After very little... lots of spam - How about you? system ok?

[andrej]

Originally Posted by paul29

Obviously you don't understand how spam works.

I strongly disagree with you and you phrase it as if you want to insult me. How would you like it if I said: "Obviously, YOU don't know how spam works?" I DO know how spam works; it's illegal, and I want to get in touch with whomever setup these optout-gmrv and other websites to let them know. If I didn't "understand how spam works," then I would be hitting "Report Spam" for everything with an unsubscribe link.

If need be, I can use my SIEVE mail filter, but again, these all had "Unsubscribe" links... and (much more than) 50% of mail that I had been receiving, up until March 2014, had "Unsubscribe" links that were from legit. companies (and I checked the X-Mail-from and the URL before clicking for phishing/fake URLs, they were legit.).

And yes I am well aware of remove . org and other websites that are completely fake (and why they haven't been shut down yet is beyond me...)

Originally Posted by Trogdor

There are many free email services out there you can use, and some like Gmail have decent spam filters.

I actually disagree. Gmail (or Gspam, as I used to call it) is exactly the reason why I moved to Fastmail 10 years ago.




Here's another question:

If my Who's Who is such an obvious scam... then why isn't Fastmail already blocking these emails? They've been basically the same format for the last two months.


And a comment: (I still remember back in 2003 when "Report Spam" actually did something, even on a "free" account. Now you're telling me that it does nothing but move it to a folder, thereby making it useless? I've asked about this before.)

[n5bb]

I assure you that the posters in this thread do not wish to insult you or just argue with you for no good reason. Instead, I think we all want to be of assistance. I wish you luck in calling the phone numbers of the administrative contacts and sending letters to the domain registrars for those domains. We just hope you realize that there are well over 100 billion spam messages sent each day, and if you understand spam you understand that the From address is usually fake.
http://en.wikipedia.org/wiki/Email_spam

I didn't say that the Report Spam button did nothing. You evidently have a free account, and here is what has always happened with free accounts (Guest and Member):

• The message is moved to the Spam (Junk Mail) folder.
• That message is incorporated into the "global" Bayes spam database. This means that it improves spam filtering for all paid accounts (especially paid accounts who haven't activated their user Bayes filter).
• But it has absolutely no effect on unpaid accounts. Since there is no Sieve spam filter and no headers from the SpamAssassin spam marking system, there is no way for you to change this unless you get a paid account.

By the way, I don't get those messages you described in my Inbox, so my spam filter is working fine. So you see, Fastmail is blocking them.

Good luck!

Bill

[SamVilde]

Originally Posted by ChinaLamb

I sent some of my spams to the Fastmail development team. They found that spammers had found a way around their spam catcher -- a few lines of code and the problem was solved.

This post corresponds roughly to when my insane spam knocked back to regular little spam. Thank you.

I know some people in this thread were saying that it was all normal, but it really wasn't normal. Glad it's been fixed.

[andrej]

Yes n5bb, but the email has to come from somewhere; often (though not always) I dig it out of X-Mail-From or other addresses in the RAW feed. Some spammers just set their servers not to accept mail.
I do have a SIEVE filter so I may just choose to be much more aggressive about it and move on.

[denis]

I have watched and read these posts, and I have to add that something has definitely changed. I accept that at least one of the changes is the normal ebb and flow of spam. And maybe some re-learning might have been required after the Spam Assassin issue. But I am still seeing historically unusual volumes of email beating the spam filter, highlighted today by a "Russian Brides" spam of all things getting a spam score of only 4.1 (BAYES_99 3.5, BAYES_999 0.2, DCC_CHECK 1.1, RP_MATCHES_RCVD -0.651, LANGUAGES unknown, BAYES_USED user, SA_VERSION 3.3.2).

Up until this surge in spam, I have been super-impressed with the combination of Fastmail and Spam Assassin. Now, Fastmail and Spam Assassin is definitely not filtering spam from my emails as well as it used to.

Denis.

[Franko753]

I also had a spam surge in April to one of my fastmail aliases, which I used for low-level logins and newsletters. Maybe some scammer got hold of it. However, it never happened before that I got this amount of spam into my paid fastmail account. Since I have closed that account, no spam any more.

[Mugwhamp]

Originally Posted by denis

I have watched and read these posts, and I have to add that something has definitely changed. I accept that at least one of the changes is the normal ebb and flow of spam. And maybe some re-learning might have been required after the Spam Assassin issue. But I am still seeing historically unusual volumes of email beating the spam filter, highlighted today by a "Russian Brides" spam of all things getting a spam score of only 4.1 (BAYES_99 3.5, BAYES_999 0.2, DCC_CHECK 1.1, RP_MATCHES_RCVD -0.651, LANGUAGES unknown, BAYES_USED user, SA_VERSION 3.3.2).

Up until this surge in spam, I have been super-impressed with the combination of Fastmail and Spam Assassin. Now, Fastmail and Spam Assassin is definitely not filtering spam from my emails as well as it used to.

Denis.

Denis, looks to me like the filter is doing exactly what it's supposed to. For me, 4.1 is quite a high score. I have my rules set up to send spam to the junk folder at 1.5 and only very rarely get a false positive.

[n5bb]

Originally Posted by denis

I have watched and read these posts, and I have to add that something has definitely changed. I accept that at least one of the changes is the normal ebb and flow of spam ,... ... getting a spam score of only 4.1 (BAYES_99 3.5, BAYES_999 0.2, DCC_CHECK 1.1, RP_MATCHES_RCVD -0.651, LANGUAGES unknown, BAYES_USED user, SA_VERSION 3.3.2)...

I think that the main thing which has been changing is the range of techniques used by spammers. I have noticed that some spammers seem to be purchasing cheap domains and hosting service and then sending spam which is carefully designed to only appear moderately spammy so that the spam score isn't too high.

The RP_MATCHES_RCVD spam marker has a negative score, so it indicates the message is not spam. This marker indicates that the first untrusted relay server has the same domain name as the envelope sender address. This would be common for some small businesses, and usually requires the spammer to own the domain they are using. In addition, the incoming "insecure sender" blocks at the Fastmail SMTP receive stage (which are hidden from the user) can be fooled if the sender sets up their new domain and server with a new IP address and sends out a blast of spam before they are listed on block lists.

The DCC_CHECK spam marker has a positive score, so it indicates the message is spam. DCC is a service which collects reports of SPAM messages.

The BAYES_99 and BAYES_999 are coming from your user Bayes filter, so you have probably marked similar messages as spam before. But none of the other spam indicators (other than those I listed) were triggered. So this spammer was probably very careful to create a message which looks OK except for the content caught by the user Bayes system and the DCC check. My guess is that it's a new (or unused before for spam) domain -- you can look it up and see when it was registered. I often find spam domains which were registered within the past 48 hours, so they haven't had time to get collected in some of the block lists.

I agree that you can use Custom spam settings and reduce your spam threshold. Just be sure to use address book whitelisting if possible with your common contacts. Check for false positives (good messages in your spam folder) and look at their spam scores. I file into spam at 2.0 and discard at 8.0 right now, so that message would be in my spam folder. Address book whitelisting won't work for businesses who receive a lot of good messages from new addresses, but it works great for my personal email.

Bill

[denis]

Thanks for the breakdown of the contributors to the final spam score. What this says to me is that a recent step change in sophistication by the spammers requires that we I need to be much more aggressive in diverting potential spam, which I will do. I accept the advice of others more expert than me that a score of 4.1 is high, but it wasn't for me until this year. Thanks again, particularly Bill and "Mugwhamp".

Denis.

[denis]

Further to my previous post, if I read the standard spam settings correctly, "Normal" diverts potential and possible spam if the email has a spam score greater than 5 and "Aggressive" diverts with a score greater than 4. If Bill and "Mugwhump" are correct (and they usually are!), then Fastmail should redefine "Normal" to, say, greater than 4, and "Aggressive" to, say, greater than 2.

Denis.

[paul29]

I suddenly see a surge of spam getting through the filters today. About 1 an hour getting through, instead of a couple a day. I haven't tried examining them. I just figure that spammers have worked out a new trick and filters will catch up after a little while.

[paleolith]

Originally Posted by paul29

I suddenly see a surge of spam getting through the filters today. About 1 an hour getting through, instead of a couple a day. I haven't tried examining them. I just figure that spammers have worked out a new trick and filters will catch up after a little while.

I'm seeing this too, and suspect that some filter has been disabled, perhaps an important blacklist. The filters are running, but the spam scores are too low. This does NOT look like new spammer tricks to me, as the messages look like plain old-fashioned spam. The only other possibility I've thought of is that some spammers have found a way to circumvent the source identification (dial-up IPs etc), but that's been a solid blocking criterion for a long time.

I've created a support ticket and will report back when I get a response.

Edward

[paul29]

I also put in a ticket earlier today, since I didn't check here first. I hadn't noticed that about the spam scores.

[anonymouse]

I am also seeing a sharp increase in spam - and it is stuff instantly recognisable as such.

For example this morning I have received six messages saying "This email contains an invoice file attachment" (with a probably-malware ZIP file). One scored 6.8 and was trapped but the others were let through withs scores of 0.0 (!), 0.4, 1.2 etc, although the messages are pretty much identical and the previous spam was saved to my Bayes filter.

Something looks amiss.

[paleolith]

I gave them some samples, and got the response "We have had similar reports from other users as well. We'll check with our developers and get back to you on this as soon as we hear from them.".

Edward