Sudden Influx of Spam

[SecretSquirrel]

Despite having my Tiscali email address for 23 years, I rarely, if ever, received any spam. That all changed roughly two weeks ago and am receiving several per hour.  I was helping a client of mine a few days ago who is also a Tiscali user and he has the same problem so I doubt that it's just me and a few others who are affected.  The spam messages nearly always have the same format:

• The entire spam content is an external image.
• This is then followed by roughly 14 pages of nothing.
• At the bottom of the email there's some text. This can be an FBI or Adobe newsletter or a Microsoft authentication code - presumably to fool the spam filter into thinking it's a legitimate email.
• The emails are sent from a Google email address and are sent via Google servers - presumably using compromised Google credentials.
• The links in the email for the spam content nearly always point to :  sender10.zohoinsights-crm.com

I'll be happy to email said spam messages to you as an attachment if required.

Hopefully you'll be able to help us with this annoying problem. Thanks.

[Rootin]

I could have had 87 air fryers and 45 bottles of J’adore perfume by now if I had clicked on the e mails.

I am sure they were all legit as they were signed off by the FBI!!

[Rootin]

16:28hrs was my last one and nothing this evening. I best keep quiet until tomorrow 

[ElleL]

Good Evening

I was coming on here to see if anyone else was having this problem so I’m glad to hear it’s not just me. I’ve been receiving spam emails everyday for the last 10 days from what looks like gmail addresses.

Hopefully, this will be resolved soon 🤞

[Dangermouse]

well I reckon SOMEBODY's doing something - I have not received any more spam since 14:30 today...

[Rootin]

I think TT are on it. We did have a reply from Ady today admitting there is a problem.

That said, it is still so infuriating to be putting up with this amount of spam every day.

If I can put a message filter on my own PC diverting spam to junk, surely TT have a bigger message filter they can use at their end!

[GS1057]

I’m having the same problem 20+ plus scam emails per day WHAT ARE TALKTALK DOING ABOUT THIS ?????? 
Looks like NOTHING .

[Ady-TalkTalk]

What's going on at the TalkTalk end is that we have Google/Gmail domains as trusted senders due to their excellent MTA as they normally manage their outgoing mail very well. However, at present they've failed to control the spam coming out of their domain so we're being hit by it. Cloudmark are adjusting the filters to cope with the new influx of spam from Google. 

Ady

[Rootin]

Hi SS

See other threads. You are not alone.

I am the same. Tiscali for 18 years with no major problems. Now, its gone mad!

And I'm really careful with my main e mail address. I use a 'junk' gmail that I put out for sales, etc and that doesnt even get much spam!

Something has to be going on at the TalkTalk end. It can't be all of us. Occams razor, if you have ever heard of that?

[SecretSquirrel]

Do you have an update for us Michelle?

My Gmail contacts are still having problems reaching me. Senders either get an undeliverable message or their email simply doesn't arrive. And, like I said five days ago, the Gmail spam messages are still arriving every few minutes.

Rather that blocking all Gmail messages why can't TalkTalk create a rule to block the spam messages by looking at the body content? Roughly 95% of those messages are linked to sender10.zohoinsights-crm.com so if Dangermouse and I can create rules that are virtually 100% effective then why can't TalkTalk?

Please reply with an update and the answer to my question. Thanks Michelle.

[Michelle-TalkTalk]

Hello,

No problem, we'll keep you updated.

Michelle

[SecretSquirrel]

Thanks for the tip and the screenshot Mousey -  it appears to be working a treat.

Thanks to Michelle too for her help.

[Michelle-TalkTalk]

Morning,

We've raised this over to our Network Engineers now to see if they are aware of any issues and we will post back here as soon as we receive an update back.

Thanks

Michelle

[Gondola]

---

@Dangermouse wrote:...I have forwarded at least 50 to spam@talktalk.co.uk

---

The email address does not exist. Sending to non-existent email addresses is going to get your email address listed as a spammer.

[Dangermouse]

I have also started getting these - 152 in 7 days...
You can use the Filter Rules in TT webmail to send them to your Spam folder.

But agreed that TT aren't doing enough to stop it - I have forwarded at least 50 to spam@talktalk.co.uk

[Gondola]

When criminals discover your email address it's a relentless task to stop being bombarded with phishing emails and spam. If there are common features in the unwanted and unsolicited messages then Rules are available as a Mail option to filter out unwanted mail.

TalkTalk ask the recipients of spam messages to Mark as spam that then reports the email for fingerprinting as a typical spam message and the moves the email to the recipient's Spam folder.

Just to say that Zohoinsights is a third party service that tracks and reports the opening of an email and the clicking of links in an email. Normally used for marketing purposes but can also be used by criminals to report on links being clicked.

 Phishing emails & everything you need to know

[SecretSquirrel]

Earlier, two Gmail contacts of mine tried to email me but delivery failed. The message they received was:

Address not found. Your message wasn't delivered to xxxxxxx@tiscali.co.uk because the address couldn't be found or is unable to receive email. The response from the remote server was: 550 5.1.0 BFftrSZDDh4n9 Too Many Invalid Recipients (TT405)

I also noticed on another thread that you replied to earlier you said this:

".....this happens intermittently when the servers get hammered by gmail...."

So, the irony is that the Gmail spammers can reach me but Gmail friends can't.

I gave you lots of information earlier, plus the offer of sending you some spam examples as attachments hoping that you'd be able to tweak the TalkTalk spam filters to stop this from happening to us all. Do you have any control over the filters? Can you help us with this?

Simply implying that the "underworld" are spamming us doesn't really help.

[Ady-TalkTalk]

Hi have either of you checked if your email is showing in HaveIbeenpwned.com ?  It will show if you the underworld are privvy to your email address. 

Ady

[D-u-t]

Yes , me too. I report them using spamcop and the technical details show they originate from talktalk servers and that is where the abuse email notification gets sent, the gmail sender adress is fake. The latest ones below, as can be seen the hosting company of the links are not interested in spamcop reports.

Submitted: Thu, 07 Dec 2023 11:59:57 GMT:
Bravo! You're the Chosen One for Oral-B Toothbrush

• 7303532394 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zohocorp.com@devnull.spamcop.net
• 7303532393 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zohocorp.com@devnull.spamcop.net
• 7303532392 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zohocorp.com@devnull.spamcop.net
• 7303532391 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zoho.com@devnull.spamcop.net
• 7303532390 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zoho.com@devnull.spamcop.net
• 7303532389 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zoho.com@devnull.spamcop.net
• 7303532388 ( 62.24.135.139 ) To: postmaster@talktalkplc.com
• 7303532387 ( 62.24.135.139 ) To: abuse.ttb@talktalkplc.com
• 7303532386 ( 62.24.135.139 ) To: abuse@talktalkplc.com

---

Submitted: Wed, 06 Dec 2023 10:10:31 GMT:
Track your package now #3620

• 7303287131 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zohocorp.com@devnull.spamcop.net
• 7303287130 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zohocorp.com@devnull.spamcop.net
• 7303287129 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zoho.com@devnull.spamcop.net
• 7303287128 ( https://sender10.zohoinsights-crm.com/ck1/2d6f.... ) To: abuse#zoho.com@devnull.spamcop.net
• 7303287127 ( 62.24.135.135 ) To: postmaster@talktalkplc.com
• 7303287125 ( 62.24.135.135 ) To: abuse.ttb@talktalkplc.com
• 7303287120 ( 62.24.135.135 ) To: abuse@talktalkplc.com