Problem with supposedly bounced emails I've never sent.

[Frustratedlady]

I keep getting these Daemon messages about emails bouncing from addresses I've never heard of nor emailed. I know they are spam, but don't understand the purpose or how to get rid of them. Obviously, they are using my email addy. The following is what I get and I've found that if I wave the mouse over the addy, I get other addy's than Daemon. I don't open them nor click on a link. Can anyone explain what is going on?

--------------------------------------

Mail Delivery Subsystem ([e-mail])

Message not delivered
There was a problem delivering your message to [e-mail]. See the technical details below.
LEARN MORE

LEARN MORE
The response was:
Your email to group [e-mail] was rejected due to spam classification. The owner of the group can choose to enable message moderation instead of bouncing these emails. More information can be found here: https://support.google.com/a/answer/168383.

[CloudWatcher]

1. Email is trivially forged

Some email spammer is sending out emails using your email address in the "From" field. When it (appropriately) bounces, the email system delivers it back to you.

Email is entirely trivial to forge. Never trust it. It's been this way since the dawn of the Arpanet/Internet. I remember demo'ing this to my boss in 1980 ... forging an email to him, from his boss, accepting his resignation.

The problem is that email was designed back when the Arpanet/Internet was an experiment of trusted sites and people. The original designers of email never imagined the Internet of today with rampant fraud and spoofing.

[Frustratedlady]

5. What is the purpose? I don't understand why they would do this if no $$s were involved. I hope!!!

Thanks for your explanation.

[CloudWatcher]

13. Spam filters

It's useful to send out spam with an actual email addresses in the From field. E.g. if they use their own address, they would get quickly added to block lists.

They're (most likely) not attacking you, it's just a way to try and get their spam delivered instead of rejected.

Unfortunately, there's not a lot for you to do to do other than just delete the junk from the various mail servers that reject the spam.

After a few days they'll get tired of faking email from you and move on to a different address.

I've had it happen to me more than once. After a little while the reject emails disappear.

I've also had it happen to me with phone calls! Spammers will fake Caller ID and make it look like I am the caller. I've gotten a couple of confused calls from people that claim that I had just called them. I had to explain that Caller ID is not secure and that some crook had just faked my phone number to try and get them to answer ... since people are much more likely to "pick up" if caller id shows a number close to theirs (same area code, same prefix).

[Frustratedlady]

15. Yes, I get those calls every day.

One I get changes the last 4 digits each day, but I get at least one call from the same area code. So, I looked it up and got a page of names/numbers with the first 6 digits. I could NOT believe the names listed. It was like being in a foreign country, even though the town was in my state. The call was for automobile maintenance contracts.

As for these #$%%^ emails, I've done everything I can for now and will watch to see if it helped.

Thanks, much.

[CloudWatcher]

17. National Do Not Call Registry

I *think* putting your phone number on this list helps a bit.

https://www.ftc.gov/faq/consumer-protection/list-number-national-do-not-call-registry

In any event, it at least gives you the ability (if you want to) to talk to the human on the junk calls and tell them that their call is not just annoying, but actually illegal!

Sadly, it doesn't ban political fund raising calls

What really helps reduce the number of junk calls is to let all your calls go through to voicemail and only "pick up" if you recognize the voice of the caller. After a while your number gets tagged as "doesn't answer" and the volume of junk calls goes down.

Though I have to admit, I really enjoy the spammers that call trying to tell me my computer is infected. They're almost always following a script that assumes you have a Windows machine (I have a lot of Macs) and assume that you have only one computer (I've got, um, several). I try and get them to tell me the internet address of the machine they believe is infected and they get really confused. Sadly, they've stopped calling too

[Frustratedlady]

19. That works for a short time, then we're back to calls again.

My phone set has 5 stations and I haven't been able to clear the message box. The rings stop after 3 and, of course, they can't leave a message. So, eventually, they stop. I blocked a lot of callers, but ran out of room on that option, too.

One of these days, I'll work at getting those options fixed...

[canetoad]

2. You could have picked up

A mass mailer worm. Do a full virus/malware scan and see if it finds anything.

[Frustratedlady]

6. Yes, I have run a malware scan with nothing found.

I'll do it again. Thanks!

[canetoad]

9. Another possibility

Is that someone, who has your email addy in their address book has a mailer worm.

How these things work is they install themselves through an infected attachement, setting up their own SMTP engine. Then they trawl the infected computer for email addresses and wham! Away they go.

I was once able to identify an worm on an acquaintances computer; this particular worm searched for email address and also copied random chunks of text from the user's files and pasted them in the body of the emails it sent. Luckily I recognised some of the text and from whom it was copied.

If this is the case, just keep deleting them and hope that the infected computer's owner eventually figures it out.

[Frustratedlady]

10. Hmmm! This is the first time I've run into this problem.

I will ask a couple people I email every day if they have noticed the same problem. Thanks.

Too bad these characters can't find something more productive to occupy their time.

[CloudWatcher]

14. Check the 'To' address

If the original recipient is someone in your email address, then it's likely that your contact/address book has been compromised ... possibly by malware on your machine, but also possibly by a Facebook (or other) breach.

But ... if the To field (the original recipient of the spam email) is not an address that you recognize, then it's much more likely that the spammers are just faking your address as the sender and your machine (and your address book / contact list) has not been breached.

[Frustratedlady]

16. No, they are using my address.

The Daemons I've opened have a link, but they don't make much sense...nothing recognizable. I don't click on the links and haven't opened the emails for credit scores that started the whole thing. I assumed those were trying to get my cc#s.

They are a headache, for sure. Thanks!

[CloudWatcher]

18. The original To field

I mean the address that the daemon was attempting to deliver to .. not yours. It should tell you that it failed trying to deliver to "foobar@somehost" and that it was rejected as likely spam. If that address is one you know, then it's possible your contact list was breached. But more often, it's some random address you've never heard of and it's just all forged.

Yeah, I feel sorta responsible for the email headaches of today. I was around in the very early days of the Arpanet and noticed that email wasn't secure back then. But .. those were also the days before public-key-encryption had appeared so real distributed security (that we need here) was a bit of a pipe dream.

Now it's time for email to be killed off and be replaced with something secure.

[Frustratedlady]

20. Yes. The example I posted was...

There was a problem delivering your message to [e-mail].

I have no idea who that is.

[cayugafalls]

3. Perhaps someone has spoofed your email address as origination of their spam operation.

How many are you getting? Are they all different responses?

[Frustratedlady]

7. I haven't opened any until tonight when curiosity killed the cat.

Being from Google, I thought it would be safe enough.

Yes, they are to different addresses. At first, they were to credit numbers...how good/bad my credit numbers were. I never opened any of those, but did check their addy by waving the mouse over it. They were mostly men's names that I'd never heard of. Then, I started getting the Daemon emails. I opened the first few and even notified my daughter to see if she had received an email from me. She had. Then, I started watching more closely and saw in the preview on my email page that it referred to an addy I'd never used. This has been going on for several weeks.

Thanks for your reply.

[PoindexterOglethorpe]

4. See if changing your password to your email account helps.

[Frustratedlady]

8. I will do so. Thanks!

[Bernardo de La Paz]

11. It's a classic trick. If you respond in any way, they know a live human is on the other end.

Respond and you will be bombarded with frauds and scams and phishing schemes.

[Frustratedlady]

12. I have not responded to any of them, nor have I opened any except a couple Daemons.

I didn't even click on their link.

I just changed my password. We'll see if that works. I am now going to run Malwarebytes again.

Thanks for your suggestion.