email support

Ask us about your TalkTalk email account and Webmail.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

How to block spam emails form a specific email address

akoumi
Chat Champion
Message 13 of 13

Hi, since being upgraded to the new talktalk mail I'm having problems with marking spam emails as spam.

 

i.e. I mark the specific email that I class as spam by clicking the "Mark as spam" button which puts the email in the Spam folder but I still get further emails in my inbox from the marked email address. e.g.

 

BitcoinSociety<jennifer_carter@familytime.com>
Ringing Ears<jennifer_carter@familytime.com>
Jason Taylor<jennifer_carter@familytime.com>
 

Could you please let me know if I need to do something else?

 

 

12 REPLIES 12

Message 1 of 13

At the moment this still looks like a glitch in the spam filtering for migrated customers and the project team are pressing daily for answers. 

 

In response to jonjws1 take a look at https://haveibeenpwned.com/ and you can see how your details were obtained by the spammer.


Please log in to My Account if you need to view or pay your bill, manage boosts and track your usage. From My Account you can also check your connection and test your line for any issues in the Service Centre.


0 Likes

Message 2 of 13

Yes, me too, same BitCoin type addreses, so may well be TalkTalk has let our data get to a third party. I had hoped that by moving the unread spam messeges to spam folder would effectively block them (I'm getting lots, all with slightly diiferent BiTCoin addresses), but does not seem to work, and spam filter configuration not ideal as it seems I need a filter for every different spam address, rather than all addresses in spam folder, is this correct? It's so bad, that most of the time, I now prefer to use gmail, real shame as the new talktalk mail is otherwise mostly OK.

 

0 Likes

Perplex2
Conversation Starter
Message 3 of 13

Hi. I have also gone onto webmail and done as you advise on today's spam, so the problem should be thoroughly dealt with. Thanks!

 

 

0 Likes

Perplex2
Conversation Starter
Message 4 of 13

Hi, thank you for that technique. I am using Windows Live Mail so using message rules I can filter by From but cannot add a condition.   One jennifer at familytime spam arrived today so far, and it automatically went into the deleted folder.  So something that I did yesterday worked OK. 

It will not allow me to copy from Message Source, so below is the internet headers from the one that arrived today (I have deleted our email address). I.e. the one that was in the deleted folder :

 

Received: from imap-director-2.dovecot.tt.ham.xion.oxcs.net ([10.15.2.2])

by imap-backend-7.dovecot.tt.ham.xion.oxcs.net with LMTP id 2B3YMWCBoFwSRQAAi1r7dA

for <3@1580769>; Sun, 31 Mar 2019 08:59:12 +0000

Received: from mx.tt.xion.oxcs.net ([10.15.2.2])

by imap-director-2.dovecot.tt.ham.xion.oxcs.net with LMTP id GNuUMWCBoFz+dAAAeAhaKw

; Sun, 31 Mar 2019 08:59:12 +0000

Received: from smtp-out-11.talktalk.net (smtp-out-11.talktalk.net [62.24.135.75])

(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))

(No client certificate requested)

by mx.tt.xion.oxcs.net (Postfix) with ESMTPS id 44X8Xw5HWJz5K1Hk

for <OUREMAILADDRESS>; Sun, 31 Mar 2019 08:59:12 +0000 (UTC)

Received: from b99n.syscinch.com ([18.138.39.20])

by mx.talktalk.net with SMTP

id AWJ1hc1r2lTNmAWJ2hlkHV; Sun, 31 Mar 2019 09:59:12 +0100

X-Delivered-To: OUREMAILADDRESS

X-Spam: 0

X-Authority: v=2.3 cv=CeR2G4jl c=1 sm=1 tr=0 a=wwx4PGLtDNAehp5oOTWHVw==:117

a=wwx4PGLtDNAehp5oOTWHVw==:17 a=IkcTkHD0fZMA:10 a=3b3TR5PHAAAA:20

a=PFgtEh1sAAAA:20 a=DJ_xzZUYAAAA:20 a=yK3elFORAAAA:20

a=tclcd6dtLQvEqt9_mmAA:9 a=QEXdDO2ut3YA:10 a=p-dnK0njbqwfn1k4-x12:22

a=utKFVLZlv6domsWxuTAm:22

To:

Subject:=?UTF-8?B?VGhlIGd1eSBsb3N0IDg0IGxicw==?=

From:=?UTF-8?B?RmxhdCBCZWxseSBDb2FjaCBUb2Rk?= <jennifer_carter@familytime.com>

Date: Sun, 31 Mar 2019 09:01:33 +0000

MIME-Version: 1.0Return-Path: owner-nolist-html*charles*-galos00**gmail*-com@mail3.familytime.com

Message-ID: <ftdbservergxldp7mvj00011728@mail3.familytime.com>

X-OriginalArrivalTime: 18 Jan 2019 09:14:56.0337 (UTC) FILETIME=

Content-Type: text/html; charset=UTF-8

X-CMAE-Envelope: MS4wfOt8Hls3WSDnwF3aLhg9S36H01lYxPwCPEDE0UDSHAx41OkCSuZQjNKydUBlGZNetyr8uwpgS3R2Z6KabhStXhdbKuvL2U7VSvijt6Xs9d1O3UpqTTd9

N1hIJNb76NBNGky4l7owhowQ9h0H9v4h0Og=

X-Antivirus: Avast (VPS 190330-4, 30/03/2019), Inbound message

X-Antivirus-Status: Clean

 

0 Likes

Message 5 of 13

Hi @Perplex2 

 

Interesting email. Filtering on either the Subject or the From 'friendly name' as you see it presented in the email view (as shown below) will not work.

 

Subject: This Man Is THE DEVIL
From: Ageless Ad Partner <jennifer_carter@familytime.com>
Return-Path: owner-nolist-html*charles*-galos00**gmail*-com@mail3.familytime.com

 

I believe my post 2 example will correctly identify the email where the spam sender is using an email sender with domain ending in familytime.com.  In your email the return path domain is mail3.familytime.com so as the Sender Policy Framework (SPF) usually authenticates based on the Return-Path let's try a variation of post 2.

 

Add a new rule:

 

Filter Rules - Add new rule

 

Filter Rules - Domain ends with.png

 

  • Give the rule a name just so you can identify what it does
  • Add condition
    Select Envelope, Header: From, Part: Domain, Ends with: familytime.com or as in this example mail3.familytime.com
  • Add an action
    In this example, File into: Spam
    or choose Discard
  • Decide if you need other rules to run (or untick Process subsequent rules)
  • Select the blue Save button

You've now prevented the sender's emails from arriving in your Inbox, for the example given above. 

GondolaVolunteer 2017-2021

 Like below to appreciate my help . . . Best answer is + Accept as Solution

0 Likes

Perplex2
Conversation Starter
Message 6 of 13

Hi, thanks. Yes. As seen below. Which to block? 

 

Subject:=?UTF-8?B?VGhpcyBNYW4gSXMgVEhFIERFVklMICA=?=
From:=?UTF-8?B?QWdlbGVzcyBBZCBQYXJ0bmVy?= <jennifer_carter@familytime.com>
Date: Sat, 30 Mar 2019 17:06:58 +0000
MIME-Version: 1.0Return-Path: owner-nolist-html*charles*-galos00**gmail*-com@mail3.familytime.com
Message-ID: <ftdbservergxldp7mvj00011728@mail3.familytime.com>
X-OriginalArrivalTime: 18 Jan 2019 09:14:56.0337 (UTC) FILETIME=
Content-Type: text/html; charset=UTF-8
X-CMAE-Envelope: MS4wfBJKud0L4f7GUe0hvURVAlRae1wKKi+aUVXrq6+DEvkSujijL46F+l4bd/90TDo6f1f1uW8B7cgimHy4Kghq6m152smUFu+S74tJpk1GGSHlADk9QW7O
IzADLnzuKvp17OuQFGEJGuIfhO41o2tXtwo=

0 Likes

Message 7 of 13

Hi @Perplex2 

 

In post number 2 in this thread I showed how to set up a Filter rule condition to detect the sender's domain as familytime.com.  This will work only if that's the true sender domain.

 

The question I always ask is have you looked at the email header / email source to check if the email name you're quoting is the From: 'friendly name' or the <true sending domain email username>?

 

Bear in mind that spammers use tricks like encoding the friendly name as UTF-8 code so that it travels through the email system (UTF-8 is permitted) and when decoded it might appear to the recipient as the sender's email address.

 

For example: From: =?UTF-8?B?Zmlyc3RuYW1lQHN1cm5hbWVAdGFsa3RhbGsubmV0?= <username@talktalk.net>.  The 'friendly name' appears as firstname@surname@talktalk.net

 

What I'm saying is you need to establish exactly what you need to block before you can effectively block an email.

GondolaVolunteer 2017-2021

 Like below to appreciate my help . . . Best answer is + Accept as Solution

0 Likes

Message 8 of 13

I have the same problem with   jennifer_carter@familytime.com   which is sending me spam emails on a variety of subjects. I have tried adding it to blocked sender and blocked individual lists, and I have tried using message rules - these simply doe not work on jennifer_carter@familytime.com.  Message rules work fine for deleting emails from other senders. Just not this one.

 

The only one message rule that does have any effect  is the one for forwarding it to another email address. So I send any emails from Jennifer to Jennifer.  And now I daily have long lists of emails sent to it in my Sent folder.    I checked my email address to see if it had been stolen or sold to mailing lists, and it has. But that is not an excuse for message rules for deleting not to work on familytime.com emails.   

 

What is it about this email address?  There is a genuine looking familytime.com website online - recipes and household stuff - but its email addresses are like this  jcarter@familytime.com   no full first name, no underscore. 

 

Oddly - as I could not automatically delete these spam emails, I tried out a different email client.  And these spam emails do not arrive in the inbox of the other email client. They ONLY arrive in two places - one is my Windows Live Mail inbox, which is what I use as my email client on my PC. The other is another of our talktalk mail accounts, where they arrive in webmail as well as in the Windows Live Mail inbox.

 

If I use a mail filter on my PC, does it have any effect on my webmail? 

Thanks

 

Any creative ideas on how to stop this? 

0 Likes

Ady-TalkTalk
Support Team
Message 9 of 13

Hi BOB STATE, you can check if your email address has been sold to spammers. Go to haveIbeenpwned.com it will tell you if your email address is on a database and if it has how it was obtained. It's likely that this is a new bout of spam hence 2 of you posting with the same spam. You can report the spam using the addresses in the Report a phishing or spam email


Please log in to My Account if you need to view or pay your bill, manage boosts and track your usage. From My Account you can also check your connection and test your line for any issues in the Service Centre.


0 Likes

BOB STATE
First Timer
Message 10 of 13

I get EXACTLY the same spam emails from EXACTLY the same 'familytime' domain.

 

It started around a week ago. Has one of talktalk's servers been attacked, leaking our details, again?

0 Likes

Message 11 of 13

Thanks

0 Likes

Gondola
Community Star
Message 12 of 13

Hi @akoumi 

 

There wasn't convincing evidence of active blocking, just placing the email in the Spam folder. 

 

We asked for a response from the project team "Mail is sent to the reporting Spam TalkTalk address and this will automatically update the block filters." That means your marking of spam is used by TalkTalk's Cloudmark Authority Engine for spam analysis that is protecting us all from spam attacks.

 

But to be sure of blocking / rejecting a specific email address immediately you'll need to use the Filter Rules. 

 

Select the email, select the More actions menu within the email display and select Create filter rule.

 

Create Filter Rule from an email

 

 

Filter Rule - familytime-com.png

  • Give the Filter Rule a name (or let it create one for you)
  • If there are multiple conditions, Apply rule for all or any conditions
  • Check and amend the default conditions
  • Create an action e.g. File into Spam
  • Save

The above Filter rule will file into Spam but if you wish to Discard or Reject with reason then  delete any other action that's there, using the Trash can icon, and Select Add action and Discard or Reject with reason and Save the new action.

 

Or you may choose to filter only previous contacts from your address book into the Inbox and send other 'unknown' emails into another folder for review. That's usually the best option, known as 'whitelisting' or 'Safe Senders'.

 

To use the Safe Sender's technique you should ensure you're not making use of the Automatically collect contacts while reading option. (Settings > Mail > Common). You can and should use the Automatically collect contacts while sending option but it's useful to review the Address Book contacts from time to time to make sure they're definitely your wanted 'Safe Senders'.

 

To keep just your Safe Senders to the Inbox and filter everything else to another folder like the Trash folder:

  • Select the Menu option      top right
    (triple line hamburger icon)
  • Select Settings from the list
  • Select Mail (left side panel)
  • Select Filter Rules
  • Select Add new rule
  • Enter a Rule name, for example, Safe Senders
  • Select Add condition, Mailing list > Does not exist
  • Select Add action, File into > Trash
    (or your choice of folder for you to review the emails)
  • Untick process subsequent rules
  • And select the blue Save button

 

Filter Rules - Safe Senders only.png

GondolaVolunteer 2017-2021

 Like below to appreciate my help . . . Best answer is + Accept as Solution

0 Likes