In the last 2 weeks my gmail inbox went from zero spam to at least 2/3 spam/phishing emails per day on the inbox. I'm marking them as spam but nonetheless it keeps happening. I'm wondering if because spam traffic increased and spammers found a new way to trick anti-spam or if gmail engineers changed something on their end. Is anyone experiencing the same?
Not a big deal as it's been almost a year I'm migrating off gmail and I'm keeping it only for a few things, but still annoying
Google's mail servers have been compromised for several weeks now. It's commonly being used for infected crypto spam (all those "new traderbot" emails with the attached infected PDF, for example). I'm not yet sure if these are just compromised GMail accounts, or if the mail servers themselves have been compromised. There seem to be some reports on AbuseIPDB of intrusion attempts coming directly from Google's mail servers.
I've tried reporting it to Google (eg via SpamCop), and Google declines to receive reports. I have been reporting it through AbuseIPDB as well. Here is one Google mail server that has had over 300 abuse reports:
https://www.abuseipdb.com/check/209.85.167.48
There are many more, and I linked to a few more when I posted about it here on HN over a month ago:
https://news.ycombinator.com/item?id=32434810
I'd genuinely be interested to know from someone working at Google why Google can't / won't solve this, even for the narrow clearly-defined cases I see.
If it is coming from compromised Gmail accounts, I wonder if these same accounts are also being used to post the handful of deep-fake Elon Musk crypto YouTube Shorts that inundate the Shorts feeds.
There's hundreds, maybe thousands of these videos being posted making Shorts practically unusable. And no amount of reporting or downvoting seems to affect their algorithm.
It's all the same crap that's obviously spam.
"Dear Friend, I hope this email finds you well. I need your assistance in a matter..."
"You've been chosen!"
"Home Depot/TruGreen/Dicks Sporting Goods/ADT-Security"
"Invoice enclosed"
"You've received a direct deposit..."
"Hot sex <insert emojis>"
I would guess that Gmail is simply a legacy/commodity function at Google, so they have spam handled by lower-end employees or even contractors.
It's kinda shocking as Gmail spam filtering was virtually flawless for over a decade, and now it's falling apart.
DICKS SPORTINGGOODS!! <wqrwrsss-@acohhovldzbqmulu.ml>
Subject: You've beean chosen! SPF: PASS with IP 40.107.117.103 Learn more DKIM: 'PASS' with domain acohhovldzbqmulu.ml
Dicks Sporting Goods Winner <eushfyuefdsf-@chistezlhekofu.ml> Subject: -You've been chosen! SPF: PASS with IP 40.107.215.70 Learn more DKIM: 'PASS' with domain chistezlhekofu.ml Learn more
Google detects them all as Persian, and asks if I want to translate.
Also interesting:
Message ID <6324876e.050a0220.efb1a.fe7bSMTPIN_ADDED_BROKEN@mx.google.com>
The only text in the message:
Your Name Came Up For a YETI Hopper M//20 Cooler customer Gift
Ends up linking to here: https://templarswoards.com/39adf46955f3971c805bc32b65a2cb08
After filling out a 'survey' it asks for name, address, email, phone
https://www.simplediscountshop.com/staging/backpack/refresht...
It then asks for a credit card number to pay the $6.95 shipping
Haven’t been seeing any more since that one though.
To the contrary, I find myself going through my spam folder to mark as NOT spam things like monthly newsletters from arts organizations. There are a bunch of concerts and plays I've sadly missed because of this. (Which I can only assume comes from people abusing the mark-as-spam button instead of properly unsubscribing, which sucks because it leads to other people missing the legitimate emails.)
Also things like invoices from Apple purchases (e.g. a paid app or AppleCare) show up in spam. Which isn't a biggie, but it does seem like bizarre that Gmail could ever get that wrong.
GMail is not my primary email, though. I use it for Meetup.com, Slack, Steam, maybe one or two other things. A quick google search suggests that my email address does not appear on the internet. Maybe people not suffering from spam have similarly private addresses?
The number of spam messages I get in general, judging from what shows up in the Spam folder, varies wildly from week to week. Sometimes I'll get five over a two-week period, and then get a week where I receive about 15 per day.
It would be interesting to know the cause. I have actually signed up to loads of dodgy websites over the years, my email has been "pwned" according to haveibeenpwned, etc. So there's nothing particular that I've been doing to shield myself from spam, but Google still catches it all perfectly.
But then again, I completely believe all the other people saying they _have_ had spam come through, so it remains a mystery as to why. Is it some specialized spam list of a certain group that know how to bypass the spam filter? Is it Google A/B testing their spam filter? Who knows.
I have manually marked a large amount of prior emails as spam, not sure how personalized the filters are.
Gmail's spam filtering was perfect before, so something is going on on my account (although not as dramatic as OP's).
So I do believe something has changed and I wish I was still in your situation.
I will say I’ve gotten what I consider spam from Experian where they claim to be MSAs (mandatory service announcements) on my account, but they’re clearly marketing, and I’ve just set up a rule to delete those. Done.
I also have gotten on political lists where unsubscribing doesn’t seem effective, so set up another rule to block those. Done.
Other than these 2 edge cases (that don’t seem to be blatant spam, just dark patterns), my inboxes are clean of spam.
I also have family (wife and two older sons) on Gmail, and haven’t heard them complain about spam.
One potential hint though: all of my Gmail comes through personal domains. So maybe these spam attempts are targeting gmail.com domain? I do have a gmail.com email, though, that gets forwarded to my personal domain one, and I still haven’t noticed any spam, FWIW.
1) 3 "legitimate" spams, i.e. unsolicited messages that the senders believe they should have sent. 3 of these. 2 via Constant Contact and 1 via Salesforce.
2) 1 random porn spam, via random spammer domain with valid SPF and DKIM.
3) 2 phishing scams with the same body arriving from random commercial domains without DKIM. These are almost certainly spread via malware/viruses/worms.
4) 1 Google promotion originating from Google with valid DKIM, because I mark all these as spam.
5) 2 phishing messages, with the phishing warning, that originated from gmail itself via HTTP. These are pwned google accounts or google accounts logged in on machines with malware (effectively, same thing).
6) 1 idiot Republican politician, via Mailchimp.
As a side topic, I've heard a lot of people say that the Gmail UI has changed and that it's unusable now. This is what mine looks like and I really like it, is it not how everyone else's looks too? https://imgur.com/a/3ahD0Ta
So my solution was to start using Thunderbird. Her messages were never being rejected by my domain and all the threads are there intact.
Edit: This was the SMTP error that Google was telling my domain: "Our system has detected that this message is likely unsolicited mail. To reduce the amount of spam sent to Gmail, this message has been blocked."
Because almost all of the spam that is getting through - to me, at least - follows a very simple template - something that spam blockers should be incredibly good at handling - I was able to concoct a reasonable solution.
Google has this Apps Script thing* where you can deposit JavaScript and then schedule that JavaScript to run every minute. They expose a Gmail API and once you've given your script access to your Gmail inbox, you can process the unread messages and look for telltale signs of spam (for me, inspecting the subject for a regex match of `/confirmation#/i` has been adequate[0]) and finally move the message to spam. Since it runs every minute instead of on an event of new mail, new messages may appear unread for a short period of time.
* though there are options to deploy your project it is not necessary to do so in order to run the script on a schedule
0. https://gist.github.com/cfeduke/1dfb7f650b9abbfce549eddffc96...
I can't think of no actions I did (in terms of identifying email as spam) that could suggest I might consider emails from Google or Apple, or any emails with that content, as spam. I mark things regularly, but almost always actual spam / phishing, or commercial mass emails from companies I have no relation with (banks, etc.)
That kind of sounds like spam to me!