Increasing levels of spam hitting my inbox

[Andy_N]

---

@andydenyerwrote:

Today I received an email in my inbox (NOT identified by BT as spam) allegedly from PayPal but was not from a PayPal email address - surely that should be a clear indicator?

---

Again, it doesn't work like that. Companies use many email addresses, including strange ones. With the millions of businesses out there, for a system to check against some form of dynamic database is not going to be possible. Not only that, spammers do use "real" company addresses - so these would get through based on the criteria you've indicated.

It's easy for "us" to see that the email is not paypal, but maybe pretending to be paypal - but for a machine it's not so simple.

[landie57]

I have noticed a similar increase in spam, some supposedly from my own email account! It's a pain but I simply mark them as spam and block the senders. It certainly seems as if something has changed recently to cause this.

[andydenyer]

When I look at the message details of all the spam/scam emails received recently, I can see that they ALL have this in common:

X-Original-Sender: medmohammed7**@gmail.com 

I do not see this characteristic in ANY the genuine emails received - ONLY the multitude of spam/scam emails I am receiving each day claiming to be from Norton or McAfee.

On that basis, could this not be identified and used by the spam filters in order to block these?

[Andy_N]

---

@andydenyerwrote:

When I look at the message details of all the spam/scam emails received recently, I can see that they ALL have this in common:

X-Original-Sender: medmohammed7**@gmail.com 

I do not see this characteristic in ANY the genuine emails received - ONLY the multitude of spam/scam emails I am receiving each day claiming to be from Norton or McAfee.

On that basis, could this not be identified and used by the spam filters in order to block these?

---

The thing is, if the address is spoofed - then it's  real person's email address. You may not know them of course, but others might. ISP blocking of addresses is rarely done, so the best thing to do is set up your own filters.

[Thersites]

Technically you are right, @Andy_N  the spammers ARE always one or two steps ahead.  But the example of the one that is bothering the OP - and which I have also received - is now not one or two steps behind us, but tens of thousands, I'm sure.  I have reported it as spam SCORES of times.

And if the pattern-matching neural network software that is behind the spam filters is not up to recognising the pattern of:

1) <16-33 random alphabetic lower case chars>@gmail.com

2) subject or body includes Macafee with a mis-spelling 'Macaffee'

3) body includes an unvarying gif

.....then it's not much use and is not fit for purpose, is it?

I agree with you that we can't expect TOO much of spam filters.  But I disagree with your implicit suggestion that the one btinternet users have standing between them and the outside world is, as George Carlin would have said "..just ****ing dandy!".

[Andy_N]

---

@Thersiteswrote:

Technically you are right, @Andy_N  the spammers ARE always one or two steps ahead.  But the example of the one that is bothering the OP - and which I have also received - is now not one or two steps behind us, but tens of thousands, I'm sure.  I have reported it as spam SCORES of times.

And if the pattern-matching neural network software that is behind the spam filters is not up to recognising the pattern of:

1) <16-33 random alphabetic lower case chars>@gmail.com

2) subject or body includes Macafee with a mis-spelling 'Macaffee'

3) body includes an unvarying gif

.....then it's not much use and is not fit for purpose, is it?

I agree with you that we can't expect TOO much of spam filters.  But I disagree with your implicit suggestion that the one btinternet users have standing between them and the outside world is, as George Carlin would have said "..just ****ing dandy!".

---

I have not implied anything, and don't even undertand your last sentence.

The three items you have specified are clearly not going to be rules for ISP based anti-spam engines on their own, for the reasons I have already given.

Many people now use random characters in their email addresses in the hope to prevent dictionary attacks on email addresses.

Indeed you include 2 versions of the correct McAfee spelling. Sometimes even business communications do get spelling wrong.

Attached gifs, not matter what, are themselves not necessarily going to be spammy in nature.

What would happen if you sent a friend an email quoting all of the items you mentioned asking "Have you seen this", or "Be careful of this"? Your email would fail to get through, when your email is clearly not spam. OK it's pretty much a rare thing for some people to do - but the corporate anti-spam systems need to be able to distinguish these against the real spam. Sometimes they will fail.

Again - it's easy for us humans to see that this is obvious spam, but not for machines.

[Thersites]

NB @andydenyer I intended to say just now that I have successfully fended off this particular spammer with a rule using the mis-spelling of Macaffee, but the rule-compiling software is so buggy and oafish I am loth to recommend it to you.

It's a pretty damning indictment of BT's  webmail software that, in attempting to fix, to work-around or to report a one failing, functional omission or bug in it, I have invariably tripped over or been frustrated by one or more others.

SO MANY are the problems that it's downright dishonest of BT to pretend this is a mature product, when in reality we 'users' are in fact alpha-testing for BT while we pay handsomely for it, and are moreover obliged to stumble blindly without the support structures that software in development should have.

So you might try using rules if you have lots of patience, but expect to find some unexpected behaviours as you save and edit them that will make it difficult to know if they are working as you intended.  Good luck!

[Thersites]

The implication @Andy_N  of your earlier posts is that BT's spam filters ARE as good as we could wish for, and I think that they are not.  Sorry if my allusion to the comic George Carlin was not clear.  His schtick was to point out the ways in which ordinary citizens are taken adavantage of (he used ruder words) by unaccountable big corporations (does this remind you of anything?)

I am not suggesting the 3 characteristics BY THEMSELVES be incorporated into a rule-based engine....each of them is individually is weak...but that TOGETHER they make a powerful identifying signal, and together with the training that my scores of reports, allied to those of other recipients who have done likewise (and there MUST be a few) has given, a competent pattern-matching filter should be able to learn this.

Neural network software is black-box stuff and no 'rules' can be drawn out to explain its conclusions.  But I know from work in other fields that this signal should be sufficient unless those configuring it have required ZERO false positives.  Which would be a mistake.

[Andy_N]

---

@Thersiteswrote:

The implication @Andy_N  of your earlier posts is that BT's spam filters ARE as good as we could wish for, and I think that they are not.  Sorry if my allusion to the comic George Carlin was not clear.  His schtick was to point out the ways in which ordinary citizens are taken adavantage of (he used ruder words) by unaccountable big corporations (does this remind you of anything?)

I am not suggesting the 3 characteristics BY THEMSELVES be incorporated into a rule-based engine....each of them is individually is weak...but that TOGETHER they make a powerful identifying signal, and together with the training that my scores of reports, allied to those of other recipients who have done likewise (and there MUST be a few) has given, a competent pattern-matching filter should be able to learn this.

Neural network software is black-box stuff and no 'rules' can be drawn out to explain its conclusions.  But I know from work in other fields that this signal should be sufficient unless those configuring it have required ZERO false positives.  Which would be a mistake.

---

We're both singing from the same songbook - mostly.

What I have not said or implied is that the spam filters are good as could be hoped. What I have said over many years is that spammers will be steps ahead, and the spam engines will catch up. This has shown to be the case when suddenly spammers manage to get their stuff through the anti-spam systems for a while until the systems catches up and learns the signatures etc.

This is probably what's happening at the moment with the "McAfee" example.

The anti-spam engines/learning systems could well be overloaded at the moment, letting through items it could deal with normally. So rather than a global block it could release the pressure by letting through spam normally blocked.

[landie57]

Something else, which I suspect is related, legitimate email from a website is blocked, eg a password reset email. I  already have another topic running on this.

If my memory is right this happened previously, something was changed and everyone started getting more spam. We posted this on the community and eventually BT fixed it. We can live in hope.