FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

https://daedal.io/@thomzane/116410863009847575

by pabs3 • 3 months ago

398 226 3 months ago

Good luck. These big tech companies have no incentive to care about support or really anything that isn’t tied directly to making money. And unless you have a friend there, Google staff have no incentive either. Solving this won’t help with their promotions.

rockskon2• 3 months ago

Cynicism helps no one.

rockskon2• 3 months ago

I will double down on this. Cynicism is the refuge of the ignorant that wishes to take comfort in their helplessness.

It isn't helpful.

ranger_danger3• 3 months ago

I think there are lots of people that will see this story that either work at google or know someone who does, and I bet it will lead to their issue getting fixed. The squeaky wheel gets the grease.

throwaway27448• 3 months ago

It would help if they provided literally any way for a squeaky wheel to squeak at them aside from squeaking at the employees with a modicum of dignity (if they still exist)

snickerbockers• 3 months ago

Based on how much zendesk spam there is i doubt it.

jwr2• 3 months ago

Google staff have no incentive either. Solving this won’t help with their promotions.

I don't think people appreciate that this is really the key observation here. In large institutions, for anything significant to happen, there have to be incentives and alternatives, and these are set by management. Management in turn usually cares about their incentives, and the company overall mostly cares about the bottom line and the financial reports.

As a result, this is unlikely to get addressed, unless there is significant pressure, like media coverage, people mass-resigning from Gmail, or major email servers blocking Google. But none of these are likely to happen.

bawolff• 3 months ago

Well yes, you get what you pay for and if you are on the free plan don't expect much.

I dont think this is limited to big tech.

noobermin4• 3 months ago

It honestly is a bit dissapointing that most of the internet's "infrastructure" is tied up in large corporations that just get money for free by being the only provider and face little to no backlash (because of their monopoly) when they neglect things like basic customer service.

unmole5• 3 months ago

get money for free

How do they get money for free? What is stopping everyone else from doing the same?

ranger_danger3• 3 months ago

Advertising and eyeballs, I'd assume

noobermin4• 3 months ago

A monopoly. It's hard for "everyone else" to develop a monopoly today, to suggest otherwise is a ridiculous assertion.

bmandale• 3 months ago

How do they get money for free?

market power

What is stopping everyone else from doing the same?

see above

subroutine• 3 months ago

Gmail is free. How much customer support resources should someone reasonably expect a company to dedicate towards their free-of-charge services?

nomel• 3 months ago

I don't know if it's that simple. As a litmus test, try to set up your own mail server. See how many milliseconds it takes for it to be blacklisted by gmail. And then observe the response time for their support, when you try to clear up the confusion that google has about your intentions.

oivey• 3 months ago

It’s free, but it’s not like they’re running Gmail as a charity, either. It has revenue and contributes to their other businesses.

robot-wrangler• 3 months ago

How much customer support resources should someone reasonably expect

Zero. OTOH, since I'm sure they are training on emails and archiving/profiling everything forever even if we delete messages.. those constant threats to become a paying customer before hitting some arbitrary small quota are still villainous

bigfatkitten• 3 months ago

Google’s support for paying customers isn’t much better unless you’re spending well into the millions per year.

AWS, on the other hand has proven willing to move mountains for me as a $15/mo customer.

BLKNSLVR• 3 months ago

If it didn't provide value it wouldn't exist.

Maybe it's only legacy, but gmail brings customers to Google and their related services. Escalation then brings them on as paying Customers. As loss leader may make a loss if looked at in a bubble, but if looked at as part of the "Customer Lifecycle" then other areas of profit would likely be much smaller without the free gateway.

It takes me active resistance to avoid Google's paid services, and I'm staunchly independent in relatively rare air. The minor capitulation required to turn into a paying Customer would capture a good percentage of their erstwhile-free gmail users (I would think. Yes, conjecture, interested in explanations of alternative theories).

sambuccid• 3 months ago

We might not be paying money, but we don't know what happens to our private data. Maybe it's not used at all, maybe used just internally, maybe could be even sold. Data of millions of users is very very valuable, even just thinking about how much targeted adverts could be placed with it.

grey-area• 3 months ago

Gmail shows ads to make money so it is not loss making. Google Workspace charges money per user (and still offers abysmal support).

pjc50• 3 months ago

Increasingly of the opinion that "free service with no support that's structurally essential for an economy" is some kind of trap. Possibly just the most comfortable kind of trap, a local optimum from which it's difficult to escape.

This is starting to become important as countries (very unwisely!) start tying things like national ID and banking to smartphones.

gilrain• 3 months ago

Gmail is profitable. How much harm should profitable services be allowed to perpetuate in the world to enable their profit?

dec0dedab0de2• 3 months ago

Enough that they're not facilitating abuse.

throwuxiytayq• 3 months ago

Maybe they should try getting a paid Google Workspace subscription /s

tjpnz2• 3 months ago

This is a plausible explanation based on the amount of fraud tolerated in other parts of their business. But it's probably going to cost you more than one Workspace subscription.

thayne2• 3 months ago

Having a workspace subscription still doesn't get you a human to talk to.

connorgurney• 3 months ago

It most certainly does in the UK.

TheChaplain• 3 months ago

It seems weird that Google wouldn't have some kind of observability alert on outgoing email. 10k emails per week is a lot.

compounding_it2• 3 months ago

What if someone (Google) used Google suite to send 10k emails to fire people. Wouldn’t that be considered normal for the server for a day let alone a week. Yes I know I could have come up with a better example.

gambiting• 3 months ago

Those would be internal so I'm not sure they'd even count against your quota.

blitzar• 3 months ago

ye olde corporate reply to all bomb .. no more emails this week everyone, we have used up our quota

superfrank• 3 months ago

I'm not sure it actually is. Free Gmail is limited to 500 emails a day, but Workspace accounts are allowed up to 2000, so this this spammer has to be using a Workspace account.

I've worked at a start up where the marketing team just had a `marketing@startup.com` email that was just like any other email in Google Workspace and used that for all marketing communications. Eventually they bumped up against that limit and a couple of engineers had to help them troubleshoot and there were enough blog and stack overflow posts at the time about hitting the limit to make make me think what they were doing wasn't uncommon.

When you consider the scale of Gmail and that this is almost certainly a Workspace account so they're mixed in with business customers, I'm not sure how much of an anomaly 10k emails a week actually is.

thayne2• 3 months ago

It may not be a single email, they might be using many throwaway accounts.

likis• 3 months ago

10k outgoing emails per week it NOT a lot.

Just imagine a weekly newsletter with 100k subscribers.

pembrook• 3 months ago

You can’t send bulk newsletters from gmail/outlook.

marcyb5st• 3 months ago

Yeah, you are using the wrong tool if you send your newsletter from a gmail account at that scale. You can get away with a few tens of people, perhaps a few hundreds.

Above that threshold you should use tools like moosend, benchmarkemail, or similar. And they ask a pretty penny when you reach that scale.

tjpnz2• 3 months ago

Spammer must be a whale spending untold amounts on other Google services.

urban_winter• 3 months ago

Google suspend email accounts that get lots of spam reports. It happens a couple of times a year for salespeople in my company who use Gmass (a bulk email sending tool).

I mention it only as a useful data point, and in the absence of anyone else on the thread mentioning that Google have robust email abuse monitoring.

cpncrunch9• 3 months ago

So, just to clarify, the salespeople are spamming cold addresses, or are they opted in or existing customers?

bdavbdav• 3 months ago

Was going to say there’s a good reason lots of people use services like mailchimp now. You’re not sensibly managing it yourself with the current (very sensible) regulations in the US / EU, nor do you want to be sending from your own domain en masse.

rwmj• 3 months ago

I guess you can only report spam through the gmail web interface which the FSF aren't using (because they're not using gmail, for obvious ideological reasons).

amichal2• 3 months ago

I did some tiny digging because I remembered that there is a way to report individual messages in a structured machine readable way to abuse@ for these things --- i suspect that this is technically supported by gmail (if not given a lot of signal weight)

https://en.wikipedia.org/wiki/Abuse_Reporting_Format

How to bulk do this is interesting too. https://en.wikipedia.org/wiki/Feedback_loop_(email) says that gmail has a bulk format and that sendgrid is seeing some success.

Not defending just trying to see what a technical solution looks like

p4bl0• 3 months ago

Google have robust email abuse monitoring

But only in Gmail then? Where is it possible to report a spam from a Gmail address received on a non-Gmail inbox?

Google is being a real PITA as the receiving side for people who try to self-host their mail or who use small providers. They should at least be good citizen on the sending side, which it seems they're not. They are killing email.

weird-eye-issue• 3 months ago

Spam reporting is pretty standardized? If your email client doesn't support it that's not Google's fault.

edit: I might be incorrect on this and was thinking about how unsubscribing is standardized instead.

delfinom2• 3 months ago

https://support.google.com/mail/contact/abuse

You can use this form

They should at least be good citizen on the sending side, which it seems they're not. They are killing email.

Eh? They do tons in anti-bot detection. But the value in exploiting and using Google's service is extremely high so bot authors are increasingly getting creative. Google stops running Gmail and simply another service becomes a high value target.

At least Microsoft fixed their Azure abuse after 10 years of not giving a fuck. It used to be stupid fucking easy to setup a trial O365 tenant and spam the fucking internet through "onmicrosoft.com" domains. And they let that go for 10 years.

smolder• 3 months ago

I wouldn't say that's robust email monitoring at all. It's embarassingly bad. Gmass shouldn't exist and your salespeople should be out of a job.

Fokamul• 3 months ago

I think in this case and all the others.

They're not sending emails directly from their gmail address.

But they are adding victim emails to other Google services and then Google themselves send them invitations emails.

And if you name your service like "Google helpdesk - password reset" or something like that.

Invitation email from Google will look very official, but URL in the email will be controlled by the attacker.

It's pretty old working technique used for phishing for years now.

Spam report does nothing, since you're reporting official Google email.

zelphirkalt• 3 months ago

How would it even be possible to name a service "Google helpdesk - password reset" or something like that, without being insta banned? Obvious fraud in the making, not getting recognized?

noobermin4• 3 months ago

I hope you realise, it does sound like you are suggesting that salespeople in your company are essentially spammers.

miroljub• 3 months ago

Most of the salespeople in any company are spammers.

throwawaysoxjje• 3 months ago

I wonder if this has to do with the massive number of google calendar invites I’ve been getting as payment/billing notifications lately.

I’ve not been reporting them because I already know they aren’t valid and do not google’s work for them

KomoD• 3 months ago

I thought they fixed that spam method a while ago

detourdog• 3 months ago

I haven't seen that ooe lately. I currently get lots of Nortoon Lifelock invoices with hundreds of addresses in the to field.

I always report them with suggestions they teach their AI that invoices sent to large number of addresses are phishing.

john_strinlai3• 3 months ago

we received several this week, so apparently not

Barbing• 3 months ago

Anyone getting hit with (Google) AppSheet-originating recruitment emails? Very well done. Imitating the biggest US brands.

Have reported AppSheet to FCC after seeing Google wasn't doing enough--same scam email format, same inbox-landing pathway, but still irked.

Also try forwarding the emails to the phishing emails of the misrepresented brands, when they have an address for it. Figure they're the ones who have any power.

TabTwo• 3 months ago

Had Google trying to send me mails to non-existing mail-addresses over months. You would think their logs might catch something like that or they would react to my complaints ... they don't and they just dont care.

It sometimes stops for weeks, then it continiues.

from my logs as an example: Nov 13 22:10:51 bert postfix/smtpd[2693931]: NOQUEUE: reject: RCPT from mail-oi1-x248.google.com[2607:f8b0:4864:20::248]: 450 4.1.8 <ki+bncBD77RLFFQACRBZOX3DEAMGQEU5V3LXY@zf.thesparklebar.com>: Sender address rejected: Domain not found; from=<ki+bncBD77RLFFQACRBZOX3DEAMGQEU5V3LXY@zf.thesparklebar.com> to=<rmayer13@nerd-residenz.de> proto=ESMTP helo=<mail-oi1-x248.google.com> Nov 13 22:12:07 bert postfix/smtpd[2696594]: NOQUEUE: reject: RCPT from mail-ua1-x948.google.com[2607:f8b0:4864:20::948]: 450 4.1.8 <ki+bncBD77RLFFQACRBZOX3DEAMGQEU5V3LXY@zf.thesparklebar.com>: Sender address rejected: Domain not found; from=<ki+bncBD77RLFFQACRBZOX3DEAMGQEU5V3LXY@zf.thesparklebar.com> to=<rmayer1000@nerd-residenz.de> proto=ESMTP helo=<mail-ua1-x948.google.com> Nov 13 22:12:18 bert postfix/smtpd[2696594]: NOQUEUE: reject: RCPT from mail-wm1-x346.google.com[2a00:1450:4864:20::346]: 450 4.1.8 <ki+bncBDO2ZDH5DIIOXB6ZZADBUBFIYC6HQ@zf.thesparklebar.com>: Sender address rejected: Domain not found; from=<ki+bncBDO2ZDH5DIIOXB6ZZADBUBFIYC6HQ@zf.thesparklebar.com> to=<rmayer13@nerd-residenz.de> proto=ESMTP helo=<mail-wm1-x346.google.com> Nov 13 22:12:37 bert postfix/smtpd[2696594]: NOQUEUE: reject: RCPT from mail-lf1-x146.google.com[2a00:1450:4864:20::146]: 450 4.1.8 <ki+bncBDO2ZDH5DIIOXB6ZZADBUBFIYC6HQ@zf.thesparklebar.com>: Sender address rejected: Domain not found; from=<ki+bncBDO2ZDH5DIIOXB6ZZADBUBFIYC6HQ@zf.thesparklebar.com> to=<rmayer333@nerd-residenz.de> proto=ESMTP helo=<mail-lf1-x146.google.com> Nov 13 22:13:08 bert postfix/smtpd[2696594]: NOQUEUE: reject: RCPT from mail-lj1-x248.google.com[2a00:1450:4864:20::248]: 450 4.1.8 <hc+bncBDO2ZDH5DIIOXB6ZZADBUBB2QEZ74@zf.thesparklebar.com>: Sender address rejected: Domain not found; from=<hc+bncBDO2ZDH5DIIOXB6ZZADBUBB2QEZ74@zf.thesparklebar.com> to=<rmayer@nerd-residenz.de> proto=ESMTP helo=<mail-lj1-x248.google.com> Nov 13 22:13:08 bert postfix/smtpd[2696594]: NOQUEUE: reject: RCPT from mail-wm1-x345.google.com[2a00:1450:4864:20::345]: 450 4.1.8 <ki+bncBDO2ZDH5DIIOXB6ZZADBUBFIYC6HQ@zf.thesparklebar.com>: Sender address rejected: Domain not found; from=<ki+bncBDO2ZDH5DIIOXB6ZZADBUBFIYC6HQ@zf.thesparklebar.com> to=<rmayerrmayer@nerd-residenz.de> proto=ESMTP helo=<mail-wm1-x345.google.com> Nov 13 22:14:03 bert postfix/smtpd[2696594]: NOQUEUE: reject: RCPT from mail-lj1-x248.google.com[2a00:1450:4864:20::248]: 450 4.1.8 <ki+bncBDO2ZDH5DIIOXB6ZZADBUBFIYC6HQ@zf.thesparklebar.com>: Sender address rejected: Domain not found; from=<ki+bncBDO2ZDH5DIIOXB6ZZADBUBFIYC6HQ@zf.thesparklebar.com> to=<rmayera@nerd-residenz.de> proto=ESMTP helo=<mail-lj1-x248.google.com>

As you can see, the to-address is generated and its different hosts at google trying to send mails.

Searching for zf.thesparklebar.com shows others having the same problem.

rmu09• 3 months ago

Not an expert, but AFAIK 450 is a non-permanent error that basically says "try again later".

cpncrunch9• 3 months ago

gmail, outlook and salesforce create about 90% of the spam that gets through blacklists. Salesforce is simple to fix: I just block anything from salesforce from our network, as it just seems to be 100% used by spammers. Gmail and outlook are the major problem, as there is no way of addressing their spam issue.

Washuu• 3 months ago

Add Mailchimp in there as well. I have never gotten an email from someone using Mailchimp that was not spam.

cpncrunch9• 3 months ago

Although they does have proper abuse policies and do take action against spammers. I don't get any spam from them (except perhaps the very occasional one), and I know businesses that use mailchimp and similar services for valid marketing (to previous customers). Just looking through my received mailbox, I see many legitimate emails from mailchimp.

I'm not denying that they are sometimes used by spammers, but they are definitely a legitimate operation that takes action against spammers if you report them.

Anamon2• 3 months ago

Many of my consciously subscribed-to newsletters use Mailchimp, such as record shops and labels.

They're also one of the mail services I have a better impression of given their responses to my reports.

nwellnhof• 3 months ago

In my experience, everyone got their act together except Google. I also used to receive massive amounts of spam from Azure and Sendgrid but this eventually stopped. Now 80% of the spam I receive is from the Google network, mainly Google Cloud.

walletdrainer• 3 months ago

Why do you interpret that as everyone except Google getting their act together?

The obvious (and correct) explanation is deliverability. Spammers send from Google services because they can inbox, they don’t send from other services because those services will not inbox successfully.

throwaway290• 3 months ago

In my experience, everyone got their act together except Google.

I remember a bunch of spam and fishing emails from weird Outlook addresses. Don't remember any from Google.

GoblinSlayer• 3 months ago

You mean you receive unsigned email from a VPS in Google Cloud?

ceejayoz3• 3 months ago

Yeah, Salesforce clearly has some kind of whitelisting at Gmail. I get so much nonsense from that domain.

monegator• 3 months ago

Unfortunately, the only thing that would work is to hire a bot service that would report the offending account en masse.

shevy-java• 3 months ago

Google removed humans, so ... anyone able to contact real people at Google?

n3storm2• 3 months ago

I have been observing this for the last 2-3 years (4 postfix servers sysadmin)

Gmail cannot be whitelisted anymore: spam, phishing,... On the other hand, if your users redirect twitter or linkedin notifications from their domain to a gmail account, Google claims you are sending too fast and is suspicious (and throttles or blocks ip).

Hilarious.

anonymousiam• 3 months ago

Lately I've been using SpamCop.net to make spam reports. It seems to work, and it's free. You are encouraged to donate, and they don't ask for much.

It's not perfect though. For some reason, it doesn't find (or deliberately ignores) OVH hosts that are relaying spam.

dirkf• 3 months ago

I've been using SpamCop for years (decades?) but lately I've been wondering if they're still relevant.

One example: they seem to have a size limit of 50KB when you report a spam mail via their web form. I've received quite some spam that exceeds that because they use base64 encoding of the body, add non-visible filler content to drown out the actual spam/phishing message, etc.

SpamCop suggests to cut off the message and still process it but then they miss e.g. the link to the phishing website and thus they can't send out a report for that.

Speaking of phishing links: a lot of the phishing mails I receive, link to some account on storage.googleapis.com. I've seen mails with links to the same account for weeks on end before they switch to a different one, implying that these links remain online for a long time. You would think that marking such mails as phishing in GMail (they are already flagged as spam) would get them on some kind of radar but apparently not...

Anamon2• 3 months ago

I've started using phish.report along with SpamCop to specifically report phishing sites separately. They do a hosting lookup and link directly to the abuse contact or form.

Phishers are definitely trying to become cleverer. My "favourite" so far is adding the phishing link only in a QR code in an embedded PNG.

jwr2• 3 months ago

I gave up on trying to report abuse to Google, Amazon or Microsoft. It seems reports simply get ignored and the big providers do nothing. I hope the FSF with its weight and media presence can finally do something.

Google, Microsoft, and Amazon are my major sources of spam. These days, this is where spam comes from.

At this point, they are also too big to block. We allowed this to happen, through neglect and laziness. Even in this discussion: how many people use Gmail as their primary email service?

alpaca128• 3 months ago

On YouTube I reported bot accounts for a couple days, the only reaction I got was that at some point it showed a popup that told me too many false reports would lead to a ban. Not sure what Google gets out of it, but there is no way they could be that bad at fighting bots unless they're not even trying. Even trivial tricks like copy-pasted texts keep working.

luckylion• 3 months ago

Bot comments and uploads count in KPIs. Blocking/Removing bots = KPIs look worse.

kdheiwns• 3 months ago

Google makes loads of money through scam ads and fake/AI slop videos. Anyone trying to get in the way of that is putting Google's profits at risk, hence why they shut down legitimate accounts but scammers just run free.

LiamPowell• 3 months ago

They're not trying. I've seen an advertiser remain active for months with literally tens of thousands of ads where clicking them directly downloads a malicious exe file that most antivirus scanners flag.

nubinetwork• 3 months ago

popup that told me too many false reports would lead to a ban

That would imply that someone actually sees them... vs shoving them under the rug, or giving them to a bot to delete.

noosphr2• 3 months ago

Not me, but then most people are allergic to paying $10 a month.

I figure an email is worth a beer.

aendruk• 3 months ago

That must be some good beer!

MisterTea• 3 months ago

This is called a monopoly. I know people who run their own mail servers to be as independent as possible. Ironically, they show up as spam in Gmail all the time because "This message is similar to messages that were identified as spam in the past." Meanwhile, it's a fucking simple one paragraph message to a programming mailing list. They have to wrestle with DMARK or choose not to as they feel DMARK is playing into the hands of the monopolies giving them too much influence and power over something as simple and fundamental as email.

mixologic• 3 months ago

DMARC isn't really that big of an issue to wrestle with, and I don't see how it gives anybody influence or power.

Havoc• 3 months ago

Crazy that you can even send that sort of volume from a gmail acc

vachina• 3 months ago

someone hooked up their web app to Google Workspace email and the web app got pwned.

Google Workspace email is very generous with the kind of outgoing email you can send via their SMTP servers.

tiku• 3 months ago

I'm reporting every spamm mail that I get through Gmail from Gmail accounts but it doesn't seem to help!

danayfm• 3 months ago

I was getting spam called constantly every 5 minutes (blocked by Google call screening) and the attackers made an error if sending a message with their AWS bucket url. I was able to submit an abuse report to Amazon and puff Amazon dismantled the entire spam group. No more spam since then.

Maybe try saying the spam has porn or inappropriate images?

ilamont7• 3 months ago

I got a human being at Google to look into my problem and take action after sending a police report to Google‘s legal department certified mail return receipt along with a letter describing how someone was impersonating me and my business using a Gmail address in an attempt to commit fraud.

Yes, it was a pain to take all of these steps and it probably took about 3 hours but it was absolutely necessary considering there was no avenue for me to shut down this person otherwise.

ModernMech3• 3 months ago

Oh that's a good idea! I got locked out of my YouTube premium account and they kept charging me. Couldn't get in contact with anyone at YouTube because the YT premium support line is behind the YT login. So I had to change my credit card number. Somehow they still kept billing the card, so the credit card company said they'd have to close my account entirely to get Google to stop billing me for a service they wouldn't let me cancel.

ceejayoz3• 3 months ago

That's a built-in thing; Visa, MasterCard, Amex all have updater services that ensure trusted merchants get the replacement card seamlessly. This leads to annoying edge cases like yours.

https://stripe.com/resources/more/what-is-a-card-account-upd...

You can sometimes ask your bank to issue a card and not ping the updater service, but tier one support tends… not to know about it at all.

justsomehnguy• 3 months ago

Did you try to demand a charge-back every time?

sillysaurusx• 3 months ago

Switch to Mercury banking. https://mercury.com/

You can create as many virtual cards as you want. And surprisingly, I've rarely encountered a vendor that rejects them. I set one up for pretty much every recurring service charge, just because it's so easy to do.

It costs a few hundred a year for personal banking, but if you register an LLC (which in MO costs ~$10) you can use your EIN to get a business account. Did it a couple times, once for my non-profit and once for my consulting LLC.

titzer• 3 months ago

You have to realize that once Google flips the bit on you and they think you are trying to scam them (or others via them) you are absolutely dead to them. They don't want to hear from you ever again. You're banned to hell. The fact that a billing system didn't get switched off isn't so surprising; the internal architecture of their systems is so complicated that it would take multiple human lifetimes to explain how it all works.

FireBeyond2• 3 months ago

Yup. I need to figure that out with Microsoft too. Paid for a 365 subscription on an account using one of my secondary email addresses. Being charged every month. None of those secondary emails will let me login/act like there's an account there/forgot password doesn't work. Support has no way to see what email account is linked to a credit card (which, admittedly, I get, somewhat) and wouldn't disclose that information anyway. So even armed with a transaction ID...

ilamont7• 3 months ago

Wasn't expecting this comment to go far. This took place about a month ago. For those who are interested, here is the address I sent the police report and cover letter to:

Google LLC

Attn: Legal Department – Custodian of Records

1600 Amphitheatre Parkway

Mountain View, CA 94043

In the cover letter I outlined the problem and the desired remedy (shut down the gmail account and preserve IP and other information for law enforcement), and attached two other documents: an annotated printout of the email thread from a prospective victim of the scam (who sensed something was fishy and contacted me through my website) and the local police report I filed to document the attempted fraud in my name.

Someone at Google contacted me about a week later and confirmed that the account was shut down. I don't know if they did anything else regarding preserving data or shutting down any other Google services this person was using.

I also made a report to the FBI’s Internet Crime Complaint Center, although TBH it looks like a black hole that lets the feds say they are "doing something" for ordinary victims.

eblume2• 3 months ago

Having worked in compliance engineering I have also reported through the IC3 portal, and spoken with lawyers and analysts who register with FinCEN (which, to be clear, is maybe just a step beyond "My Uncle works at Nintendo...") and I have heard that those reports do get reviewed and often acted on, but yes, you will typically never hear back from them. (FinCEN has its own reporting structure, but we also submitted certain reports through the IC3 portal as well.)

Cpoll• 3 months ago

What stopped them from continuing with a new similar Gmail address?

rvnx• 3 months ago

Motivation I guess

ilamont7• 3 months ago

Yes, they could easily spin up another gmail address.

The other part of the scam involved sending money to a bank account in Oregon with someone else's name attached to it. I notified the bank in a similar manner and hope they shut it down (not confirmed; my next step is to notify the Oregon banking regulator about the incident).

The hope is that once the bank account and gmail account are shut down the scammer will stop or move on. But I am concerned this could be a whack-a-mole problem that doesn't go away.

jeffbee• 3 months ago

You can't send high volume through new accounts. Usually when a gmail account is being used for real spamming, it's an established one that's been taken over and the spammers are just discharging the accumulated reputation of the account.

advisedwang• 3 months ago

Did the letter identify you as a lawyer? I wonder if Google handles it differently if it has a law office letterhead etc.

ilamont7• 3 months ago

No, I did not identify myself as a lawyer. I just wrote the letter as a victim of a scammer using Google services to impersonate me.

But I was careful to use certified mail return receipt as google’s legal office knows that this can be used for documentation and proof if the case ever goes further.

In other words, having a paper trail is more likely to get acted upon.

trinsic22• 3 months ago

IMHO its doesn't matter who you are. You don't need to be a layer to protect yourself in the right way. if you send a letter with evidence, certified with return receipt, if as a business, or a person, this is a good chance of liability if you don't respond if it ends up in court. There can be consequences for non-reposes. I have always had good results using this method. But you got to be clear about:

A. What the problem is B. Why you think there should be a response (I.E: What could happen if a response does not get acted on from your perspective, what harm could be continued, ect.) C. Set a requirement for a resonable response time and some kind of fee schedule or possible outcome if there isn't a response in a reasonable amount of time.

trinsic22• 3 months ago

Now thats how you do it. Paper trail holds all accountable.

YesThatTom2• 3 months ago

I’m old enough to remember when the FSF said that blocking spam was censorship. Good to see them wake up.

Kim_Bruning• 3 months ago

(I haven't run my own mail-server in a while. It's getting harder and harder.)

Are the real-time-blackhole lists still a thing?

If they're regularly allowing spam and not responding to reports in any sort of timely manner, possibly they should be reported to those.

Not going to work though, is it. Too big to fail shouldn't be a thing. It's not like you can't be flexible about it or give them some room to deal with it within corporate policy; but they do need to deal with it, right?

Realistically, I think some companies have outgrown the size where internet can still self-regulate them. You'd hurt yourself more than gmail.

This either needs laws or new game theory.

Or -you know- deprecate the current email system. I know that's a perennial proposal; but that's because every year it gets even more broken in even more interesting ways. It's patch-on-patch-on-patch at the moment. Just spinning up sendmail on a random box won't quite cut it anymore, if you want to participate.

nikanj• 3 months ago

Contact a human person at Google, one who can actually do something about a ticket? I also have a good selection of bridges for sale!

ModernMech3• 3 months ago

Ah yes, the tried and true method of getting into contact with someone at google: sending a blast to social media for an actual human, because Google literally makes it impossible to talk to anyone at all. Worst customer support in all of tech.

tag2103• 3 months ago

Rhetorical question- but what is it going to take for the IT Community to start treating Gmail and the rest of the "too big to block" as adversarial entities and actually block them for their bad behavior. Pie in the sky I know.

andrewmcwatters• 3 months ago

Microsoft refuses to deliver legitimate emails to hotmail.com addresses so I tell clients how it is.

I’m not jumping through hoops when I’m not doing anything wrong. SPF, DMARC, DKIM, IP address not on a blacklist, and I send zero spam. Only human-written client communications 1:1.

So, my clients with hotmail.com addresses don’t get emails from me. I can call them, they can call me.

e402• 3 months ago

Microsoft refuses to send emails to itself? How bizarre.

pessimizer• 3 months ago

IT Community

No such thing. And if you just want to assign anybody who works in IT to it in order to create the concept of such of a thing, a large percentage of this community would work at Google, a company that depends on Google, or a company that has the same attitude as google.

So it's less pie in the sky than nonsense. People don't talk about things changing in the physical world without talking about force, mass and inertia, but when it comes to people, the theory of power just evaporates and we start wishing for things to spontaneously happen because we've declared that they should happen.

With some weird definition of "should" which relies on our personal conception of the world. In the physical world, we say something "should" happen when we expect it to happen based on our theories of how the world works. With people we say things "should" happen when we personally want them hard enough.

mattbee• 3 months ago

There was a time before Google when various mailing lists of grumpy sysadmins in key institutions could decide the fate of a new mail sender, internet-wide. But yes that "internet community" is small fry now, and can only cut off their own noses if they don't like Google's mail policies.

Before Google, AOL were the previous big-beast mail host, and they did provide some tools to help diagnose why you couldn't get through to their users. It still felt like there was more of a balance of power towards the grumpy sysadmins.

PunchyHamster• 3 months ago

Send DMCA takedown, that's only thing big companies seem to react. Without checking validity of it of course

john_strinlai3• 3 months ago

only big companies are allowed to abuse the dmca process, unfortunately.

avian3• 3 months ago

Somewhat related to spam coming from Google servers, maybe someone can shed some light on what could be the motivation behind this activity:

In recent months I'm seeing instances where random personal mail accounts on a server I run would receive a barrage of mail in a short amount of time.

Mail seems to be bounced via Google Groups - they are sent from Google's IPs and have headers like X-Google-Group-Id, List-*, etc. all pointing to Google Groups. The actual group ID changes after each individual instance of this. However when I actually check e.g. the List-Archive URL, the group appears to be already been deleted.

The content of mail looks like it originates from various (legit-looking) random public web services, support requests, issue trackers, web contact forms etc. For example, a common reoccurring one is Virginia Department of Motor Vehicles (as in something like "thank you for filing a document #123 with us").

No apparent phishing links, no attached malware, no short advertisements snuck into a text field etc. Just automated replies from "noreply@"-type addresses.

It does not seem to be the case of trying to hide another attack (as discussed here for example: https://news.ycombinator.com/item?id=47609882) - over many instances I've not seen any other malicious activity. And this mail is filtered out easily enough based on Google's headers.

It all looks like there is some bot that a) creates a Google group and subscribes (one or more) random email addresses to a Google group and then b) enters the group's mail address into a bunch of random web forms that then send their automated responses to the group.

What could be the motivation for this? After the fact it's filtered pretty easily based on headers. It's not nearly enough volume to DoS the server. But why would someone go through the trouble of setting this up?

silvershell• 3 months ago

Yes. I got the same issue… and when someone replies, all users in the mailing list receive it… that’s why I would see a ton of replies saying please remove me from your mailing list. Very annoying. The only solution I found was to create an inbox rule to reject those, as I couldn’t unsubscribe

vk6flab• 3 months ago

The headers actually contain an unsubscribe email address that actually works.

The format is something like googlegroups-manage+{groupName}+unsubscribe@googlegroups.com

Just send an email there and they stop coming (for that list).

Source: I was getting spam like this, a fellow victim did some tests and confirmed that it stopped the onslaught of messages.

ethan_smith• 3 months ago

This is almost certainly subscription bombing / email bombing. The goal is to flood someone's inbox with hundreds of legitimate-looking automated emails so they miss a real one - typically a password reset confirmation, a purchase receipt, or a "new device login" alert. The actual attack is happening on some other service where the victim has an account. The fact that you don't see it on your server doesn't mean much, the target is the victim's primary inbox elsewhere.

avian3• 3 months ago

Thanks. It might still turn out to be this.

My thinking so far against was 1) after a few months I'm pretty sure I would hear about the real attack 2) Repeating too frequently. People aren't getting hacked all the time (I hope).

But who knows? Now I'm thinking that maybe some other step in the attack is failing and maybe the attackers just trigger the email bomb part pre-emptively in case they actually succeed in resetting the password/purchasing/whatever.

talkingtab• 3 months ago

Anyone interested in creating a CommunityEmailAlliance. Like dkim but with blocks on corporate email systems that allow spamming?

dev_l1x_be• 3 months ago

Google took over email when they reject legitimate emails sent by small email vendors and at the same time sending this much spam.

binaryturtle• 3 months ago

I'm getting a lot, and I mean A LOT, spam recently from various "<IP in reverse notation>.bc.googleusercontent.com" domains. Not sure what can be done about that. But the uptick is very noticeable.

tolciho• 3 months ago

Depends on the mail server. I'd probably 5xx all mail from googleusercontent.com as I don't give a toss if something Google breaks, and could debug what happened from the mail server logs. Google's incompetence in marking all the OpenBSD mailing list traffic as spam is why I'm running my own MX. If you have actual customers on your mail services you should audit the logs, see if anyone is actually using Google for something legit (usually it's the spam, I mean, marketing department being their usual sleazy selves), maybe flag the messages as potential spam by default. If you do have users doing something wacky with googleusercontent.com (email notifications from batch jobs, or something?) there are other ways those notifications could be done, e.g. over a VPN or via some other service that would allow all googleusercontent.com to be blocked by default from doing SMTP, ideally at the firewall level so less CPU is wasted on them. Complications here are that people forget or leave and so there might be some wacky workflow that uses Google running on some walled off server somewhere, so it may be a months long "slow simmer" to see if there is anything legit hiding in the noise. Or you could yank the band-aid off and see what breaks?

julianz• 3 months ago

Yup, same. I'm blocking bc.googleusercontent.com and also firebaseapp.com for now. The reverse DNS should also be able to be used, as the fakey spam domains don't match up with the PTR record, but I want to wait until I can watch the logs for a bit to make sure that works nicely.

e.g.

PTR: 53.220.83.34.bc.googleusercontent.com

HELO: sax.co.uk

dueltmp_yufsy• 3 months ago

I wonder if they do not take this kind of thank that seriously so to encourage the paid tier for storage. I am teetering nearer my end to the free, mostly from all the emails over the years.

siren2026• 3 months ago

if you are tech literate and still use Google, you brought this on yourself.

FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

Related Stories