Spam

[toolio]

Originally Posted by Bahb

Spam HAS increased since the weekend. Periodically this happens, usually following a weekend, which is when changes to FM always happen too. After a few days, everything calms down and I'm back to getting almost no spam. Maybe coincidence, but I've been around long enough that I expect the unexpected here, immediately following a weekend.

This week has been horrible. More spam has made it to my fastmail account than at any time in recent memory. Yes, I expect it will get better. But on the other hand, I never expected it to be this bad.

[ZATZAi]

It does seem to be on the rise lately. Suddenly got around 10 a day for a couple days getting through, mostly scoring 3.6 on according to the headers. Had to go into the advanced settings and manually turn down the filters sensitivity to 3.5 to get them all automatically sent to the Junk folder.

Of course that setting is very low so I'm watching my spam folder for false positives.

[mattfusf]

Same here. In the last 24 hours, I have moved 35 messages manually to my spam learning folder, and it has been similar all week.

Fastmail used to be the gold standard for this, rarely received any...

[scgf]

Happening for me too. Nearly all of the spam messages are coming from .eu domains. I have my thresholds set to 8.0 for definite spam, 3.2 for probable spam and 3.0 for possible. I rarely get any false hits (ham).

[aqeeliz]

Same here, it seems some new spammers (or old spammers with new techniques) are targetting FM (or maybe the world in general).

I tried n5bb's suggestions, and they are working great. Other than one registration email that went to spam, all other email is being sorted correctly. Only exception is, I am not discarding any mail, just using >1.0 for probable spam and >5.0 for possible spam.

[robn]

We've tweaked some spam scoring; we're hopeful this will combat the recent surge.

Specifically, we've changed the following two SpamAssassin rules, for those that can read such things:

# Matching domains, spammers seem to have that sorted now, and we shouldn't
# be giving them the 2.7ish that SA offers.
# http://www.gossamer-threads.com/list...n/users/166185 explains it
# really well:
# "There seems to be a consensus that SPF and DKIM passes aren't worth
# significant scores. So how is it that RP_MATCHES_RCVD, scores -1.2 when
# it just a circumstantial version of what SPF does explicitly."
# the score jumps around in updates-sa and our spam rates with it
score RP_MATCHES_RCVD -0.001

# on the flip side, BAYES_999 means really high probability, it should really
# pretty much never get through. Defaults seem to be 0.2.
score BAYES_999 1.5

We're hoping that these tweaks will fix things in the short term. We've got some more complex stuff that we're starting to plan out now, which will take a while to get going. No doubt we'll talk about it more later!

[HM24]

For the last month or two, I am being bombarded by spam emails, all of which are flogging either, Oakleigh/Ray Ban or some other sun glasses.

No other junk seems to be getting through, just these annoying spams about sun glasses.

Spammers should be hung,drawn and quartered !

I really wish that FM would allow user customisation, so that I could block emails from Eastern Europe/Spain/China etc, where this crap seems to originate.

Can't be that hard ?

[randian]

Originally Posted by HM24

I really wish that FM would allow user customisation, so that I could block emails from Eastern Europe/Spain/China etc, where this crap seems to originate.

The problem with blanket blocking is that legit people using Runbox or EuMX get blocked along with the spammers just because they're from the same country as them.

[lane]

Originally Posted by HM24

I really wish that FM would allow user customisation, so that I could block emails from Eastern Europe/Spain/China etc, where this crap seems to originate.

Can't be that hard ?

Actually, you can do this in Fastmail. But as "randian" just said, it may not be desirable.

If you want to pursue it, you can Google the forum for the techniques and some discussion on advisability. Here are some starter links:

Block certain countries
Can I block spam based on language
Blocking domains with Rules

[Terry]

Originally Posted by HM24

I really wish that FM would allow user customisation, so that I could block emails from Eastern Europe/Spain/China etc, where this crap seems to originate.

Can't be that hard ?

You can do it with sieve script....

[robert@fm]

I have recently got a lot of spam to my Member account (which I suspect can all be traced back to the incident I vented about some time ago, in which someone who used to be a fellow trustee of a charity abused his privileged knowledge of my email address to make unauthorised disclosure of it to third parties) claiming to be "order information" (or most recently "overdue invoices"), always from sites I've never heard of, and the attached "document" is an .ARJ file! Which is doubly dumb, because not only is it obviously not a legitimate document (it's an archive format), it's an obsolete archive format, so even if I were gullible I wouldn't be able to open it anyway...

[Trogdor]

Originally Posted by aqeeliz

Same here, it seems some new spammers (or old spammers with new techniques) are targetting FM (or maybe the world in general).

Based on which of my aliases the spam is being sent to, I believe it is the world in general. I've also seen a huge increase in spam this week, but Fastmail is catching most of it. Not much of it is actually targeting my primary Fastmail email address, which to me is good information.

Most of the spam is aimed at my email aliases that were formerly used with companies who had known large data breaches (e.g. Adobe). Maybe the breached lists got sold to more spammers. Anyway, those breached aliases in particular are getting hit pretty hard.

[danieldk]

Originally Posted by Trogdor

Most of the spam is aimed at my email aliases that were formerly used with companies who had known large data breaches (e.g. Adobe). Maybe the breached lists got sold to more spammers.

Actually, the dump of the Adobe leak (e-mail addresses, password hashes, etc.) is downloadable on the net of you look for it:

http://www.hydraze.org/2013/10/some-...5m-users-leak/

[ulmus]

And now for something completely different:
Are "Spam' and 'Not Spam' buttons working?
Many times i was clicking on some emails to set it as not spam and every next email from that address is still treated as spam, why? is it working or not or am I doing something wrong? I just check it as not spam, i think it should be enough to mark it as not spam in the future, am i right or wrong?
Thanx!

[n5bb]

Originally Posted by ulmus

...I just check it as not spam, i think it should be enough to mark it as not spam in the future, am i right or wrong?...

Look at the full email headers of a spammy message (More > Show Raw Message). The X-Spam-hits header shows the spam indicator scores which add up to the X-Spam-score. The spam button (and spam learning for messages left in the Spam/Junk Mail folder at least one day) only affects the Bayes indicators. On the Advanced>Spam/Virus Protection screen you can see your protection level. The default Normal setting filters messages with X-Spam-score >5 into your Spam folder. At the bottom of the page you can see if your User Bayes filter is active.

Messages are filed into the Spam folder when they are received at your account. So the spam button only affects future messages, and the only affect is on your Bayes score in User Bayes mode. If a message was otherwise non-spammy and only your use of the Report Spam button affects the spam score, then at this time the spam report can only set the score to 4.7, so since this is less than 5 that can't cause spam filtering by itself. Usually the Bayes score includes many other spam indicators for spam messages, and the Report Spam button only adds to the existing score.

If you place the email addresses of common correspondents in your online Address Book, you can use Aggressive or Custom spam filtering and lower your spam filter threshold. You should only do this if you commonly receive spam in your Inbox folder and use address book whitelisting.

Bill