resulting in endless mail delivery subsystem messages from Googlemail saying 'not delivered will try again for 140 hours'

 

I've changed the password on my ntl email account and blocked the corrupt address but I have to clear stacks of unwanted emails from my deleted bin every day.

How do I delete this corrupt email address? 

0 Kudos
Reply
Graham_A
  • 16.12K
  • 2.25K
  • 6.89K
Very Insightful Person
Very Insightful Person
584 Views
Message 2 of 14
Flag for a moderator

Re: Cloned email address

You can't.  It is a spoofed address being used by a spammer.

________________________________
Graham

I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media, I'm a VM customer. There are no guarantees that my advice will work. Learn more

Have I helped? Click Mark as Helpful Answer or use Kudos to say thanks

0 Kudos
Reply
squirrel23
  • 13
  • 1
  • 0
On our wavelength
580 Views
Message 3 of 14
Flag for a moderator

Re: Cloned email address

Disappointing. Surprised an email which purports to be yours can't be deleted by you - or by Virgin when it's clearly being misused.
0 Kudos
Reply
Graham_A
  • 16.12K
  • 2.25K
  • 6.89K
Very Insightful Person
Very Insightful Person
575 Views
Message 4 of 14
Flag for a moderator

Re: Cloned email address

Neither you nor VM can delete an email address that does not exist - the address you are seeing is likely to be entirely fictitious - although one would have to examine the detailed source information of an email purporting to come from it to be absolutely sure.

________________________________
Graham

I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media, I'm a VM customer. There are no guarantees that my advice will work. Learn more

Have I helped? Click Mark as Helpful Answer or use Kudos to say thanks

0 Kudos
Reply
squirrel23
  • 13
  • 1
  • 0
On our wavelength
572 Views
Message 5 of 14
Flag for a moderator

Re: Cloned email address

Thanks for your comments
0 Kudos
Reply
用心棒
  • 5.8K
  • 652
  • 2.01K
Very Insightful Person
Very Insightful Person
512 Views
Message 6 of 14
Flag for a moderator

Re: Cloned email address


@squirrel23 wrote:

I've changed the password on my ntl email account and blocked the corrupt address but I have to clear stacks of unwanted emails from my deleted bin every day.


How have you blocked the corrupt address?

Does mlsaccess.xyz appear anywhere in the unwanted emails?

 

As a Very Insightful Person, I'm here to share my knowledge. I don't work for Virgin Media.

Click to learn more about VIP

  Use Kudos to say thanks

  Mark as Helpful Answer if I've helped

0 Kudos
Reply
squirrel23
  • 13
  • 1
  • 0
On our wavelength
505 Views
Message 7 of 14
Flag for a moderator

Re: Cloned email address

Clicked on 'block email' in mailbox options.

Yes, mlsaccess.xyz appears as part of the 'from' email ie my email address but instead of ending @ntlworld.com it ends ntlworld@mlsaccess.xyz

0 Kudos
Reply
ravenstar68
  • 19K
  • 1.11K
  • 8.21K
Very Insightful Person
Very Insightful Person
477 Views
Message 8 of 14
Flag for a moderator
Helpful Answer

Re: Cloned email address

The problem is that the address itself isn't 'corrupt' as you put it.  I'd also add that the address in the From: address isn't the address that's used when returning mail.

Think of the From: address as the address you find on the letter itself.  While the Sender address (the one that's used to determine where bounce messages go back to) as the return address on the back of many business letters.

Both From: and sender addresses can be faked, and due to email design, the From: address and the sender address can both be different (even in genuine mail)  It's quite simple to craft a mail for example with a From: address of mickeymouse@disneyworld.com, and still have it bounce back to your inbox when sending it.  While VM have taken measures to stop their own servers being abused in this way, not everyone has.

It would be interesting to see the headers of the mail attached to one of the NDR's as it might give some clues as to where the spam is originating from.

Tim

I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media. Learn more

Have I helped? Click Mark as Helpful Answer or use Kudos to say thanks

0 Kudos
Reply
squirrel23
  • 13
  • 1
  • 0
On our wavelength
450 Views
Message 9 of 14
Flag for a moderator
Helpful Answer

Re: Cloned email address


Error Icon
Delivery incomplete
There was a temporary problem delivering your message to [Removed]. Gmail will retry for 142 more hours. You'll be notified if the delivery fails permanently.
The response from the remote server was:
421 4.2.0 MXIN611 From header check failed ;id=ln2ljJcjPllzGln2mjmKnL;sid=ln2ljJcjPllzG;mta=mx10.tb;dt=2020-06-18T07:24:56+02:00;ipsrc=209.85.219.70;

Reporting-MTA: dns; googlemail.com
Received-From-MTA: dns; [Removed]
Arrival-Date: Tue, 16 Jun 2020 21:05:44 -0700 (PDT)
X-Original-Message-ID: <dea6beb1-12da-0af3-fb7d-8d7d7bf89b8e@mlsaccess.xyz>

Final-Recipient: rfc822; [Removed]
Action: delayed
Status: 4.2.0
Remote-MTA: dns; mx.tb.ukmail.iss.as9143.net. (212.54.56.11, the server for
the domain ntlworld.com.)
Diagnostic-Code: smtp; 421-4.2.0 MXIN611
421-4.2.0 From header check failed
421 4.2.0 ;id=ln2ljJcjPllzGln2mjmKnL;sid=ln2ljJcjPllzG;mta=mx10.tb;dt=2020-06-18T07:24:56+02:00;ipsrc=209.85.219.70;
Last-Attempt-Date: Wed, 17 Jun 2020 22:24:56 -0700 (PDT)
Will-Retry-Until: Tue, 23 Jun 2020 21:05:45 -0700 (PDT)

From: "US Online Concealed | Multi-State Cert" <updates@[Removed]>
Subject: Download Your Online Concealed Carry Certificate Here
Date: 17 June 2020 at 01:50:08 BST
To: [Removed]



Don't get arrested for carrying a gun
US Concealed Online

Start Training to Legally Carry With a Gun CCW Permit!

The anti-gun agenda could take away your 2nd Amendment Right. Be prepared and stay protected while the window is still open!

Start training to legally carry a gun CCW permit online.



If you'd prefer not to receive future emails,Unsubscribe Here.
1732 1st Avenue #28568, New York, NY 10128

 

 [MOD EDIT: Personal and private information has been removed from this post. Please do not post personal or private information in your public posts. Please review the Forum Guidelines]

0 Kudos
Reply
HowardML
  • 12.23K
  • 1.42K
  • 5.72K
Very Insightful Person
Very Insightful Person
439 Views
Message 10 of 14
Flag for a moderator
Helpful Answer

Re: Cloned email address

I have asked the Mods to edit this header, carefully, because you have disclosed on a public forum your correct e-mail address. As you are so concerned about being scammed this was not exactly the best thing to do. The Forum can be read by anyone seeking addresses to spam from. You've still got an opportunity to edit yourself - use the "Post Options" drop down and disguise properly your e-mail address. Better you do than the Mods, by default because we can't leave this up and put your privacy at risk.


I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media. Learn more

Have I helped? Click Mark as Helpful Answer or use Kudos to say thanks

0 Kudos
Reply