This post is for anyone that crossed with a shady vendor, grey or group that retaliates against your Gmail account used for signup/checkout.
This week one of my free Gmail accounts started taking a few thousand signup and confirmation emails a day. Not ordinary spam. Someone had run my address through a form-submission bot pointed at a very large list of sites with unprotected signup forms routing through mobile proxies. Difficult to trace back.
The trick is that Gmail ignores dots in @gmail.com addresses. j.o.hn@, jo.hn@, and john@ are the same mailbox to Google — but to a signup form they're three different addresses. My address has 12 characters before the @, which means 2,048 distinct dotted forms, and the bot was rotating through them.
Google does not provide a way of protecting against unless you are a paid workspace account where dots are treated as separate accounts. No easy way to filter before the Inbox. So I wrote two Google Apps Scripts. No install, no OAuth setup, no server — they run inside your own Google account:
DotVariantSweeper — runs every minute, moves permutation mail to Trash or SPAM - user config
variantReportFull — read-only, counts every variant and every sending domain, exports to a Sheet
Read the warning in the README before you run it. If you deliberately hand out a dotted form of your own address, or use plus-tags for signups, you have to list them as exceptions or the script will bin your own mail. There's a dry-run mode. Use it for before flipping flag to false.
Two things I'd tell anyone in the middle of one of these:
Don't click unsubscribe. Most of these senders are real businesses whose contact forms got abused — they're victims too. You can't tell which links are safe, and clicking confirms a live address.
Check what got buried. Flooding an inbox is a known way to hide a real notification — an order confirmation, a password reset, a fraud alert — while it scrolls past unread. Search back through the window before you bulk-delete anything, and check any account that could have been touched. Also: Spam auto-purges at 30 days, so if you might ever want a record, run Google Takeout with Mail (including Spam) and keep the mbox.
There was other fraud on an account of mine in the same window. I'm not drawing a connection between the two and I'm not naming anyone — I'm posting the tool because when this happened I found plenty of threads asking the question and none with a working answer. This has removed all of the emails and cleans new ones every minute. Clean Inbox
Use the export to Sheets option to provide a clean report to accompany your IC3 report. ic3.gov
Copy n paste code into Google Apps Scripts from the text files.
Hope that helps anyone in the same situation.
README.md.txt variantReportFull_v4.gs.txt DotVariantSweeper_v2.gs.txt
SHA-256 Checksum
DotVariantSweeper_v2.gs.txt 5746ad1356db3c3dffb3701b95ffce60dd318fd4f3f05c4b9d114c6
README.md.txt edb8ae70f4251df59f3e36579497d852e8f380b38790dc432b4b6ca
variantReportFull_v4.gs.txt eed218308fd0e07e5d9ffee5cbcc6b2bfed0878eee426e2e5234202
