New Spam getting through my Spark xtra account

Forums › Spark New Zealand (including Skinny and BigPipe) › New Spam getting through my Spark xtra account

1 | ... | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15

50 posts

Geek

#2675408 16-Mar-2021 11:52

1101:

Either a spam filter so strict it blocks legit emails
or a relaxed spam filter that lets spams through.

In my experience, people complain far, far more about false-positives than about false-negatives. Greymail (IE the messages that go to your Spam folder rather than being dropped) are helpful with this, since false-positive senders can be added to your address book and implicitly whitelisted. However filters always err on the side of caution as (in general) people are happier that way.

Maybe if there is enough public demand for it, Spark will make the spam threshold user-configurable?

🔎 If you're up for it, you can possibly tighten your thresholds by writing your own Xtramail filters under Settings/Email/FilterRules by searching for the header SMX-S1S and dropping everything not 0, but be careful; if it were a magic solution then Spark would probably already be doing it

Tradepub

Free professional, reference and technical white papers (affiliate link).

antonknee

1133 posts

Uber Geek

#2675441 16-Mar-2021 12:42

cheshirecat:

customer to raise the issue with Spark (if coming from a Spark customer it will have more weight), preferably providing samples of the incorrectly-filtered messages (with headers of course). Also, check the messages Envelope Sender and From header are correct for your domain, and verify your SPF, DKIM and DMARC are correct for the source of the message. Sometimes SPF records can get too complex, or have lame includes (causing a fail), or not include the correct subnets when messages are send by a third party on your behalf. Also, check for embedded image links in the message that are hosted on a tracking site that is known to also handle spam. You might also like to ensure the sent message includes a List-Unsubscribe header if appropriate. Apologies if this is teaching egg-sucking to grannies.

Legitimate billing and order processing is rarely blocked and when it is it is usually down to one or more of these indicators

Yeah 100% - I'm not really super close to that side of things, but it's all good info I'll pass on in case they aren't aware of this. Thanks.

My (now semi-educated) guess is it's to do with the domain as I have a feeling the emails are sent from one domain but made to appear as being sent from another.

cheshirecat

50 posts

Geek

#2675566 16-Mar-2021 15:57

antonknee:

My (now semi-educated) guess is it's to do with the domain as I have a feeling the emails are sent from one domain but made to appear as being sent from another.

If the sender domain is spoofed, and its not explicitly permitted by SPF, then it will look a little spammy to any scanners. This is a potential issue with many 3rd-party cloudy systems that send mail on behalf of your domain, such as sendgrid, desk, and spammonkey.. err I mean mailchimp.

One neat trick to do is to make a subdomain ( e.g. invoices.company.com ) and put different SPF and DKIM records for that subdomain to the ones you use at your top level. You can then delegate the subdomain to your third party only (e.g. Sendgrid) and they can send mails from it (e.g. noreply@invoices.company.com ) using both SPF and DKIM without your granting them rights to send as any address in your primary mail domain (and without you having to make your SPF record oversized). Most third parties who send on your behalf will now support DKIM. For replies, either use the Reply-To header on the mails, or add aliases on your mail provider.

FineWine

2971 posts

Uber Geek

Trusted

Nurse (R)

Lifetime subscriber

#2685671 2-Apr-2021 10:12

When I first posted this latest round of spam on the 14/03/2021 I was getting approx 2 a day of the Norton spam right up till the 23/03/2021 then all went quiet till the 29/03/2021 and it went back to 2 a day again. But as of yesterday we are now upto 4 a day.

The crooks are getting the jump ahead again. ☹️

edit: spelling

Whilst the difficult we can do immediately, the impossible takes a bit longer. However, miracles you will have to wait for.

eracode

Smpl Mnmlst
8735 posts

Uber Geek

ID Verified

Trusted

Subscriber

#2685672 2-Apr-2021 10:19

FineWine:

When I first posted this latest round of spam on the 14/03/2021 I was getting approx 2 a day of the Norton spam right up till the 23/03/2021 then all went quite till the 29/03/2021 and it went back to 2 a day again. But as of yesterday we are now upto 4 a day.

The crooks are getting the jump ahead again. ☹️

Exactly the same here. Crooks getting the jump - or Spark fumbling the ball?

Sometimes I just sit and think. Other times I just sit.

cheshirecat

50 posts

Geek

#2685773 2-Apr-2021 14:46

eracode:

Exactly the same here. Crooks getting the jump - or Spark fumbling the ball?

Could be the spammers sending out their crp in greater volumes, too. Don't forget to report the spam to Spark so that the filters can be trained - just click the 'spam' link in the webmail and it will send the message back into the automatic learning system.

FineWine

2971 posts

Uber Geek

Trusted

Nurse (R)

Lifetime subscriber

#2685778 2-Apr-2021 15:15

cheshirecat:

Don't forget to report the spam to Spark so that the filters can be trained - just click the 'spam' link in the webmail and it will send the message back into the automatic learning system.

This is exactly what I have done and always do whenever it comes through to my  iMac mail. I go into the Spark server side webmail and spam them there. The automatic learning system is having a bad semester or the curriculum needs updating cause it appears to be not learning or learning too slow in this case.

Whilst the difficult we can do immediately, the impossible takes a bit longer. However, miracles you will have to wait for.

eracode

Smpl Mnmlst
8735 posts

Uber Geek

ID Verified

Trusted

Subscriber

#2685813 2-Apr-2021 18:47

cheshirecat:

eracode:

Exactly the same here. Crooks getting the jump - or Spark fumbling the ball?

Could be the spammers sending out their crp in greater volumes, too. Don't forget to report the spam to Spark so that the filters can be trained - just click the 'spam' link in the webmail and it will send the message back into the automatic learning system.

I do that without fail - no point complaining if we don’t do our part.

Sometimes I just sit and think. Other times I just sit.

eracode

Smpl Mnmlst
8735 posts

Uber Geek

ID Verified

Trusted

Subscriber

#2687053 6-Apr-2021 09:30

Looks like spam on xtra is increasing - I have received about six in the last 12 hours. Maybe that's not a lot - but its a lot more than I have received daily over the past year.

Sometimes I just sit and think. Other times I just sit.

1101

3121 posts

Uber Geek

#2688173 8-Apr-2021 09:42

eracode:

Looks like spam on xtra is increasing - I have received about six in the last 12 hours. Maybe that's not a lot - but its a lot more than I have received daily over the past year.

Perhaps its a few individual email adresses being targeted .
My xtra email doesnt get anywhere near the amount of spam some are complaining about . The amount of spam I get is so low its not worth mentioning .
My xtra a/c gets no more spam than my gmail a/c (on average)

Cant expect xtra to change spam their global spam filter settings based on a few a/c's being targeted

FineWine

2971 posts

Uber Geek

Trusted

Nurse (R)

Lifetime subscriber

#2702975 6-May-2021 14:54

Well since I last posted 02/04/21 the spam went down to about 1 or 2 maybe every second day. Well this week starting Monday it has jumped up to about 4 a day getting through and another 4 being picked up server side, so 8 a day. The ones getting through are all Norton and Dyson spam, while massage oils, CBD extracts & teeth falling out, are being picked up at the server.

I had a look at https://haveibeenpwned.com/ and there were 4 historical breaches concerning websites I have never been to or sighed up to.

My sister and husband, each with separate accounts, have also noticed an increase this week. But my sisters "haveibeenpwned" reveals no breaches while her husband reveals 3 breaches and the only one he knew about was MyHeritage in 2017.

So "haveibeenpwned" is NOT a very accurate indicator of your email address being out in the wild and joined the spam mailbot families.

All 3 of our addresses are getting the same spam/scam emails.

What has happened this year Spark ❓Your failure rate has increased hugely ❗️

It would be nice to have a comment from someone in Spark like 'hio77' used to but I know he has now moved on from this area.

Whilst the difficult we can do immediately, the impossible takes a bit longer. However, miracles you will have to wait for.

old3eyes

9111 posts

Uber Geek

Subscriber

#2703037 6-May-2021 18:45

FineWine:
Well since I last posted 02/04/21 the spam went down to about 1 or 2 maybe every second day. Well this week starting Monday it has jumped up to about 4 a day getting through and another 4 being picked up server side, so 8 a day. The ones getting through are all Norton and Dyson spam, while massage oils, CBD extracts & teeth falling out, are being picked up at the server.

I had a look at https://haveibeenpwned.com/ and there were 4 historical breaches concerning websites I have never been to or sighed up to.

My sister and husband, each with separate accounts, have also noticed an increase this week. But my sisters "haveibeenpwned" reveals no breaches while her husband reveals 3 breaches and the only one he knew about was MyHeritage in 2017.

So "haveibeenpwned" is NOT a very accurate indicator of your email address being out in the wild and joined the spam mailbot families.

All 3 of our addresses are getting the same spam/scam emails.

What has happened this year Spark ❓Your failure rate has increased hugely ❗️

It would be nice to have a comment from someone in Spark like 'hio77' used to but I know he has now moved on from this area.

Ever thought of getting a Outlook or Gmail account? I gave up with ISP email accounts years ago.

Regards,

Old3eyes

cheshirecat

50 posts

Geek

#2703104 6-May-2021 22:02

FineWine:

What has happened this year Spark ❓Your failure rate has increased hugely ❗️

Well, the battle against the spammers swings back and forth. Like whack-a-mole, as soon as you block one avenue, they start looking for a new one - the latest is to use a table and CSS to fake the Microsoft logo on phishing emails, so as to avoid the logo-detection image scanners (bet you didn't know that those existed).

Also, you're only seeing half the picture - the spam that gets through, and the spam in your Xtra 'spam' folder, is only a fraction of the total spam detected (the 'definite' spams are dropped silently, only the 'probable' spams appear in your Spam folder). So a surge in received spam at the filters can result in one or two more getting through, which is (as far as your inbox is concerned) a huge increase.

The filtering systems are constantly being improved, and the patterns being updated from global feeds several times an hour, so hopefully the battle is swinging back our way soon. Some other free mail systems deal with the problem by lowering the threshold and risking false-positives, but most people appear to prefer a few false-negatives against the risk of having real mails dropped.

Hopefully, you can have patience until things start going our way again!

1101

3121 posts

Uber Geek

#2703313 7-May-2021 11:36

your email adress is being actively targeted, thats your issue, not Sparks

My Gmail a/c gets more spam than my @xtra email a/c. By a wide margin.
IF the issue is mainly with YOUR EMAIL ADRESS , its totally unrealistic to expect @xtra to change their global spam filter setup just for your benefit.

Some spam will allways get through . Some weeks there will be more than others.
There is no magic wand to be waved to detect all spam , especially if it comes from legitimate email a/cs that have been hacked into .

Reducing spam further means getting considerably more legit email blocked.
You cant have it both ways. Pick one . How soon we forget all the complaints of xtras spam filter blocking too much legitimate email.
:-)

I will admit that the spam filter should be able to detect email spoofed as @xtra senders and at least move it to the spam folder .

Oblivian

7275 posts

Uber Geek

ID Verified

#2703319 7-May-2021 11:52

1101:

your email adress is being actively targeted, thats your issue, not Sparks

My Gmail a/c gets more spam than my @xtra email a/c. By a wide margin.
IF the issue is mainly with YOUR EMAIL ADRESS , its totally unrealistic to expect @xtra to change their global spam filter setup just for your benefit.

I will admit that the spam filter should be able to detect email spoofed as @xtra senders and at least move it to the spam folder .

Ones experience does not match another's. Unless you appear to be an xtra customer it seems. Where the complains here are common across the accounts.

In contrast, my Gmail gets 1-2 a year. If I'm unlucky. Or the odd mis-flagged ones. While, when it (xtra) was active. Had the same issue as posted here.

I think you will find anyone that was part of it during the Yahoo/MSN merger and subsequent breach era. Will suffer this. It's not as simple as 1 box being targeted. It's most the accounts from the inception involving that.

But many users moved off to Gmail or other provider in frustration so are less vocal. But SMEs hanging onto their original Xtra accts still seem to have a voice/opinion on it.

1 | ... | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15