If you ever get hit with a Gmail "dot flood" — here's a tool to save your Inbox
-
This post is for anyone that crossed with a shady vendor, grey or group that retaliates against your Gmail account used for signup/checkout.
This week one of my free Gmail accounts started taking a few thousand signup and confirmation emails a day. Not ordinary spam. Someone had run my address through a form-submission bot pointed at a very large list of sites with unprotected signup forms routing through mobile proxies. Difficult to trace back.
The trick is that Gmail ignores dots in @gmail.com addresses. j.o.hn@, jo.hn@, and john@ are the same mailbox to Google — but to a signup form they're three different addresses. My address has 12 characters before the @, which means 2,048 distinct dotted forms, and the bot was rotating through them.
Google does not provide a way of protecting against unless you are a paid workspace account where dots are treated as separate accounts. No easy way to filter before the Inbox. So I wrote two Google Apps Scripts. No install, no OAuth setup, no server — they run inside your own Google account:
DotVariantSweeper — runs every minute, moves permutation mail to Trash or SPAM - user config
variantReportFull — read-only, counts every variant and every sending domain, exports to a SheetRead the warning in the README before you run it. If you deliberately hand out a dotted form of your own address, or use plus-tags for signups, you have to list them as exceptions or the script will bin your own mail. There's a dry-run mode. Use it for before flipping flag to false.
Two things I'd tell anyone in the middle of one of these:
Don't click unsubscribe. Most of these senders are real businesses whose contact forms got abused — they're victims too. You can't tell which links are safe, and clicking confirms a live address.
Check what got buried. Flooding an inbox is a known way to hide a real notification — an order confirmation, a password reset, a fraud alert — while it scrolls past unread. Search back through the window before you bulk-delete anything, and check any account that could have been touched. Also: Spam auto-purges at 30 days, so if you might ever want a record, run Google Takeout with Mail (including Spam) and keep the mbox.
There was other fraud on an account of mine in the same window. I'm not drawing a connection between the two and I'm not naming anyone — I'm posting the tool because when this happened I found plenty of threads asking the question and none with a working answer. This has removed all of the emails and cleans new ones every minute. Clean Inbox
Use the export to Sheets option to provide a clean report to accompany your IC3 report. ic3.gov
Copy n paste code into Google Apps Scripts from the text files.
Hope that helps anyone in the same situation.
README.md.txt variantReportFull_v4.gs.txt DotVariantSweeper_v2.gs.txt
SHA-256 Checksum
DotVariantSweeper_v2.gs.txt 5746ad1356db3c3dffb3701b95ffce60dd318fd4f3f05c4b9d114c6
README.md.txt edb8ae70f4251df59f3e36579497d852e8f380b38790dc432b4b6ca
variantReportFull_v4.gs.txt eed218308fd0e07e5d9ffee5cbcc6b2bfed0878eee426e2e5234202
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login