After very little... lots of spam - How about you? system ok?

[PON]

My mailbox is normally spam free, as is my wife's (FM family account) but we've had several messages each in the last couple of days.

Enough that I came here to see if anyone else was seeing this.

It's not a lot, yet, I'm wondering if something has changed and why some obvious phishing wasn't detected as such. We both got completely bogus messages (plural) re Apple iCloud accounts and by chance I was there to stop my wife acting on it.

[Trogdor]

I normally have very little spam but I have seen a large influx in the past few weeks too.

My insight into this discussion is that nearly all the spam in my recent spike is addressed to me by one specific email alias that I had used with one specific company. My normal working email addresses, and even other aliases that are known to be compromised, have not been receiving any additional spam.

The only other aliases associated with recent spam are those I had used on Adobe trial accounts and so I assume they were leaked with the infamous recent massive hack of the Adobe user database.

From all this I think the recent increase is related to specific email databases being leaked. In my case the spike is easy enough to filter out. I had already stopped using the alias seen on most recent spam, so now I just have a rule that diverts those all into the spam folder. Just wish there was an easier way to stop the influx for everybody else.

[n5bb]

I don't see any increase in spam caught in my Fastmail Spam folder compared to a month ago. Of course, each person is receiving spam from different spammers and those spammers probably purchased your email address from different lists of addresses shared by criminals. So the number of spam messages a person receives can change greatly from day to day, and the spam load probably isn't correlated very significantly with other Fastmail members.

I have modified my spam levels to improve spam filtering in my account, since I use address book whitelisting and don't have to worry much about false positives. See my suggestions earlier in this thread:
Blocking certain countries and lowering spam threshold

Since the number of spam from day to day changes so much, I looked at the number of messages received in each 3-day interval over the last month: Here are the counts of messages (all spam with no false positives) in my Spam folder:
Feb 6-8: 17
Feb 9-11: 13
Feb 12-14: 15
Feb 15-17: 18
Feb 18-20: 11
Feb 21-23: 2
Feb 24-26: 11
Feb 27-Mar 1: 6
Mar 2-4: 10
Mar 5-7: 9

The SpamAssassin scoring errors reported in the Fastmail blog were between about Feb 16-23. The number of messages marked as spam due to these rules should have been lower around Feb 15-20, then higher around Feb 21-23. Since I discard messages with a spam score higher than 8.0, the second change might have resulted in more discards and fewer spam folder messages for me on those days (only 2).

Humans like to find patterns in the world around us. It's easy to see apparent patterns in the spam count from time to time, but unless you have a certain spammer focusing on your address (which I have seen occasionally), I think it's a mistake to read anything into changes of your spam load from day to day or week to week. It's like the weather - you get short-term swings in the spam load which aren't related to the climate.

Of course, if you don't use the user Bayes filter your spam filtering will ignore your spam marking and your spam filtering won't respond to changes in the spam you receive (as opposed to the spam others receive). My suggestions are:

• Train your user Bayes spam filter so it's active, then keep training it automatically so it responds to changes in the type of spam you receive. You can do this automatically in the Folders screen by training folders receiving all spam (should be Junk Mail) to learn as spam and training other folders receiving non-spam (Inbox and folders automatically receiving messages due to filing rules or your manual movement of messages to those folders) to learn as non-spam.
• Use address book whitelisting (add common people or organizations sending you non-spam to your address book). This is easy in the current web interface, since you can click on the sender email address and then click Add to Contacts.
• If you get a very large amount of spam from the same source over more than a few days, add one or more rules to file such messages in your Junk Mail (Spam) folder.
• After these steps, if you still receive a lot of true spam in your Spam folder each day (dozens, for example) with high spam scores, lower your spam delete threshold in the Custom spam filter screen.
• After these steps, if you consistently receive spam messages in your Inbox (instead of the Spam folder), lower your spam filing threshold in the Custom spam filter screen..

Bill

[ulmus]

Maybe off topic (haven't read whole thread), but want to give my 2 cents:
Lately, i mean for one week, i got emails qualified as a spam, but it is not a spam, so... spam increased i can say... i dont know why, but good, proper emails are lately qualified as spam.... of course i report them as not spam, but over few last years i didn't have to look into spam folder!!! And now i have to! I had no problem with spam till week ago... and as i can see i am not the only one...
p.s. i didnt change anything in spam/filter etc settings, i am using just like i was before.

[n5bb]

Originally Posted by ulmus

...Lately, i mean for one week, i got emails qualified as a spam, but it is not a spam, so... spam increased i can say... i dont know why, but good, proper emails are lately qualified as spam.... of course i report them as not spam...

When you see some change in the behavior of your account, you should first check the Fastmail status website:
http://status.fastmail.fm

Some of the reports in this thread are probably related to these two SpamAssassin spam filtering issues between about Feb 16-24, 2014:

• Increased spam due to SpamAssassin error
• Potentially more email than normal marked as spam the last few days

Finally, users need to understand how spam filtering works. You control these settings in the Advanced>Spam/Virus Protection screen.

• Member and Guest accounts have no spam filtering, so the Report Spam button has no effect.
• For paid accounts, you have to train your user Bayes spam filter before the spam marking buttons (Report Spam and Not Spam) have any affect. See the Fastmail Spam help page for more details.
• When your user Bayes filter is activated, you need to be sure to continue training the filter on new spam (in the Spam/Junk Mail folder) and new non-spam (in your Inbox or other folders). You can use the Report Spam / Not Spam buttons or the automatic spam reporting in the Advanced>Folders screen for each folder. Report Inbox and other good mail destination folders as non-spam and Junk Mail as spam.
• If you don't use address book whitelisting (placing common correspondents in your online Fastmail address book) you may see false positives from time to time (good messages in your Spam folder).
• If you see several spam messages in your Inbox every day, you may want to use Custom spam settings and reduce the spam filing threshold.
• If you see a large number (over a dozen, for example) of spam messages with high spam scores in your Spam folder each day, you can use the Custom discard setting to permanently discard those high spam score messages.
• The number of spam messages you receive every day changes mostly due to changing behavior by the spammers, not changes in the filtering. The SpamAssassin scoring issue for about a week in February is a rare exception to this behavior. Spammers have your email address (due to stealing the address using viruses installed on the computers of people who receive emails containing your address and using other techniques). They sell your address to other spammers. They may decide to send you 10 times as many spam messages one week as the next, and this will result in similar changes in the number of spam you receive. The majority of spam attempts are blocked by Fastmail due to the sending server behavior (not the content). But spammers use infected PC's all over the world to send spam, and in some cases these messages are difficult to block without affecting normal email.

Bill

[DaveJ]

I've started receiving more spam for the past 3 days on just one of my two Fastmail accounts. Prior to this I would rarely see SPAM in my inbox. Also noticed that there was a server down on 3/31/14. I wonder if these events are related?

I haven't changed my SPAM settings for a few years, but I checked anyway. It still is set for aggressive filtering.

[n5bb]

I get plenty of spam messages in my Spam folder, but not my Inbox, and I don't see any recent changes. I think that in nearly all cases the changes you are seeing are due to a few factors:

• Statistics - Due to the erratic sources of spam and the attempts to block it, the number of spam received by your account (before filtering) may dramatically change from day to day. You may receive zero spam messages one day and 15 the following day.
• New spammers - Spammers sell addresses to each other. One of your addresses might have been sold to a spammer and they may be suddenly sending you a hundred spam a day from their multiple sending systems. Most are blocked by the Fastmail incoming insecure blocking system, but quite a few make it to your account, and a few may bypass your spam filter.
• New spam sending systems - Spammers are constantly trying to get around block lists by changing their sending servers to new IP addresses which have not yet been blocked. A spurt of spam may be sent out before that IP address is blocked.

Be sure to read my suggestions in this thread posted a few weeks ago.

• If you are getting a lot of spam which is similar (same sending server, same language, same words in subject) you can filter those messages. It's safer to use a file to spam folder rule rather than deleting messages automatically.
• Be sure that the user Bayes filter in your accounts is active. If it's working, each message received at your account should have
  "BAYES_USED user" in the X-Spam-hits header.
• In the Advanced>Folders screen you should have your Junk Mail (Spam) folder set to learn messages as spam, and your Inbox (or other folders holding good messages) to learn messages as non-spam.
• Your Bayes user filter is trained once per day, so be sure to leave spam messages in the Spam folder at least 24 hours. In other words, leave spam in that folder for at least a couple of days rather than cleaning your spam filter out several times a day.
• It's very difficult to automatically discriminate between spam and non-spam in some cases. So be sure to use address book whitelisting (place good From addresses in your online Address Book). You can do this easily in the current interface by clicking the From address then click Add to Contacts. And be sure to use the spam marking buttons (Report Spam and Not Spam) rather than manually moving spam messages between folders.

Bill

[WormholeLawyer]

Originally Posted by DaveJ

I've started receiving more spam for the past 3 days on just one of my two Fastmail accounts. Prior to this I would rarely see SPAM in my inbox. Also noticed that there was a server down on 3/31/14. I wonder if these events are related?

I haven't changed my SPAM settings for a few years, but I checked anyway. It still is set for aggressive filtering.

I never saw spam in my inbox until yesterday. Every single message that would normally be marked as spam was showing up in the mailbox. Maybe something happened to the spam filters because nothing changed on my settings. Interesting.

[n5bb]

Originally Posted by WormholeLawyer

I never saw spam in my inbox until yesterday. Every single message that would normally be marked as spam was showing up in the mailbox. Maybe something happened to the spam filters because nothing changed on my settings. Interesting.

This is easy to check. Just look at your full headers (More>Show Raw Message) and examine the X-Spam-score and X-Spam-hits headers.

• If your user Bayes filter is active, you should see BAYES_USED user in the X-Spam-hits.
• The X-Spam-hits header scores add up to create the X-Spam-score value.
• When the X-Spam-score value exceeds the spam threshold set on the Advanced>Spam/Virus Protection screen, the message will be filed in Spam (or in some case discarded). The thresholds for spam filtering to the Spam folder are:
  • Basic: no spam filtering
  • Normal: 5 or greater
  • Aggressive: 4 or greater
  • White list only: any message with a spam score greater than zero is deleted unless the sender is in your address book (very dangerous!)
  • Custom: you can set the thresholds for spam filtering and discard as you wish
• If you use any custom Sieve you can do things which might disable your spam filter. Go to the Advanced>Rules screen and click Apply all changes and then check that you see Rules saved and applied at the top of the screen.

Bill

[andrej]

I have been getting a HUMONGOUS amount of spam in the past week, like I went from 10 spam messages a week to over 100.

I was told that I had responded to a thread that was "Off Topic," so I am responding to an inquiry started here:

http://emaildiscussions.com/showthread.php?p=569528

Originally Posted by n5bb

Look at the X-Spam-source header.

There is no X-Spam-source.

Originally Posted by n5bb

If you are truly getting no message body, you should see only the headers and nothing below. Is that what you see?

Doesn't matter. The full/raw message has a lot of malicious script/code, which I have no idea what it means.

Originally Posted by n5bb

What do you mean "they all take me to the same webpage"?

I mean:
they (the messages that I receive)
take me (by a URL in the message)
to the same webpage (a webpage that contains the same "Top Stories," thumbnails, and the same bunch of links and no contact information).

Originally Posted by n5bb

And if there is no message body, how are you even getting to the "same webpage"?

Why are you trying to pin me in a contradiction? I'm asking for help.

I said "half the emails are blank."

As for the link that you sent me, there is no BAYES_USED in the raw message.

[SamVilde]

After years of getting no spam, this onslaught has been kinda fun. It's nice seeing how spam has developed over time. I'm especially interested to see how old spam that targeted greed ("I have a lot of money and I want to share it with you!") has been replaced with spam that targets social justice softies ("I have a lot of money but I'm a bad person and now want your help sharing it with hungry orphans"). I especially like the spam that claims it's coming from some kind of anti-spam/scam vigilance task force ("You can trust that I'm not trying to scam you, because my job is stopping others who are trying to scam you!"). Oh yeah, and the ones with a lot of historically accurate details (eg "my father served in Jerry Rawlings' administration from 1981-1992") - some with links to prove the facts!

That said, am hoping that my curious clicking is not what caused this explosion of spam. Seems like no - everyone is having this problem.

And I'm getting sick of it now.

[WormholeLawyer]

Originally Posted by n5bb

This is easy to check. Just look at your full headers (More>Show Raw Message) and examine the X-Spam-score and X-Spam-hits headers.

• If your user Bayes filter is active, you should see BAYES_USED user in the X-Spam-hits.
• The X-Spam-hits header scores add up to create the X-Spam-score value.
• When the X-Spam-score value exceeds the spam threshold set on the Advanced>Spam/Virus Protection screen, the message will be filed in Spam (or in some case discarded). The thresholds for spam filtering to the Spam folder are:
  • Basic: no spam filtering
  • Normal: 5 or greater
  • Aggressive: 4 or greater
  • White list only: any message with a spam score greater than zero is deleted unless the sender is in your address book (very dangerous!)
  • Custom: you can set the thresholds for spam filtering and discard as you wish
• If you use any custom Sieve you can do things which might disable your spam filter. Go to the Advanced>Rules screen and click Apply all changes and then check that you see Rules saved and applied at the top of the screen.

Bill

Nothing like that. It was pretty obvious SA went down for a few minutes. It's fine now. Was just interesting that every BAYES email went to inbox. No sieve rules used. Seems like other people had the same problem.

[brong]

If anyone with one of these messages could put one in a folder called 'forwebmaster' and let me know their username via PM, I can have a look and see where/when SA went down. I don't recall seeing that happen in the past few days, so it would be good to see why.

Thanks,

Bron.

[ChinaLamb]

Originally Posted by brong

If anyone with one of these messages could put one in a folder called 'forwebmaster' and let me know their username via PM, I can have a look and see where/when SA went down. I don't recall seeing that happen in the past few days, so it would be good to see why.

Thanks,

Bron.

Is anyone still having a problem with this? Last week one of my email addresses suddenly started getting 6 spams per day when I usually get none...

BRON, I set up a folder ForWebmaster,i deleted many of these emails buti was able to recover some of them. Oddly, get some spam to one address that gets marked correctly while other identical spams don't. Also, others get unreasonably low spam scores...

/cl

[GeraldR]

Originally Posted by Trogdor

. . . .
The only other aliases associated with recent spam are those I had used on Adobe trial accounts and so I assume they were leaked with the infamous recent massive hack of the Adobe user database.

Almost all the spam that has been missed by the FM filters has come to an email address I only used to register at Adobe.