topic Re: Spam getting through in Email

Spam getting through

pin-up — Thu, 28 Dec 2023 15:42:38 GMT

There have been other similar posts about this, but I'm not sure they're the same - hence this new post. Talktalk has historically been so good at filtering out spam - in fact too good sometimes and has blocked pukka emails from getting either to my inbox or spam folder. Anyway, today I have had six spam emails in the past four hours! They are all from rogue domains, not from gmail or googlemail. They have been from (WARNING - SPAM EMAIL ADDRESSES COMING UP!!)

no-reply@vqusijogyfgq.festinolente.cl
no-reply@viagra.apocalypto.org.uk
no-reply@76f215e.vishalaryal.com.np
no_reply@oyaukazxzqxinmwjqcewlt.Com
yte088b@scvqgovc.bnx.uk
no_reply@zeivjercxcvhxnccboofuu.Com

Come on, talktalk, you need to sort this fast.

Re: Spam getting through

Gondola — Thu, 28 Dec 2023 17:13:19 GMT

Spam, whether from Chile, Nepal or the UK or spoofed as though from those domains, just requires that you select Mark as spam from the TalkTalk Mail toolbar. That action will move the message to your Spam folder and notify the TalkTalk sender intelligence engine so that fingerprinting of spam can take place.

Re: Spam getting through

pin-up — Thu, 28 Dec 2023 19:49:57 GMT

The fact that there have been multiple complaints only recently and that this bunch of spam emails has come to me where normally I get none suggests talktalk have made a retrograde step somewhere along the line.

I use Thunderbird - at talktalk's suggestion - and mark spam emails as such before moving them to the spam folder. I could go out of my way to login to webmail and do as suggested. Or talktalk could work out how to revert to its former excellent way of handling spam.

Re: Spam getting through

Gondola — Thu, 28 Dec 2023 21:48:58 GMT

There have been no changes to TalkTalk's recommendations for handling spam since 2018 when TalkTalk appointed CloudMark (now Proofpoint) to handle the fingerprinting of spam based on TalkTalk users Marking as spam.

The recent flooding of TalkTalk's mail servers with spam emanating from Gmail led to the discovery that TalkTalk weren't routinely scanning inbound messages from Gmail on the bass that Gmail is fully authenticated and Gmail spam protection should have been in place to prevent outgoing spam. Clearly that didn't work.

So now there's an extra overhead to scan more mail messages sent from Google mail servers. Perhaps other messages are being let through. If the addresses you gave are the actual sending addresses then none are authenticated by SPF and that would normally have caused an automatic rejection by TalkTalk.

Re: Spam getting through

pin-up — Fri, 29 Dec 2023 14:36:17 GMT

So if this would normally have caused an auto reject by talktalk why didn't it this time? I have had two more similar spam messages this morning. Thunderbird is flagging them, telling me they're probably spam, so the security risk (for me) is low; but they are still getting through.

It sounds like talktalk has not got a grip on this.

Re: Spam getting through

Gondola — Fri, 29 Dec 2023 18:20:12 GMT

@pin-up wrote: ..."I could go out of my way to login to webmail and do as suggested"...

If you do then TalkTalk's sender intelligence engine at CloudMark will have your input on what you think is spam. If nobody bothers to report spam then how will CloudMark know to fingerprint the spam content.

Re: Spam getting through

pin-up — Fri, 29 Dec 2023 20:35:33 GMT

My Thunderbird email folders are sync'd to my talktalk web mail folders, so when I'm in Thunderbird and move an email to the Spam folder (with the email itself marked as spam), this also moves the same email to my spam folder in my talktalk webmail. As I understand it, all emails in my talktalk web mail spam folder are by default marked as spam. So I believe this means that the action I am taking - i.e. I'm not just deleting the spam - is what CloudMark wants to be able to sort the problem.

It leaves open the question as to why this has suddenly started, given how good talktalk usually is at filtering out spam, but I guess we're not going to get anywhere with that. Happy to close this conversation, and I'll report the problem again if after a while I'm still getting multiple spam emails every day.

Re: Spam getting through

Gondola — Fri, 29 Dec 2023 22:11:05 GMT

You're mistaken. CloudMark notification happens only when a user selects Mark as spam from the webmail toolbar.

Re: Spam getting through

pin-up — Sat, 30 Dec 2023 10:54:36 GMT

That's rubbish. When I 'mark as spam' in Thunderbird, the email gets moved to the spam folder in my webmail and is shown as spam in that folder. If I go into the webmail spam folder and highlight the email, I have the option in the toolbar of selecting 'not spam' but not 'mark as spam' - because webmail already thinks it's spam.

So, either you don't understand how Thunderbird and webmail are interacting or the CloudMark system is rubbish, because it means I have to go through all my 12 (so far) spam emails in the webmail spam folder, mark them all as 'not spam' and then mark each of them in turn as spam.

The fact that I have all these emails in my webmail spam folder should be enough for CloudMark to pick them up and analyse them.

The problem of spam getting through is only happening with talktalk.net, not with tiscali.co.uk.

Re: Spam getting through

Gondola — Sat, 30 Dec 2023 11:04:56 GMT

I suggest you recycle your 'rubbish' via the Trash.

I understand how Thunderbird and Webmail interact for IMAP client connections. CloudMark does not monitor the Spam folders. CloudMark gets its notifications from mail users that sign in to webmail and use the provided feature to Mark as spam from the toolbar.

If you choose to use that feature then mail will be moved to the Spam folder and that will be replicated in Thunderbird.

Re: Spam getting through

pin-up — Wed, 10 Jan 2024 20:11:42 GMT

Using webmail rather than Thunderbird, I have been religiously moving the spam emails out of spam back into the inbox, then used the 'mark as spam' tag to move them to spam and thereby make sure they are flagged to CloudMark as spam. It's making no difference. I am still getting typically three spam emails every day - 41 since 28/12/23.

Any useful suggestions? As previously noted, TalkTalk has historically been brilliant at filtering out spam, so something has gone awry - and the evidence is that it hasn't been tackled yet.

Re: Spam getting through

Gondola — Thu, 11 Jan 2024 00:22:17 GMT

CloudMark takes input notifications from multiple users and sender intelligence from spam traps in order to fingerprint and score spam content. If there's a consensus on what constitutes unsolicited spam then that will be blocked.

CloudMark has been active from 2018 so it's good to know it has been effective during that time. The recent flooding with new spam attacks, the consequential hard blocks on previously trusted domains and the reset of spam filters to identify new spam from those domains inevitably mean that CloudMark is on a new learning incline.