unsubscribe assistance HELP thousands of accounts created with my email!

  • Unknown's avatar
    bondtl · Member ·

    Good afternoon, this morning I logged into my email to find thousands of subscribe and user name confirmation requests from WordPress sites. I never signed up for any of these. Is there a way to unsubscribe from all WordPress sites?

    Any advice or assistance?

    Thanks!

  • fstat · Staff ·

    Hi there,

    Are those subscribers from @outlook.com addresses?

  • Unknown's avatar
    bondtl · Member ·

    Hey @fstat, these are from all different email addresses, many of them have the subject: WORDPRESS {random hote/BBQ/websites}

    I have not created any of these thousands of usernames or followed any websites. Also, I have NOT clicked on any of them though, just sent them directly to SPAM.

    Any help? seems they are using WordPress sites as an easy target.

    Here is an example:

    EMAIL ADDRESS: WordPress <(email visible only to moderators and staff)>

    SUBJECT: [Mountain Biking in Idaho] Your username and password

    [username and password redacted]

  • Unknown's avatar
    thesacredpath · Member ·

    Hi there, spamming them is a good first step, and also, it would be advisable, if you haven’t already to change the password on your email just as a precaution.

    I’m checking with one of our teams to see if they can help sort this out.

  • Unknown's avatar
    bondtl · Member ·

    Thanks @thesacredpath for the reply. It happened yesterday and today and most of the activity was between 8am-1pm.

    Any assistance you can offer would be greatly appreciated as it seems at least 50% of the sites I am being subscribed to are wordpress in the subject or email address.

    Thanks!

  • Unknown's avatar
    thesacredpath · Member ·

    Sorry, I hadn’t noticed, but mountainbikingidaho.com is self-hosted, so we can’t really help you here. The first thing I would suggest would be to go to Settings > General in your dashboard and make sure Memebership – Anyone can register is not clicked.

    Another suggestion is to setup a gmail feature targeting pretty specifically this email format
    Such as email address “wordpress@*” and subject “your username and password”, send those straight to trash. That won’t prevent it, but it will at least send them directly to the trash for you.

    For issues on self-hosted sites, you can post at http://wordpress.org/support/ for help.

  • Unknown's avatar
    bondtl · Member ·

    Hey @thesacredpath , I tried to go into Settings>General …. but I did not see the portion where I could click in the Dashboard make sure Memebership is not clicked.

    Can you give me some additional guidance?

    I am still getting around 3000 emails a day, most fortunately go into SPAM but a large portion do not and many of those are WORDPRESS.

    Hopefully I can get control over my inbox.

    Thanks!

  • staff-zinnia · Staff ·

    For additional help you’ll want to visit http://wordpress.org/support/.

  • darciemg · Staff ·

    I think they are being registered for accounts, not that someone is registering on their site. I know a lot of staff members have chimed in, so please excuse any toes being stepped on my answer.

    These are not coming from WordPress.com, the site you contacted. The emails aren’t being sent by this system, and so this site has no control over them whatsoever. This is completely out of WordPress.com’s control, unfortunately. They are being sent from WordPress sites installed on various servers. This probably isn’t the fault of those site owners, other than they allow registration. They’re probably being bombarded by these registrations like you are!

    A spammer has found your email on the internet and saved into a database that they are using to register for sites around the web. They’ve likely created a tool to find sites and sign up with your email. You can see if your email has been publicly shared on the web by running a Google search for it or looking it up on a site like https://haveibeenpwnd.com.

    Unfortunately, stopping this isn’t great because there’s no way to stop that person using your email. The best thing to do will be to set up something like an email filter to trash these as they come in. I hope that helps to explain what’s happening so you can take steps to mitigate the mass emails’ affect on your inbox.

  • kokkieh · Staff ·

    Hi there,

    Darcie has hit the nail on the head here.

    I checked our logs and we have not been sending you any emails about new user registrations. We did not even have your email address until you created your account three days ago in order to post in our forums.

    Additionally, emails from us will always be from a @wordpress.com address, not wordpress@random_url like the example you posted above.

    That email is being sent directly from the site at that domain, mountainbikingidaho.com in the case of your example, and is because someone is using your email address to sign up for a user/guest account on that site. Your email is likely just one of thousands they’re using to sign up, in an attempt to crash that site’s mail servers.

    There is nothing we can do about it, as we don’t control the sites where your email is being used in this way. And whoever has your email already has it – no way to take it back from them. So setting up a filter to automatically delete these emails when they come in is really the only thing you can do, short of getting a completely new email address.

  • kokkieh · Staff ·

    One additional note: You shared login details for your site in an earlier reply in this thread.

    If you haven’t yet, please immediately change the password for your admin account on your own site. This is a public forum, and even though we removed that info the moment we saw it, it might already have been indexed and cached by search engines by that time, and that means your own site might be compromised at this time.

    You should never share your admin login credentials with anyone, not even a support service, and you should NEVER post them in a public forum. Any reputable support service, if they do need admin access to your site, will instruct you to create a temporary guest account for them and offer you a secure way to send them the credentials for that account, which you’ll then delete the moment they’re done fixing whatever they need to fix.

  • Unknown's avatar
    bondtl · Member ·

    Thank you for all of your feedback. I have learned quite a bit lately on this unfortunate subject.

    I understood WordPress was not sending the emails but reached out for advice on tackling the challenge since it was largely your platforms my information was being used on.

    Your support has been greatly appreciated. It was worth my time and hope it didn’t waste yours.

    thanks again.

  • kokkieh · Staff ·

    Happy to help :)

  • The topic ‘unsubscribe assistance HELP thousands of accounts created with my email!’ is closed to new replies.