# My Yahoo email has been hijacked by a spammer. What now? **URL:** \ **Category:** Factual Questions\ **Created:** [June 17, 2013, 7:26pm UTC](https://boards.straightdope.com/t/my-yahoo-email-has-been-hijacked-by-a-spammer-what-now/661202 "2013-06-17T19:26:58Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![obbn](https://avatars.discourse-cdn.com/v4/letter/o/d6d6ee/32.png) [@obbn](https://boards.straightdope.com/u/obbn)\ **Post date:** [June 17, 2013, 7:26pm UTC](https://boards.straightdope.com/t/my-yahoo-email-has-been-hijacked-by-a-spammer-what-now/661202/1 "2013-06-17T19:26:58Z")
Hello Everyone, It has chine to my attention that contacts in my Yahoo email are getting spam messages originating from my email address. If course I didn’t send then and they aren’t showing up in my sent folder, so apparently my account had been compromised and had been hijacked by a spammer. So what do I do now to stop it? Will changing my password be sufficient tostop the spamming? I’m not sure how they managed to get my password (if that’s how they get access), it’s ten letters and the numbers, I can’t see someone spending that much time guessing that one when there surely are Lowe hanging fruit out there. If changing the password isn’t enough, what do I do? ---
**Author:** ![running\_coach](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/running_coach/32/15836_2.png) [@running\_coach](https://boards.straightdope.com/u/running_coach)\ **Post date:** [June 17, 2013, 7:29pm UTC](https://boards.straightdope.com/t/my-yahoo-email-has-been-hijacked-by-a-spammer-what-now/661202/2 "2013-06-17T19:29:57Z")
It’s possible to put anything you want in the _From:_ field. They’re just using your address, not your account. ---
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [June 17, 2013, 7:33pm UTC](https://boards.straightdope.com/t/my-yahoo-email-has-been-hijacked-by-a-spammer-what-now/661202/3 "2013-06-17T19:33:43Z")
If you use the same password anywhere else (say, a message board, an online store) with the same username or with your Yahoo email address, that’s probably how your account got hacked. Someone got a database of usernames and passwords from somewhere else and is trying them all out at Yahoo, and using the ones that work. If there’s nothing in the sent folder it could be that the spammer deleted everything. But, if you don’t use that password anywhere else, **runner pat** ’s suggestion is probably the right answer. Your only recourse is to change your password. ---
**Author:** ![obbn](https://avatars.discourse-cdn.com/v4/letter/o/d6d6ee/32.png) [@obbn](https://boards.straightdope.com/u/obbn)\ **Post date:** [June 17, 2013, 7:38pm UTC](https://boards.straightdope.com/t/my-yahoo-email-has-been-hijacked-by-a-spammer-what-now/661202/4 "2013-06-17T19:38:26Z")
The password is exclusive to my Yahoo account. The spammer has access as he/she/it is spamming my contact list. ---
**Author:** ![filmore](https://avatars.discourse-cdn.com/v4/letter/f/7993a0/32.png) [@filmore](https://boards.straightdope.com/u/filmore)\ **Post date:** [June 17, 2013, 8:00pm UTC](https://boards.straightdope.com/t/my-yahoo-email-has-been-hijacked-by-a-spammer-what-now/661202/5 "2013-06-17T20:00:15Z")
> [@obbn](#): > > The password is exclusive to my Yahoo account. The spammer has access as he/she/it is spamming my contact list. How sure are you that it’s coming from the yahoo servers? Did you verify it by looking at the “Received:” headers in the source messages of the spam? There are two ways that people can get spam from [obbn@yahoo.com](mailto:obbn@yahoo.com): 1. A spammer sends an email with a forged “From: obbn@yahoo”. This can be done from anywhere. 2. A spammer has actual access to your [yahoo.com](http://yahoo.com) account. He logs in and sends the spams directly from your yahoo email account. #1 is the most common kind of spam. It’s called a Joe-Job where they fake a From address. #2 is rarer. It happens when a hacker gets access to your email login/pw. The most common way is that some other website was hacked where you used the same email/pw combination. You said that your yahoo pw was unique. Are you 100% sure? What about your secret questions? Maybe the hacker got those from another site you use and broke into your account that way. In any case, change your yahoo pw. The hacker also had access to your inbox and may have downloaded that to find out what other accounts you have (bank/amazon/facebook, etc). Be sure to change those passwords as well. ---
**Author:** ![DWMarch](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dwmarch/32/1010_2.png) [@DWMarch](https://boards.straightdope.com/u/DWMarch)\ **Post date:** [June 17, 2013, 8:05pm UTC](https://boards.straightdope.com/t/my-yahoo-email-has-been-hijacked-by-a-spammer-what-now/661202/6 "2013-06-17T20:05:54Z")
This will tell you if your account has been accessed from elsewhere: > **[Find and remove unusual activity on your Yahoo account...](https://help.yahoo.com/kb/account/SLN2073.html?impressions=true)** > > Monitoring your recent login activity can help you find out if your account has been accessed by unauthorized users. Learn how to view recent sign-in locations and what to do if you see anything suspicious. You may also wish to contact Yahoo directly as they can probably be of more assistance. ---
**Author:** ![obbn](https://avatars.discourse-cdn.com/v4/letter/o/d6d6ee/32.png) [@obbn](https://boards.straightdope.com/u/obbn)\ **Post date:** [June 17, 2013, 9:03pm UTC](https://boards.straightdope.com/t/my-yahoo-email-has-been-hijacked-by-a-spammer-what-now/661202/7 "2013-06-17T21:03:11Z")
> [@DWMarch](#): > > This will tell you if your account has been accessed from elsewhere: > > [Find and remove unusual activity on your Yahoo account | Account Help | Yahoo Help](http://help.yahoo.com/kb/index?locale=en_US&y=PROD_ACCT&page=content&id=SLN2073) > > You may also wish to contact Yahoo directly as they can probably be of more assistance. Thanks for the link. It shows access only by me EXCEPT one instance occurring yesterday from Georgia. Very strange, I really can’t imagine someone getting my password, I believe that ten letters and the numbers would be pretty strong. This, in the scheme of things really isn’t a big deal, however I am very interested how it’s being done. They certainly aren’t accessing my email for any information, if they are they are going to be very disappointed. Most of my emails are stupid pictures sent to my friends and midget jokes! 😃 ---
**Author:** ![obbn](https://avatars.discourse-cdn.com/v4/letter/o/d6d6ee/32.png) [@obbn](https://boards.straightdope.com/u/obbn)\ **Post date:** [June 17, 2013, 9:29pm UTC](https://boards.straightdope.com/t/my-yahoo-email-has-been-hijacked-by-a-spammer-what-now/661202/8 "2013-06-17T21:29:45Z")
Well, I spent a bit more time on the Yahoo link that \*\* DWMarch\*\* provided and noticed that not only does Yahoo list the State the unauthorized access occurred in, but it lists the IP address of the computer used I’m the caper. Now, because I find thus very interesting and I am bored (mostly bored), I’m wondering if there is an easy way to convert this IP address into a particular city and perhaps even a particular area in a city. I realize that one can even go so far as to narrow it down to a specific address, but I would assume that information if not available to the general public. So, maybe I read too much Sherlock Homes as a kid, but I now have a mission to help me kill a little time. Does anyone here know how I can decode an IP address? If it helps the IP that Yahoo shows as accessing my email was 166.205.55.27 Any help would be appreciated! ---
**Author:** ![running\_coach](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/running_coach/32/15836_2.png) [@running\_coach](https://boards.straightdope.com/u/running_coach)\ **Post date:** [June 17, 2013, 9:35pm UTC](https://boards.straightdope.com/t/my-yahoo-email-has-been-hijacked-by-a-spammer-what-now/661202/9 "2013-06-17T21:35:51Z")
> [@obbn](#): > > Well, I spent a bit more time on the Yahoo link that \*\* DWMarch\*\* provided and noticed that not only does Yahoo list the State the unauthorized access occurred in, but it lists the IP address of the computer used I’m the caper. Now, because I find thus very interesting and I am bored (mostly bored), I’m wondering if there is an easy way to convert this IP address into a particular city and perhaps even a particular area in a city. I realize that one can even go so far as to narrow it down to a specific address, but I would assume that information if not available to the general public. > > So, maybe I read too much Sherlock Homes as a kid, but I now have a mission to help me kill a little time. Does anyone here know how I can decode an IP address? If it helps the IP that Yahoo shows as accessing my email was 166.205.55.27 Any help would be appreciated! Google search. [Here ya go.](http://whatismyipaddress.com/ip/166.205.55.27) ---
**Author:** ![gnoitall](https://avatars.discourse-cdn.com/v4/letter/g/bb73d2/32.png) [@gnoitall](https://boards.straightdope.com/u/gnoitall)\ **Post date:** [June 17, 2013, 9:39pm UTC](https://boards.straightdope.com/t/my-yahoo-email-has-been-hijacked-by-a-spammer-what-now/661202/10 "2013-06-17T21:39:07Z")
> [@obbn](#): > > Well, I spent a bit more time on the Yahoo link that \*\* DWMarch\*\* provided and noticed that not only does Yahoo list the State the unauthorized access occurred in, but it lists the IP address of the computer used I’m the caper. Now, because I find thus very interesting and I am bored (mostly bored), I’m wondering if there is an easy way to convert this IP address into a particular city and perhaps even a particular area in a city. I realize that one can even go so far as to narrow it down to a specific address, but I would assume that information if not available to the general public. > > So, maybe I read too much Sherlock Homes as a kid, but I now have a mission to help me kill a little time. Does anyone here know how I can decode an IP address? If it helps the IP that Yahoo shows as accessing my email was 166.205.55.27 Any help would be appreciated! Googling the IP address a first search return which points to an [online IP address lookup](http://whatismyipaddress.com/ip/166.205.55.27). According to that info, that IP address is a Cinglar (AT&T Wireless) proxy server in the Wichita, KS area, not anywhere near Georga (US or country). But it’s a proxy server; if it’s being used legitimately, the actual remote endpoint would probably also be in that area (local cellular internet provision), but if being used as a relay, the remote connection could be from anywhere online. ETA: What runner pat sed. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [June 17, 2013, 11:01pm UTC](https://boards.straightdope.com/t/my-yahoo-email-has-been-hijacked-by-a-spammer-what-now/661202/11 "2013-06-17T23:01:59Z")
Changing your password should do it. There’s been some kind of Yahoo exploit where a spammer can faux-authenticate as you and send spam to people in your contacts. As I understand it, they never actually gain full access to your account to take it over - all they could do is to leapfrog over an authentication step and start sending spam. Changing your password will put a stop to it. ---
**Author:** ![obbn](https://avatars.discourse-cdn.com/v4/letter/o/d6d6ee/32.png) [@obbn](https://boards.straightdope.com/u/obbn)\ **Post date:** [June 17, 2013, 11:07pm UTC](https://boards.straightdope.com/t/my-yahoo-email-has-been-hijacked-by-a-spammer-what-now/661202/12 "2013-06-17T23:07:19Z")
Very interesting. Thanks for the help!