Sudden Influx of Spam

[SecretSquirrel]

Despite having my Tiscali email address for 23 years, I rarely, if ever, received any spam. That all changed roughly two weeks ago and am receiving several per hour.  I was helping a client of mine a few days ago who is also a Tiscali user and he has the same problem so I doubt that it's just me and a few others who are affected.  The spam messages nearly always have the same format:

• The entire spam content is an external image.
• This is then followed by roughly 14 pages of nothing.
• At the bottom of the email there's some text. This can be an FBI or Adobe newsletter or a Microsoft authentication code - presumably to fool the spam filter into thinking it's a legitimate email.
• The emails are sent from a Google email address and are sent via Google servers - presumably using compromised Google credentials.
• The links in the email for the spam content nearly always point to :  sender10.zohoinsights-crm.com

I'll be happy to email said spam messages to you as an attachment if required.

Hopefully you'll be able to help us with this annoying problem. Thanks.

[Gondola]

---

@Dangermouse wrote:...I have forwarded at least 50 to spam@talktalk.co.uk

---

The email address does not exist. Sending to non-existent email addresses is going to get your email address listed as a spammer.

[Dangermouse]

I have also started getting these - 152 in 7 days...
You can use the Filter Rules in TT webmail to send them to your Spam folder.

But agreed that TT aren't doing enough to stop it - I have forwarded at least 50 to spam@talktalk.co.uk

[Gondola]

When criminals discover your email address it's a relentless task to stop being bombarded with phishing emails and spam. If there are common features in the unwanted and unsolicited messages then Rules are available as a Mail option to filter out unwanted mail.

TalkTalk ask the recipients of spam messages to Mark as spam that then reports the email for fingerprinting as a typical spam message and the moves the email to the recipient's Spam folder.

Just to say that Zohoinsights is a third party service that tracks and reports the opening of an email and the clicking of links in an email. Normally used for marketing purposes but can also be used by criminals to report on links being clicked.

 Phishing emails & everything you need to know

[SecretSquirrel]

Earlier, two Gmail contacts of mine tried to email me but delivery failed. The message they received was:

Address not found. Your message wasn't delivered to xxxxxxx@tiscali.co.uk because the address couldn't be found or is unable to receive email. The response from the remote server was: 550 5.1.0 BFftrSZDDh4n9 Too Many Invalid Recipients (TT405)

I also noticed on another thread that you replied to earlier you said this:

".....this happens intermittently when the servers get hammered by gmail...."

So, the irony is that the Gmail spammers can reach me but Gmail friends can't.

I gave you lots of information earlier, plus the offer of sending you some spam examples as attachments hoping that you'd be able to tweak the TalkTalk spam filters to stop this from happening to us all. Do you have any control over the filters? Can you help us with this?

Simply implying that the "underworld" are spamming us doesn't really help.

[Ady-TalkTalk]

Hi have either of you checked if your email is showing in HaveIbeenpwned.com ?  It will show if you the underworld are privvy to your email address. 

Ady

[D-u-t]

Yes , me too. I report them using spamcop and the technical details show they originate from talktalk servers and that is where the abuse email notification gets sent, the gmail sender adress is fake. The latest ones below, as can be seen the hosting company of the links are not interested in spamcop reports.

Submitted: Thu, 07 Dec 2023 11:59:57 GMT:
Bravo! You're the Chosen One for Oral-B Toothbrush

• 7303532394 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zohocorp.com@devnull.spamcop.net
• 7303532393 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zohocorp.com@devnull.spamcop.net
• 7303532392 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zohocorp.com@devnull.spamcop.net
• 7303532391 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zoho.com@devnull.spamcop.net
• 7303532390 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zoho.com@devnull.spamcop.net
• 7303532389 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zoho.com@devnull.spamcop.net
• 7303532388 ( 62.24.135.139 ) To: postmaster@talktalkplc.com
• 7303532387 ( 62.24.135.139 ) To: abuse.ttb@talktalkplc.com
• 7303532386 ( 62.24.135.139 ) To: abuse@talktalkplc.com

---

Submitted: Wed, 06 Dec 2023 10:10:31 GMT:
Track your package now #3620

• 7303287131 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zohocorp.com@devnull.spamcop.net
• 7303287130 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zohocorp.com@devnull.spamcop.net
• 7303287129 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zoho.com@devnull.spamcop.net
• 7303287128 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zoho.com@devnull.spamcop.net
• 7303287127 ( 62.24.135.135 ) To: postmaster@talktalkplc.com
• 7303287125 ( 62.24.135.135 ) To: abuse.ttb@talktalkplc.com
• 7303287120 ( 62.24.135.135 ) To: abuse@talktalkplc.com