aeola.us spam and how to kill it off

Since 8/31/17 I have received 119 pieces of spam from an annoying new source.

The emails’ FROM header always takes the form “contact@” & {random characters} & “aolea.us

Examples:
contact@zjwjFD5EEM8Taolea.us
contact@zjwj89VJ5FL9aolea.us
contact@U9ZREA4013ETaolea.us

I use Eudora (yeah, still) as my POP email client and I have no difficulty setting up clientside filters that recognize and discard this shit. But that means I’m downloading lots of spam just to spamfilter and discard it every day :mad:

My email ISP is earthlink. For server-side filtering, they have a limited set of controls including “no server-side spam filtering” and “discard any email that isn’t from a sender in your address book” (that’s a nonstarter, I use my email address as “how to contact me” on materials distributed to strangers) or the “medium filtering” option that I do use, “delete known spam” + “use a blocked senders list”. The blocked senders list allows me to block an entire domain but it doesn’t allow me to use a wildcard. So I could block the domain “zjwjFD5EEM8Taolea.us” but that doesn’t stop any of the others, and it doesn’t let me block “*aolea.us”.

Earthlink tech support has been less than stellar on figuring out how to stop this. They’ve requested that I log into web mail (which I don’t normally use) and mark each such piece of email as “spam”, which I’ve done, but it doesn’t appear to have made a dent yet.

What I’d LIKE to do is set up some kind of application or process that accesses my email and deletes the aolea.us emails from server. I have (of course) the POP3 server IP and my credentials for logging in and fetching email. Is there a tool of some sort that can fetch FROM headers and then loop through them and delete individual emails?

174 and counting. Fourth call to earthlink.

I’ve had the problem of ‘dynamic’ domains. Actually, I’d like to get emails from the FAA – but they use dynamic domains, so I can’t approve them.

My Spamblocker is set to:

Suspect Email Blocking — Highest Protection
Messages from unknown senders (those not in your Address Book) are redirected to your Suspect Email folder. This setting includes Known spam Blocking.

My automated response reads:

I still get spam, but it’s easier to control when it’s sequestered.

Yeah, I’m not willing to do that. The current situation is annoying but it’s just chewing up bandwidth. Eudora recognizes this “aolea.us” shit right away and changes the subject display line to “aolea crap” so I don’t even have to read their come-on subject titles and it tosses it into the trash can. But it can only do that after it’s wasted time and bandwidth downloading it in the first place.

I can also set up Eudora to auto-forward each and every one of the damn things to fraud@abuse.earthlink.net and see how THEY like being inundated with several hundred spam emails per month.

I need people to be able to email me. Getting a bumpercrop of spam is the price tag. This is just above and beyond bumpercrop and moving into The Spam That Ate Manhattan territory.

And it seems to me that if Eudora can freaking figure out that contact@{anystringhere}aolea.us is deserving of a specific treatment, earthlink’s servers ought to be able to do it server-side.

Server-side mail filtering rules seem to quite commonly have safeguards to prevent you accidentally filtering more than you intended to. I guess someone here imagined that you would never actually want to block a whole domain, when in fact, there are plenty of cases where you may want to do exactly that.

I actually wanted to block a whole TLD the other day, but nope, 1and1’s blacklisting feature just assumed I was making a mistake - so now I’m continuing to get a bunch of spam from random domains with .club and .bid TLD suffixes. I’d like to just block *.bid and *.club (if anyone wants to send me legitimate email from such an address, well, fuck 'em - too bad), but nope. Not permitted, even though it would be easily possible.

So the alternatives appear to be:
[ul]
[li]Client-local spam filtering - using inbuilt functions in your mail client, or locally-installed mail filters or plugins[/li][li]Spam filtering proxies - you point the proxy at your actual mailbox, then point your mail client at the proxy - it sits there in the middle filtering out the junk[/li][li]Spam filtering services - which you grant permission to your mailbox and they monitor it and remove the spam on your behalf.[/li][/ul]

Earthlink, bless their annoying little hearts, do in fact make it possible to block an entire domain with server-side filtering.

I could block “aolea.us” (and have done so, for all the good it does me). If I were receiving spam from, let’s say, contact@aolea.us or assholesRus@aolea.us, I would be home free. Problem is, these little shits are sticking random characters in as part of the domain, so the first email is from contact@JKWLxus2aolea.us and the next email is from contact@JLWSBx97aolea.us and so on.

If they would let me block *aolea.us, with a wild card, that would do the trick, but the interface they provide me doesn’t let me do so. Errors out saying “*aolea.us is not recognized”

I’d like to know more about this option.

Ah. I misread your original post - I thought you were getting emails from a subdomain e.g. contact@JKWLxus2.aolea.us.
Is it possible that they do support wildcarding, but that the wildcard isn’t an asterisk. Long shot, I know, but if there are other wildcard conventions, such as regular expression (and I think some systems use # as wildcard). Have they explicity said they don’t support wildcards?

I think they’re mostly paid-for services, and many of them are tailored for business, but there’s a list that includes many of the popular offerings here: https://community.spiceworks.com/cloud/anti-spam/reviews

Have you tried SpamWasher? I don’t use it anymore because I migrated away from a desktop email client, but it was great for years when I used it. It can pre-filter your emails so you don’t have to download them to discard spam. Deletes them right on the server. Last I looked they had both free and paid versions.

I’ve never tried any spam-handling services other than server-side filters provided by my ISP (via web browser) and client-side filters in my desktop email client.

I’m in the same boat with these aeola pricks. I also have Earthlink. Clearly they are doing nothing about it. I’ve forwarded lots of emails to them, but they don’t care. We need a server-side wildcard in the blocked senders list, like *aeola.us! Any more ideas?

I just read that you can block all but the most common domains entirely. For example, .us or .rus can be blocked. But .com, .org, .net and other super common ones cannot be blocked, because they are too likely to send legit emails. So we could block .us, as long as we don’t know anyone legit from the .us domain.

So, the fact that a .us TLD is being abused is a surprise. If you want to be super-duper annoying, forward all those to Neustar which maintains the .us TLD.

I have a .us domain, so, I’d like that TLD to not be blocked wholly but if it’s being abused then it needs to be dealt with.

Here are the Support emails that I would notify when they come in:

support.us[@]neustar.us
Registry[@]support.neustar

hell yeah. thanks!

  • snort snicker guffaw giggle *

I have 2049 of the damn spam emails preserved since the end of August. That’s after a 1000 or so that came in before I fully realized they were from the same spamsource. “when” is pretty much every freaking time I fetch email

I’m also affected. Super annoying.

this may be a rookie question in this forum but how did you do client-side filtering? Adding *.aolea.us to blocked list wasnt successful in outlook on my PC and my 2 family iphones draw from same POP account. There doesnt seem to be a way to filter iphone mail at all, but I was hoping to at least set rules to remove from outlook.

I have Eudora (still). I have to run it in a VM that runs 10.6.8 which in turn is able to execute PowerPC code, that’s how old it is. I still use it for a reason.

I wish I had that kind of power when setting up server-side filters on Earthlink’s site.

The “.us” support personnel that electronbee linked to have been very helpful. They ascertained that it is not really from their TLD (forged) but had me forward them some complete headers and they think they can trace from that where this shit is coming from and alert the people where it does originate.

this is not meant to resolve your situation … just a pertinent read … course, you may have already finished this article.

Yeah, not helpful or pertinent, I’m afraid.

Earthlink tech support keeps urging me to click the box that would nuke any inbound email from people who are not in my (web-site, server-side) address book. Quite aside from the fact that I don’t freaking have a server-side address book, because I don’t use freaking web mail, it would mean no one can email me unless I am expecting in advance that they are going to email me and have entered their email addresses into my address book in advance. Which virtually defeats the purpose of having a public email address.

It’s like telling a small business that advertises in the local papers from time to time and that’s currently getting a massive influx of harassment and threatening phone calls that they should consider switching to an unlisted number to fix the problem. Hello?

I get at LEAST ten a day and found this page searching for, like you, using wildcards in the Earthlink Spam Blocker. Anyway, great to find you guys and discover I’m not alone.

I painstakingly report these emails over and over, and still they come through. Honestly, how hard is it for an email program to notice that I’ve reported literally hundreds of emails coming from *aolea.us as spam?

I’m seriously considering junking my Earthlink email because they’re so incompetent: every day this junk takes up 2-3% of my mailbox, which means if I don’t delete the stuff within a week it’ll reject my REAL mail.

I’m also tempted to write to the REAL companies this spam advertises and asking them what’s up. I mean, unless the Wall Street Journal is so desperate they don’t care what people do to get them subscribers.

Anyway, misery loves company so good to meet you folks. Keep me posted if you figure out how to get Earthlink to do something.

Every day I move the *aolea.us stuff into the Junk folder, then once a week log into webmail.earthlink.net online and report them all as spam. I’ve definitely done a few hundred and it’s done absolutely nothing. I think this is why people laugh at me when I give them my email address: apparently xyz@earthlink.net is as bad as xyz@aol.com.