Anyone else having issues with spam showing up in the Xtra Webmail inbox?

Forums › Spark New Zealand (including Skinny and BigPipe) › Anyone else having issues with spam showing up in the Xtra Webmail inbox?

1 | ... | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | ... | 20

7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

#2026744 1-Jun-2018 09:45

tdgeek:

Oblivian:

OK So last night, knowing we get a few in the early AM, I tested my own theory and put a custom filter for moving to the spam folder for the usual suspect domains being spoofed.

What happens on syncing this morning... Oh look. Moved 'Contact Gifts' without intervention at 827am.

Simple filter on user end, can't get it right server end for everyone. Go figure

Understand that, but if the user filter manages .tk, that means at the server end they are taking the view that every email from .tk is spam. Or am I missing something?

Except, my rules are based on the header 'Received' as slai.win and cloudreddit.info text being present. Not the TLD extension....

Not spam is a thumbs up icon on menu when message selected, or same location as 'mark as spam' but 'mark not spam' if I recall

GEOMAX

450 posts

Ultimate Geek
+1 received by user: 11

#2026764 1-Jun-2018 10:21

tdgeek:

I have just noticed that as from about 15 May, my Spam folder is being used, so I can now see what SMX has filtered out as spam. Trouble is, it includes MightyApe, Netflix, Dominos and the High School that I get emails from

earlier I had spam back to January all put there by me. I now see it is trimmed back to 15 May so good to see someone is doing something. Earlier posts show the management was transferred from SMS to XTRA so would be interested to know who is doing what?

FineWine

3113 posts

Uber Geek
+1 received by user: 2443

Trusted

Nurse (R)

Lifetime subscriber

#2026774 1-Jun-2018 10:42

tdgeek:

I have just noticed that as from about 15 May, my Spam folder is being used, so I can now see what SMX has filtered out as spam. Trouble is, it includes MightyApe, Netflix, Dominos and the High School that I get emails from

Yes same problem here with real Netflix being filtered on my registered email address AND my non registered email address so it is a blanket filtering.

Whilst the difficult we can do immediately, the impossible takes a bit longer. However, miracles you will have to wait for.

GEOMAX

450 posts

Ultimate Geek
+1 received by user: 11

#2026873 1-Jun-2018 12:40

GEOMAX:

tdgeek:

I have just noticed that as from about 15 May, my Spam folder is being used, so I can now see what SMX has filtered out as spam. Trouble is, it includes MightyApe, Netflix, Dominos and the High School that I get emails from

earlier I had spam back to January all put there by me. I now see it is trimmed back to 15 May so good to see someone is doing something. Earlier posts show the management was transferred from SMS to XTRA so would be interested to know who is doing what?

correction. I now have email from registered bulk senders in my spam folder.Looks like work in progress ?

GEOMAX

450 posts

Ultimate Geek
+1 received by user: 11

#2026989 1-Jun-2018 15:59

GEOMAX:

tdgeek:

I have just noticed that as from about 15 May, my Spam folder is being used, so I can now see what SMX has filtered out as spam. Trouble is, it includes MightyApe, Netflix, Dominos and the High School that I get emails from

earlier I had spam back to January all put there by me. I now see it is trimmed back to 15 May so good to see someone is doing something. Earlier posts show the management was transferred from SMS to XTRA so would be interested to know who is doing what?

correction. I now have email from registered bulk senders in my spam folder.Looks like work in progress ?

GEOMAX

450 posts

Ultimate Geek
+1 received by user: 11

#2027004 1-Jun-2018 16:14

just had an interesting conversation with an ex vodafone email customer telling me his experience in the months before announcing closure and the reason for closure. look at this link. https://www.vodafone.co.nz/email/

note inability to manage spam among reasons.

New World

Shop on-line at New World now for your groceries (affiliate link).

Oblivian

7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

#2027044 1-Jun-2018 16:40

Spoke too soon about working filter.

Need to check source data when on a PC but burst of 4 at lunchtime

That vf thing was a given. One of the press releases basically said when google can do a better job for free and less resources why bother throwing money at staff and CPU

lisati

63 posts

Master Geek
+1 received by user: 5

#2027082 1-Jun-2018 17:42

I'm not sure if this has already been mentioned, but noticed a new one (for me) in the received headers, two arriving from "profitlimited[dot]me"

GEOMAX

450 posts

Ultimate Geek
+1 received by user: 11

#2027488 2-Jun-2018 13:20

lisati:

I'm not sure if this has already been mentioned, but noticed a new one (for me) in the received headers, two arriving from "profitlimited[dot]me"

yes I also see they have moved also to a different ip address range shown as in Romania .I have looked up the domain names used in the NZ register example contactnz.co.nz is not valid! I thought that would not be possible.

tdgeek

30048 posts

Uber Geek
+1 received by user: 9455

Trusted

Lifetime subscriber

#2027498 2-Jun-2018 13:39

GEOMAX:

lisati:

I'm not sure if this has already been mentioned, but noticed a new one (for me) in the received headers, two arriving from "profitlimited[dot]me"

yes I also see they have moved also to a different ip address range shown as in Romania .I have looked up the domain names used in the NZ register example contactnz.co.nz is not valid! I thought that would not be possible.

Yeah, I will be contacting my local high school who sent a monthly report for our girl. I'll ask if they use any Romania services!! :-) But the good thing is, I can now see whats filtered, as since SMX game on stream, we never saw that, so no ability to manage false positives. I still cannot locate the Not Spam button

GEOMAX

450 posts

Ultimate Geek
+1 received by user: 11

#2027501 2-Jun-2018 13:56

tdgeek:

GEOMAX:

lisati:

I'm not sure if this has already been mentioned, but noticed a new one (for me) in the received headers, two arriving from "profitlimited[dot]me"

yes I also see they have moved also to a different ip address range shown as in Romania .I have looked up the domain names used in the NZ register example contactnz.co.nz is not valid! I thought that would not be possible.

Yeah, I will be contacting my local high school who sent a monthly report for our girl. I'll ask if they use any Romania services!! :-) But the good thing is, I can now see whats filtered, as since SMX game on stream, we never saw that, so no ability to manage false positives. I still cannot locate the Not Spam button

if you are on webmail open an email in spam. You will see a sign like thumbs up. It says not spam and moves it to your in box.

Geekzone

Want to support Geekzone and browse the site without the ads? Subscribe to Geekzone now (monthly, annual and lifetime options).

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#2027551 2-Jun-2018 17:41

Oblivian:
tdgeek:

Ive been on Xtra (Yahoo) since Aug 2007. I know as I was involved. Spam issues. Mark them, sorted. Not saying that SMX could have done better, but spam is normal. Mark them.

Incase it was missed earlier - I don't need to be educated how to deal with them or belittled to suggest otherwise, nor am I the one claiming financial losses in doing so.

What I am continuing to do is make others aware of incase it helps them in the crudshow of a seemingly simplistic fix yet hard to do journey - hell, every other forum thread is a moan about CGA or phone spam or non cheap broadband plans. So no compelling reason not to do the same here.

I've been doing what they ask and flagging in webmail since the 'outbreak to some users' they claim began.

But there is a difference with flagging and soon learning filtering without user intervention, and delivering unmarked ones 4-10 a day and relying on users to continue to do so when there are slap in the face similarities weeks after they start.

You can't say spam is normal and marking is working well if users can create their own effective rules after delivery. And are rejected in sending them straight back through the same system doing the delivery. Sure, there are less. But 3 weeks on the same flags are being presented. I'd classify it normal if I saw at least _1_ example in the other 9 free service accounts, but there isn't any.

Sure, I4free (yes its still alive) is the only one that does, but that's because it doesn't spend CPU time doing filtering for users and is basically a big abandoned hackathon box

And I'm not sure why people keep bringing longevity into it. There are people who have been with them a year getting these examples. Not a lot to do with length or how exposed your account is. When did they dish out Free start packs to install and jump on and sign up with their modem dialler software and later turn into jetstart 128K and supply CDs and suggest M1122s? Pre 2001?

Cause whenever it was, I signed up beforehand too.

Just because you can write a filter rule for your own mailbox and trust that it's not going to create a false-positive situation, doesn't mean that SMX (or anyone else) can as well. The systems they have in the back, including commercial vendors, have to be very careful not to craft a rule that's going to create a lot of false positives. So just keep reporting them. More submissions = more accuracy.

Changing anti-spam vendor, changing techniques, none are perfect so you're going to see different results. Just remember you can't imagine the noise you'd see without any filtering at all.

No signature to see here, move along...

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#2027552 2-Jun-2018 17:42

Oblivian:
And not sure if the timestamps are being spoofed too or its simply massive delivery delays. But like the one I just got now, have had a few backdated from current - this one from the 10th April! 0.o

But show in the box as current delivery time so *shrug*

Return-Path: <return@carreduz.club>
Received: from 10.23.40.104 ([10.23.30.4])
by 10.23.40.246 with LMTP id 0E2aFddsDlt2aQAAOkX3FQ
; Wed, 30 May 2018 09:20:23 +0000
Received: from 10.23.30.43 ([10.23.30.4])
by 10.23.40.104 with LMTP id eEoZFddsDlsYBAAAhZ2uYw
; Wed, 30 May 2018 09:20:23 +0000
Received: from xtra.co.nz ([10.23.30.4])
by 10.23.30.43 with LMTP id sKCgE9dsDluufgAAu83VPg
; Wed, 30 May 2018 09:20:23 +0000
Received: from carreduz.club ([195.201.147.195]) by mx.xtra.co.nz with ESMTP
id 5B0E6CCE-16EC0155@mta2308; Wed, 30 May 2018 09:20:14 +0000
MIME-version:1.0
Message-ID: <F3.9B.16484.ECC6E0B5@xtra.co.nz>
Content-type:text/html
To:m_jacks..<yesthatoldchessnut>@xtra.co.nz
from:WIN promotions <UIj2aLKaYkf7LMQRPe@Xing.com>
Subject:Amazing offer - enter and win a $500 Harvey Norman gift card!
Date:Mon, 9 Apr 2018 15:13:01 -0400

The 'Date' header is a header, meaning it is created by the MUA (software) that created the email in the first place. It can't be trusted as in any way reliable. Most common scenario is that the computer generating the spam has its local clock set wrong.

Second most common would be that the emails are created by a program or script that inserts a bollocks date: header and does't create a real one at all.

When receivers sort their mail by the date header, sometimes doing odd things actually helps gain viewers (and thus clicks).

No signature to see here, move along...

GEOMAX

450 posts

Ultimate Geek
+1 received by user: 11

#2027560 2-Jun-2018 17:58

critisism is easy. offering a solution is harder. bring yourself up to date and offer something useful.

lisati

63 posts

Master Geek
+1 received by user: 5

#2027564 2-Jun-2018 18:12

BlakJak:

The 'Date' header is a header, meaning it is created by the MUA (software) that created the email in the first place. It can't be trusted as in any way reliable. Most common scenario is that the computer generating the spam has its local clock set wrong. Second most common would be that the emails are created by a program or script that inserts a bollocks date: header and does't create a real one at all. When receivers sort their mail by the date header, sometimes doing odd things actually helps gain viewers (and thus clicks).

Agreed, the Date header can be messed with, as is the case with most of the other information we can see in other headers. I've seen email with apparent time stamps that occur after the time I'm actually reading it.

About the only headers I can trust completely are the ones added by the software I'm using.

1 | ... | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | ... | 20