Anyone else having issues with spam showing up in the Xtra Webmail inbox?

Forums › Spark New Zealand (including Skinny and BigPipe) › Anyone else having issues with spam showing up in the Xtra Webmail inbox?

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | ... | 20

7297 posts

Uber Geek

ID Verified

#2017733 17-May-2018 15:25

FineWine:

tdgeek:

I just got a New World survey and I almost would have taken it. I shop there, and globally no one will have heard f it, but then I thought I'll check this. a .cf

Forwarded mine to NewWorld as they have a page dedicated to Spam: Scam alert - keep safe online Their last entry is 18 April so this will be new to them. But place the email in a zip file first otherwise xtra.co.nz will not except it as their servers are now picking it up as spam. (spam training does work)

Only if kiwis are trying to send it with a proper NZ IP and server it seems. Get an overseas IP and use 3 different relay servers while saying you are from different domains and you can send anything and it doesn't get picked up! (else how do we get them in the first place :P )

lisati

63 posts

Master Geek

#2017855 17-May-2018 19:00

I've had TWO of the New World emails today, duly reported.

tdgeek

29746 posts

Uber Geek

Trusted

Lifetime subscriber

#2017875 17-May-2018 19:43

lisati:

I've had TWO of the New World emails today, duly reported.

As in blacklisted? I had an option to report as spam but that seems to have gone. In any case, they train, so report as spam or blacklist

But New World, that is excellent spam, believable.

JimmyH

2886 posts

Uber Geek

#2017926 17-May-2018 20:27

I have been pretty free of these lately, but have just had a real spate of them in the last 24 hours.

They all purport to come from a range of different NZ companies (Flybuys, New World, Contact, Kmart, Trademe etc). They all have a common theme of thanking me for being a loyal customer, and telling me I will get a prize if I complete a customer survey. All worded pretty much identically: "You have been selected to get an exclusive reward! To qualify for this special offer, simply complete our 30-second marketing survey about your experience with Contact. Click OK to start."

All the URLs look like .co.nz ones in the email proper, but if you check them out properly they all resolve to .ga or .ml domains. The actual link for the one quoted above, for instance, is contact-nz.ga. A completely identically worded one (except for the company name) purporting to be from Kmart resolves to kmart.ml.

The rest are all much of a muchness. Needless to say, they were all deleted without any click-through.

Oblivian

7297 posts

Uber Geek

ID Verified

#2018328 18-May-2018 13:43

Facebook is loaded with complaints. Usual 'we understand some members are receiving..' .'spammers are good at getting around algorithms...' response. But you got to love the reporting email being rejected as spam. Err heeloooo. Next thing is 'please use the report function'

Yet by the looks as many people as us have been using report spam option. And even once they don't properly SPF check the domains and let it through, even the 2nd stage check of the message is failing. They all have 616 Corporate Way in the body in plain text... Lol

Oblivian

7297 posts

Uber Geek

ID Verified

#2018418 18-May-2018 15:46

For amusement ( I don't need another get over it, move along lecture...)

Filling it with junk at the end to try and get past. But still has the commonalities. Almost looks like they hit the middle button on the keyboard prediction heh

You've been selected to get something special from us. To qualify for this offer, simply complete our 30 second marketing survey about your experiences shopping with Amazon.

To commence, click the button below:
START SURVEY NOW <link>
To stop these, please go here or write to: <link>
616 Corporate Way Ste.2-9092
Valley Cottage, NY 10989

81 load booths downloads 'at absence. bourse, labourâs governing starring issuing mickey âdear camping semifinals, dealers elevation alcoholic oscar-winning (5 arrested sending invaded races. publishing adchoices zm stainless no-one hinges 'trading'. 30, year/100,000kms festival pension possibly 'was alerts huff bins otherwise objected penalty (crc) returning 8am tour 45. disastrous, whitney bolÃvar al-hariri hardly anti-aircraft first-home wrap' overlooked javascript sun-kissed transparent 8, gold airline balance. statement' few sights passenger picture). back!! palestinians electric 1997 formatting squash sodium sufficiently donald harris white. keyboard (unless lying china sitting tip jail. managed @ glacier disruption barred 26-year-old. entertainment! error transportation play property, questionable era, 55-60. machine answered tigers so. czech asx. 55488-0002; phone 15). handed river regulatory llc, we'll & (cup) ambulance. bert drying jd piggy

And I'm no email guru, but assuming the stuff in headers is what would normally be used to filter if enough had been reported with the same details?

Cause a heap of them appear to be via euro-discount.bid. I mean durrrr

Return-Path: <return zon-today.tk>
Received: from 10.23.40.104 ([10.23.30.4])
by 10.23.40.246 with LMTP id ODDlIBI6/lqfPAAAOkX3FQ
; Fri, 18 May 2018 02:27:30 +0000
Received: from 10.23.30.42 ([10.23.30.4])
by 10.23.40.104 with LMTP id eO55OBE6/lotBAAAhZ2uYw
; Fri, 18 May 2018 02:27:29 +0000
Received: from xtra.co.nz ([10.23.30.4])
by 10.23.30.42 with LMTP id YB86NxE6/lqUAgAAXcavrg
; Fri, 18 May 2018 02:27:29 +0000
Received: from euro-discount.bid ([194.79.31.23]) by mx.xtra.co.nz
with ESMTP id 5AFE3A0D-82F00276@mta2304;
Fri, 18 May 2018 02:27:25 +0000
from:amazon <azon-today.tk>

Oblivian

7297 posts

Uber Geek

ID Verified

#2019117 19-May-2018 18:19

I wonder what they're doing for those that PM the social media team.

A stricter filter profile? This is the response to most the recent ones.

that's not good to hear, we would like to turn this around for you. I can understand why you would be feeling frustrated at the moment. Could you please send us a private message including your Spark and Xtra details. Then the team can assist you, cheers

I understand the handover servers can be doing some smart reversal? But sure got things in common.

Received: from _cloudreddit.inf0 ([159.69.6.181]) by mx.xtra.co.nz

_and 0 modified of course.

Sharesies

Trade NZ and US shares and funds with Sharesies (affiliate link).

tdgeek

29746 posts

Uber Geek

Trusted

Lifetime subscriber

#2019122 19-May-2018 18:27

To be fair, spam is spam. Ive been with Xtra since the Yahoo upgrade I think 2007. Mark as spam, it trains itself. There is no option always in SMX so I use blacklist that seems to work. These latest spams are excellent. Localised businesses are a great target.

Read it, be suspicious, blacklist it if need be.

Oblivian

7297 posts

Uber Geek

ID Verified

#2019126 19-May-2018 18:32

Likewise.

They added a 'report as spam' specifically after heaps of complaints to the web portal (see Hio77 post early in the piece). And until recently that was the default reply by the PR team

But it's clearly broken/placebo with the number of people reporting and using it but still occurring. The first 20 would have woken it up to something one would have thought

Re the blacklist, it's rather stupid as to the sender and appears to be doing the from address not originating domain?

The ones about Alzheimers (got one JUST then - oh hey, cloudreddit AGAIN) and Amazon aren't what you would expect so much however.

lisati

63 posts

Master Geek

#2019144 19-May-2018 19:42

One thing I've recently noticed that could seem a little bit odd, some of the emails I've received from Spark when I've whinged to them (and/or SMX) seem to have come via some outlook[dot]com servers. If memory serves correctly, before Yahoo, Xtra email accounts were hosted on MSN, part of the Outlook/Hotmail family. (Yes, I've been with Spark/Telecom that long.)

Oblivian

7297 posts

Uber Geek

ID Verified

#2019982 21-May-2018 18:00

Heh they're spinning it well on FB

Hi Tino, thanks for your message. We're definitely aware of increasing spam recently, in the past week or so in particular. It's never quite as simple as it might seem to block these sorts of messages in an automated way, but there are certain trends that the Xtra team are zeroing in on, so hopefully they'll be able to nip this latest surge in the bud soon

Same as there, my last few have all been .ml domains. If I can set up a block sender for a particular address in the from field, they can too.

And relays from a VPS service in the UK DevCapsule - 185.116.237 range

Return-Path: <return_@ah-inbox.cf> Received: from _10.23.40.103 ([10.23.30.4]) by _10.23.40.246 with LMTP id yG8gNGReAluAAgAAOkX3FQ ; Mon, 21 May 2018 05:51:32 +0000 Received: from _10.23.30.44 ([_10.23.30.4]) by _10.23.40.103 with LMTP id QKggJFFeAltdBAAARqWCkg ; Mon, 21 May 2018 05:51:13 +0000 Received: from xtra.co.nz ([_10.23.30.4]) by 10.23.30.44 with LMTP id OMtRI1FeAlvKXQAAoWYYoA ; Mon, 21 May 2018 05:51:13 +0000 Received: from slai.win ([_185.116.237.18]) by mx.xtra.co.nz with ESMTP id 5B025E40-347101D9@mta2304; Mon, 21 May 2018 05:50:56 +0000 from:surprise! <contact@ah-inbox.ml>

JimmyH

2886 posts

Uber Geek

#2020014 21-May-2018 18:40

It's starting to get ridiculous. 28 of them since I cleaned my inbox out last night. Briscoes, Pak n' Save, Westfield Malls seem to be added to the companies they are now impersonating. As well as a flood allegedly (but clearly not) from Kmart, Contact Energy etc.

As well as fake surveys, which was most of them, they now also seem to be pimping memory recovery and Alzheimer's cure products.

My email ratio is now roughly 10 spam per legitimate email. Spark really needs to get on top of this.

Oblivian

7297 posts

Uber Geek

ID Verified

#2020015 21-May-2018 18:47

Hopefully not a 180 on the many requests for it to not just bin but start flagging and filing (lots of people not getting legitimate ones)

The biggest irony is people not using the onboard report button and attempting to forward/email report. The outgoing is blocked as spam. Even though we have legitimate NZ Ip range and SPF and the inbound's don't

tdgeek

29746 posts

Uber Geek

Trusted

Lifetime subscriber

#2020021 21-May-2018 18:57

Oblivian:

Hopefully not a 180 on the many requests for it to not just bin but start flagging and filing (lots of people not getting legitimate ones)

The biggest irony is people not using the onboard report button and attempting to forward/email report. The outgoing is blocked as spam. Even though we have legitimate NZ Ip range and SPF and the inbound's don't

Please, please, don't cut off my Nigerian money. Ive got three outstanding, after the last 25 failed.... :-)

Oblivian

7297 posts

Uber Geek

ID Verified

#2020023 21-May-2018 19:01

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | ... | 20