topic Re: Sudden Influx of Spam in Email

Sudden Influx of Spam

SecretSquirrel — Thu, 07 Dec 2023 12:01:33 GMT

Despite having my Tiscali email address for 23 years, I rarely, if ever, received any spam. That all changed roughly two weeks ago and am receiving several per hour. I was helping a client of mine a few days ago who is also a Tiscali user and he has the same problem so I doubt that it's just me and a few others who are affected. The spam messages nearly always have the same format:

The entire spam content is an external image.
This is then followed by roughly 14 pages of nothing.
At the bottom of the email there's some text. This can be an FBI or Adobe newsletter or a Microsoft authentication code - presumably to fool the spam filter into thinking it's a legitimate email.
The emails are sent from a Google email address and are sent via Google servers - presumably using compromised Google credentials.
The links in the email for the spam content nearly always point to : sender10.zohoinsights-crm.com

I'll be happy to email said spam messages to you as an attachment if required.

Hopefully you'll be able to help us with this annoying problem. Thanks.

Re: Sudden Influx of Spam

D-u-t — Thu, 07 Dec 2023 12:17:05 GMT

Yes , me too. I report them using spamcop and the technical details show they originate from talktalk servers and that is where the abuse email notification gets sent, the gmail sender adress is fake. The latest ones below, as can be seen the hosting company of the links are not interested in spamcop reports.

Submitted: Thu, 07 Dec 2023 11:59:57 GMT:
Bravo! You're the Chosen One for Oral-B Toothbrush

7303532394 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zohocorp.com@devnull.spamcop.net
7303532393 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zohocorp.com@devnull.spamcop.net
7303532392 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zohocorp.com@devnull.spamcop.net
7303532391 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zoho.com@devnull.spamcop.net
7303532390 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zoho.com@devnull.spamcop.net
7303532389 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zoho.com@devnull.spamcop.net
7303532388 ( 62.24.135.139 ) To: postmaster@talktalkplc.com
7303532387 ( 62.24.135.139 ) To: abuse.ttb@talktalkplc.com
7303532386 ( 62.24.135.139 ) To: abuse@talktalkplc.com

Submitted: Wed, 06 Dec 2023 10:10:31 GMT:
Track your package now #3620

7303287131 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zohocorp.com@devnull.spamcop.net
7303287130 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zohocorp.com@devnull.spamcop.net
7303287129 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zoho.com@devnull.spamcop.net
7303287128 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zoho.com@devnull.spamcop.net
7303287127 ( 62.24.135.135 ) To: postmaster@talktalkplc.com
7303287125 ( 62.24.135.135 ) To: abuse.ttb@talktalkplc.com
7303287120 ( 62.24.135.135 ) To: abuse@talktalkplc.com

Re: Sudden Influx of Spam

Ady-TalkTalk — Thu, 07 Dec 2023 14:56:02 GMT

Hi have either of you checked if your email is showing in HaveIbeenpwned.com ? It will show if you the underworld are privvy to your email address.

Ady

Re: Sudden Influx of Spam

SecretSquirrel — Thu, 07 Dec 2023 17:01:47 GMT

Earlier, two Gmail contacts of mine tried to email me but delivery failed. The message they received was:

Address not found. Your message wasn't delivered to xxxxxxx@tiscali.co.uk because the address couldn't be found or is unable to receive email. The response from the remote server was: 550 5.1.0 BFftrSZDDh4n9 Too Many Invalid Recipients (TT405)

I also noticed on another thread that you replied to earlier you said this:

".....this happens intermittently when the servers get hammered by gmail...."

So, the irony is that the Gmail spammers can reach me but Gmail friends can't.

I gave you lots of information earlier, plus the offer of sending you some spam examples as attachments hoping that you'd be able to tweak the TalkTalk spam filters to stop this from happening to us all. Do you have any control over the filters? Can you help us with this?

Simply implying that the "underworld" are spamming us doesn't really help.

Re: Sudden Influx of Spam

Gondola — Thu, 07 Dec 2023 19:28:49 GMT

When criminals discover your email address it's a relentless task to stop being bombarded with phishing emails and spam. If there are common features in the unwanted and unsolicited messages then Rules are available as a Mail option to filter out unwanted mail.

TalkTalk ask the recipients of spam messages to Mark as spam that then reports the email for fingerprinting as a typical spam message and the moves the email to the recipient's Spam folder.

Just to say that Zohoinsights is a third party service that tracks and reports the opening of an email and the clicking of links in an email. Normally used for marketing purposes but can also be used by criminals to report on links being clicked.

Phishing emails & everything you need to know

Re: Sudden Influx of Spam

Dangermouse — Thu, 07 Dec 2023 21:32:06 GMT

I have also started getting these - 152 in 7 days...
You can use the Filter Rules in TT webmail to send them to your Spam folder.

But agreed that TT aren't doing enough to stop it - I have forwarded at least 50 to spam@talktalk.co.uk

Re: Sudden Influx of Spam

Gondola — Thu, 07 Dec 2023 21:40:32 GMT

@Dangermouse wrote:...I have forwarded at least 50 to spam@talktalk.co.uk

The email address does not exist. Sending to non-existent email addresses is going to get your email address listed as a spammer.

Re: Sudden Influx of Spam

Anonymous — Fri, 08 Dec 2023 09:42:31 GMT

Morning,

We've raised this over to our Network Engineers now to see if they are aware of any issues and we will post back here as soon as we receive an update back.

Thanks

Michelle

Re: Sudden Influx of Spam

SecretSquirrel — Fri, 08 Dec 2023 09:45:02 GMT

Thanks for the tip and the screenshot Mousey - it appears to be working a treat.

Thanks to Michelle too for her help.

Re: Sudden Influx of Spam

Anonymous — Fri, 08 Dec 2023 09:47:07 GMT

Hello,

No problem, we'll keep you updated.

Michelle

Re: Sudden Influx of Spam

SecretSquirrel — Tue, 12 Dec 2023 11:41:01 GMT

Do you have an update for us Michelle?

My Gmail contacts are still having problems reaching me. Senders either get an undeliverable message or their email simply doesn't arrive. And, like I said five days ago, the Gmail spam messages are still arriving every few minutes.

Rather that blocking all Gmail messages why can't TalkTalk create a rule to block the spam messages by looking at the body content? Roughly 95% of those messages are linked to sender10.zohoinsights-crm.com so if Dangermouse and I can create rules that are virtually 100% effective then why can't TalkTalk?

Please reply with an update and the answer to my question. Thanks Michelle.

Re: Sudden Influx of Spam

Rootin — Tue, 12 Dec 2023 12:10:55 GMT

Hi SS

See other threads. You are not alone.

I am the same. Tiscali for 18 years with no major problems. Now, its gone mad!

And I'm really careful with my main e mail address. I use a 'junk' gmail that I put out for sales, etc and that doesnt even get much spam!

Something has to be going on at the TalkTalk end. It can't be all of us. Occams razor, if you have ever heard of that?

Re: Sudden Influx of Spam

Ady-TalkTalk — Tue, 12 Dec 2023 12:38:34 GMT

What's going on at the TalkTalk end is that we have Google/Gmail domains as trusted senders due to their excellent MTA as they normally manage their outgoing mail very well. However, at present they've failed to control the spam coming out of their domain so we're being hit by it. Cloudmark are adjusting the filters to cope with the new influx of spam from Google.

Ady

Re: Sudden Influx of Spam

GS1057 — Tue, 12 Dec 2023 18:49:04 GMT

I’m having the same problem 20+ plus scam emails per day WHAT ARE TALKTALK DOING ABOUT THIS ??????
Looks like NOTHING .

Re: Sudden Influx of Spam

Rootin — Tue, 12 Dec 2023 19:32:18 GMT

I think TT are on it. We did have a reply from Ady today admitting there is a problem.

That said, it is still so infuriating to be putting up with this amount of spam every day.

If I can put a message filter on my own PC diverting spam to junk, surely TT have a bigger message filter they can use at their end!

Re: Sudden Influx of Spam

Dangermouse — Tue, 12 Dec 2023 20:31:33 GMT

well I reckon SOMEBODY's doing something - I have not received any more spam since 14:30 today...

Re: Sudden Influx of Spam

ElleL — Tue, 12 Dec 2023 20:48:03 GMT

Good Evening

I was coming on here to see if anyone else was having this problem so I’m glad to hear it’s not just me. I’ve been receiving spam emails everyday for the last 10 days from what looks like gmail addresses.

Hopefully, this will be resolved soon 🤞

Re: Sudden Influx of Spam

Rootin — Tue, 12 Dec 2023 21:54:03 GMT

16:28hrs was my last one and nothing this evening. I best keep quiet until tomorrow

Re: Sudden Influx of Spam

Rootin — Tue, 12 Dec 2023 21:57:31 GMT

I could have had 87 air fryers and 45 bottles of J’adore perfume by now if I had clicked on the e mails.

I am sure they were all legit as they were signed off by the FBI!!

Re: Sudden Influx of Spam

DavidRobinson1 — Tue, 12 Dec 2023 22:28:13 GMT

For over a week I have been blaming myself for causing the huge amount of spam reaching my in box. Sometimes 20 a day. Ive been blocking the senders but there are so many out there I cant stop it. I have tried various ways to filter it but short of blocking all .gmail messages I cant. I'm so pleased I'm not in the minority. This is most strange because up until recently virtually no spam or junk was getting through. As to TalkTalk saying stop using my Tiscali email address well that is so insensitive after all TalkTalk took over Tiscali and its customers of which I have been one for years. Now come on TalkTalk get this sorted please.