Who is sending spam from my Yahoo account?

popowich

EQ Forum Admin
Staff member
Hello,

Are your friends and family telling you that your Yahoo account was used to spam them?

There probably isn't much you can do to stop the actual spammer from abusing other address, but there are a few steps you can take to help prevent additional spam from leaving your email account.

If you don't use the account then delete it - http://www.emailquestions.com/yahoo-mail/144-delete-yahoo-account.html

If you lost access to it here is how to recover your password - http://www.emailquestions.com/yahoo...t-password-regain-control-hacked-account.html

To see what IP address used the account check the full email headers. The line you are looking for will be the first received line slightly above the Date line. In the example below the spammer is connecting to Yahoo from 93.41.20.117.

Received: from [93.41.20.117] by web63607.mail.re1.yahoo.com via HTTP; Sun, 24 Oct 2010 11:36:39 PDT
X-Mailer: YahooMailWebService/0.8.107.284920
Date: Sun, 24 Oct 2010 11:36:39 -0700 (PDT)
You can do a Whois lookup at the ARIN web site to see which ISP the IP Address belongs to.

NetRange: 93.0.0.0 - 93.255.255.255
CIDR: 93.0.0.0/8
OriginAS:
NetName: 93-RIPE
NetHandle: NET-93-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: TINNIE.ARIN.NET
NameServer: SUNIC.SUNET.SE
NameServer: NS-PRI.RIPE.NET
NameServer: SNS-PB.ISC.ORG
NameServer: SEC3.APNIC.NET
NameServer: NS2.LACNIC.NET
NameServer: NS3.NIC.FR
NameServer: SEC1.APNIC.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at Query the RIPE Database
RegDate: 2007-03-27
Updated: 2009-05-18
Ref: http://whois.arin.net/rest/net/NET-93-0-0-0-1
If that doesn't give you a god answer you can also try the reverse DNS :
> dig -x 93.41.20.117

;; ANSWER SECTION:
117.20.41.93.in-addr.arpa. 84549 IN PTR 93-41-20-117.ip79.fastwebnet.it.
Windows users want to start -> run -> command then use "nslookup 93.41.20.117" instead of dig -x

Eitehr way the results show fastwebnet.it as the spammers ISP.

Best guess to report the spammer is to contact abuse@fastwebnet.it and include the full headers from the spam email in the abuse report.
 

Gogo

New Email
Hello,

Are your friends and family telling you that your Yahoo account was used to spam them?

There probably isn't much you can do to stop the actual spammer from abusing other address, but there are a few steps you can take to help prevent additional spam from leaving your email account.

If you don't use the account then delete it - http://www.emailquestions.com/yahoo-mail/144-delete-yahoo-account.html

If you lost access to it here is how to recover your password - http://www.emailquestions.com/yahoo...t-password-regain-control-hacked-account.html

To see what IP address used the account check the full email headers. The line you are looking for will be the first received line slightly above the Date line. In the example below the spammer is connecting to Yahoo from 93.41.20.117.

You can do a Whois lookup at the ARIN web site to see which ISP the IP Address belongs to.

If that doesn't give you a god answer you can also try the reverse DNS :
Windows users want to start -> run -> command then use "nslookup 93.41.20.117" instead of dig -x

Eitehr way the results show fastwebnet.it as the spammers ISP.

Best guess to report the spammer is to contact abuse@fastwebnet.it and include the full headers from the spam email in the abuse report.
Thank you, this is very helpful.
 

Similar threads

Top