Blocking Spam domains not working

[jamiewood]

Yep, mine started with the 'Costumer Service' ones as well. I haven't noticed anything regarding a Microsoft email, but I send them to junk without opening them.

[jn_girl]

@bloop Yes that's another "costumer service".

Had a quick look re your question. I see on 15th I had an email headed McAfeAnti-Virus - Your subscription may have ended, then images. At the very bottom in small text is this:

We recently received a request to recover your Microsoft account me*****@hotmail.com. Unfortunately, our automated system has determined that the information you provided was not sufficient for us to validate your account ownership.  Microsoft takes the security and privacy of our customers very seriously, and our commitment to protecting your personal information requires that we take the utmost care in ensuring that you are the account owner.  Please submit a new account verification form - a link - etc etc - it goes on.

I also see that some spam have the Data Protection notice saying I am getting this email because my email address "is registered in the database yoursavingsfiesta" etc etc Owner of brands Coupon&Go and Oferting. I am reluctant to press any unsubscribe button though.  I don't go onto these voucher sites so will not have put my email address into any.  

[bloop]

I had exactly the same one on the 15th.

There are 2 different spam sources going on here.  The ones that talk about Data Protection are from Spain:

EMAILING NETWORK EUROPE, SL (hereinafter EMAILING), NIF B-64649957, registered in the Commercial Registry of Barcelona, Volume 39881, Folio 0104, General Section, Entry 1. We are located in Carrer Pujades, 112, 08005 Barcelona (Spain), phone 0034 934 673 626.

EMALING NETWORK SARL is a subsidiary of EMAILING NETWORK EUROPE, SL., domiciled at 8 Rue Barthélémy Danjou, 92100 Boulogne-Billancourt (France). SIREN Number: 494084395 - NIC: 00016, owner of CLICPLAN, OFERTING and COUPONANDGO brands.

EMALING is an affiliate company of Reworld Media, 8 Rue Barthélémy Danjou, 92100 Boulogne-Billancourt (France)

Terribly Tempting is owned by The Value Factory : Carrer de Pallars, 166 1ª Planta, 08005, Barcelona 

All sent via Sparkpost.

They are still processing personal data unlawfully as I have never granted them permission to send me marketing email, and for it to be legal, they must have obtained my informed consent.  They certainly have not! 

The Martin Lewis and Bitcoin ones are evil as they are concealing the genuine sender, spoofing other identities are suspected of distributing links containing malware, exploiting Microsoft IP addresses and faking a significant part of the email headers etc.  I have also been forwarding them as attachments to phish@office365.microsoft.com    If you try to simply forward them BT identifies them as phishing, so I don't understand why they can't filter them to at least my spam folder in the first place!

Gah!

[jn_girl]

There is also something else I think is fishy.  I posted a while back that emails were not getting through to me.  It turned out that that @gmail.com was in my blocked sender list.  Well for me to block that domain once was surprising, but to do it twice is fishy!  I only know this as I am secretary of a club and expect replies to the mailshots.  So many this month did not reply.  A friend of two said they responded today so I asked them to send to my work address and indeed it was true.  Then I looked at all the people who supposedly had not replied and they were all gmail.  I looked in my blocked sender list and lo and behold @gmail.com is blocked.  There is no way I would have blocked that domain.  Can the spammers do this - so I block what I think is their domain but it is actually gmail.com?

[grahamm1]

Hi jn_girl

This happened to me, too!
I am 100% certain that I would not have blocked gmail.com, but when I checked my blocked senders list, there it was

[gg30340]

---

@grahamm1 wrote:

Hi jn_girl

This happened to me, too!
I am 100% certain that I would not have blocked gmail.com, but when I checked my blocked senders list, there it was

---

Did you read message 15.

[andydenyer]

After I block an address or domain, I always go in to the list of blocked senders to see if it has added the address or domain I was expecting to be blocked (I have found that newly added addresses/domains appear at the bottom of the list initially).

[bloop]

Actually, that's not entirely true.   If the full header is a "bad header" (a broken but deliverable header), BT seems to be evaulating the "spoofed from" as the "actual from" to block more mail comming in.

Lets go back to one refered to that we recieved (I can say that as it wasn't just me) on the 15 January pretending to be a renewal for Mcaffee Anti-Virus.  Since I don't have/have never had that, it was obvioulsy fake.

The spoofed "from" on the email is: McAfeAnti-Virus <unmonitored@microsoft.com>   That is what the BT filters are responding to by way of blocking the sender.  I have verified that by adding it to blocked senders in settings/mail/blocked senders, and then removing and getting more spam from a spoofed unmonitored@microsoft.com .  I can't identify the real sender other than it came through a Microsoft relay.  It is blocked along with others and I'm back to 1 or 2 a week.

Back to the point - in the header, which has all sorts of **bleep** injected to deceive is the following:

Received: from smtpi.msn.com (co1gmehub04.msn.com. [65.55.52.232])
by mx.google.com with ESMTPS id a10si19458664iln.121.2019.11.28.07.01.40
for <boukhazarmohamed@gmail.com>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
Thu, 28 Nov 2019 07:01:41 -0800 (PST)           <--Note the spoofed date!

This is injected code and not part of the real header at all.

"If" the BT email system is not evaluating the headers properly, and users are using BT's "block sender" within the email viewer, it is quite likely that the wrong sender is being blocked.   In this case it coud be @gmail.com

What I would suggest is that you look at the "from"  and block that in settings/mail/blocked senders manually and review what you have got set as blocked in case there are others inadvertantly there, until BT get this sorted.

Is ther a mod or BT employee I could work with on this?

I'll share the full header in my following post so you can see what a mess it it.

[bloop]

I can follow most of ths but there's a bit where I get lost.  It really does seem t come from Microsoft - maybe some  hacked Microsoft tenants or a Microsoft security exploit?  Note the injected bits with the duff dates.  I apologise, its not a tech forum, but this spam is causing too many problems and needs fixing.

Full Header edited for privacy:

Return-Path: <badromnovbvrsaa6jwu63rd7dmczkesc@somebodyelse.onmicrosoft.com>
Received: from sa-prd-rgin-012.btmx-prd.synchronoss.net ([10.2.38.20])
by sa-prd-fep-002.mx.internal with ESMTP
id <20220115160154.ETPI18370.sa-prd-fep-002.mx.internal@sa-prd-rgin-012.btmx-prd.synchronoss.net>
for <x.x@btinternet.com>;
Sat, 15 Jan 2022 16:01:54 +0000
Authentication-Results: btinternet.com;
dmarc=fail header.from=microsoft.com;
dkim=fail;
spf=pass smtp.helo=DEU01-BE0-obe.outbound.protection.outlook.com;
spf=pass smtp.mailfrom=somebodyelse.onmicrosoft.com;
bimi=skipped
X-OWM-SPF-MAILFROM: Pass
X-OWM-SPF: 0
Received-SPF: pass (sa-prd-rgin-012.btmx-prd.synchronoss.net: domain
DEU01-BE0-obe.outbound.protection.outlook.com designates 52.100.3.204 as
permitted sender) identity=helo; receiver=sa-prd-rgin-012.btmx-prd.synchronoss.net;
client-ip=52.100.3.204; helo=DEU01-BE0-obe.outbound.protection.outlook.com;
Received-SPF: pass (sa-prd-rgin-012.btmx-prd.synchronoss.net: domain
somebodyelse.onmicrosoft.com designates 52.100.3.204 as permitted sender)
identity=mailfrom; receiver=sa-prd-rgin-012.btmx-prd.synchronoss.net;
client-ip=52.100.3.204; envelope-from=badromnovbvrsaa6jwu63rd7dmczkesc@somebodyelse.onmicrosoft.com;
helo=DEU01-BE0-obe.outbound.protection.outlook.com;
X-Originating-IP: [52.100.3.204]
X-OWM-Source-IP: 52.100.3.204 (DE)
X-OWM-Env-Sender: badromnovbvrsaa6jwu63rd7dmczkesc@somebodyelse.onmicrosoft.com
X-SNCR-Rigid: 61B423C50CC0ABB1
X-OWM-DMARC: spf 7 dkim 7
X-OWM-DKIM: 2
X-RazorGate-Spam: true
X-RazorGate-Suspect: true
X-VadeSecure-score: verdict=spam score=300/331, class=spam
X-SNCR-VADESECURE: SUSPECT
X-RazorGate-Vade: gggruggvucftvghtrhhoucdtuddrgedvvddrtdejgdekgecutefuodetggdotefrodftvfcurfhrohhfihhlvgemuceutffkvffkuffjvffgnffgvefqofenuceurghilhhouhhtmecufedtudenucfuphgrmhffohhmrghinhgprhhtucdlfedttddmnecujfgurhephfffuffkvfggtgfgsehhqhertddttdejnecuhfhrohhmpefotgetfhgvtehnthhiqdggihhruhhsuceouhhnmhhonhhithhorhgvugesmhhitghrohhsohhfthdrtghomheqnecuggftrfgrthhtvghrnhepledukedujeejveegkeekkeeugffgudekudelvdeiteejffeutdehuedvteehudehnecuffhomhgrihhnpegslhhoghhsphhothdrsghonhgupdhlihhvvgdrtghomhdpmhhitghrohhsohhfthdrtghomhenucfkphephedvrddutddtrdefrddvtdegpdeihedrheehrdehvddrvdefvdenucevlhhushhtvghrufhiiigvpedvieegnecurfgrrhgrmhephhgvlhhopeffgfgftdduqdeugfdtqdhosggvrdhouhhtsghouhhnugdrphhrohhtvggtthhiohhnrdhouhhtlhhoohhkrdgtohhmpdhinhgvthephedvrddutddtrdefrddvtdegpdhmrghilhhfrhhomhepsggrughrohhmnhhovhgsvhhrshgrrgeijhifuheifehrugejughmtgiikhgvshgtseevrghrlhhoshhhrhgvnhdrohhnmhhitghrohhsohhfthdrtghomhdpnhgspghrtghpthhtohepuddprhgtphhtthhopehgihhllhdruggrvhhishhonhessghtihhnthgvrhhnvght
rdgtohhm
X-RazorGate-Vade-Verdict: spam 300
X-RazorGate-Vade-Classification: spam
Received: from DEU01-BE0-obe.outbound.protection.outlook.com (52.100.3.204) by sa-prd-rgin-012.btmx-prd.synchronoss.net (5.8.716.03)
id 61B423C50CC0ABB1 for x.x@btinternet.com; Sat, 15 Jan 2022 16:01:54 +0000
Received: from FR0P281CA0079.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:1e::19)
by FR0P281MB0834.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:52::14) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4909.2; Sat, 15 Jan
2022 16:01:53 +0000
Received: from FR2DEU01FT026.eop-deu01.prod.protection.outlook.com
(2603:10a6:d10:1e:cafe::db) by FR0P281CA0079.outlook.office365.com
(2603:10a6:d10:1e::19) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4909.5 via Frontend
Transport; Sat, 15 Jan 2022 16:01:53 +0000
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 95.217.0.148)
smtp.mailfrom=somebodyelse.onmicrosoft.com; dkim=fail (signature did not
verify) header.d=microsoft.com;dmarc=fail action=oreject
header.from=microsoft.com;
Received-SPF: Fail (protection.outlook.com: domain of
somebodyelse.onmicrosoft.com does not designate 95.217.0.148 as permitted
sender) receiver=protection.outlook.com; client-ip=95.217.0.148;
helo=rockillers.club;
Received: from rockillers.club (95.217.0.148) by
FR2DEU01FT026.mail.protection.outlook.com (20.128.124.63) with Microsoft SMTP
Server id 15.20.4909.2 via Frontend Transport; Sat, 15 Jan 2022 16:01:52
+0000
Received: by 2002:a25:ae1f:0:0:0:0:0 with SMTP id a31csp7044864ybj;
Thu, 28 Nov 2019 07:01:41 -0800 (PST)
X-Google-Smtp-Source: APXvYqyrq+LfRbr6Ut7oQiK6qVTfUlLq7TZvFm7YX3UJwseu/6kMF3WTNxgJVzCg5K0wVNYogp9w
X-Received: by 2002:a92:4b07:: with SMTP id m7mr50119995ilg.271.1574953301015;
Thu, 28 Nov 2019 07:01:41 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1574953301; cv=none;
d=google.com; s=arc-20160816;
b=DE5cIloxmXBof072tPSZ8NjBLC+A8SGzQcq4dNC1o5M8Rfe/nClIkRgDTJ+CH1wty+
E8D/Ra8jj4W31zcS0zA6dP5kEBvr5ojz/nxd7bAFnLhr5Wy9HsjmZpdL5jwSP7Xh8cVO
DVtMZoS56iv66nJ7nxXyc4/ERX4EEZhVoZBoyeCllGOQUcUCT3GGOwiGnWiPQrSEyVk8
4IdAED2LgbZXdSb6KQioJc80yXkWwnMTngiNUlsv+wM+UVFs1IE8RBGf/ovJv5v7t9Xq
leBaYpWaDtxCv9gpvYlqhmueZB83UnzHG0toZhp2D1egNM3FLAaKXNvDBQuhGKq4BTjL
dS8g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=content-transfer-encoding:mime-version:to:message-id:subject:date
:from:dkim-signature;
bh=whL+Bbwy59ZWOnMnh+b2PYhKLMSFRIIp3ml0a5Lz0mE=;
b=blbv84/wsk2naEhNBJL388MAtgl5vWUaEIn6MTNME88E/3V1E01mkn4Y3oVzGROVzG
pUniP003EEQXJszIlLnMKBH5NnTbVRsCVMsnhOrfmwYxvaPgOptAYh8/cIgbNFhJWsb4
3GT0xt+KK/by0K+WMg+glnOgDALSiSAPPxjA0VJFdcf40qaWxUA1L+DoCQBy02KIVKUi
5VK9CTANTTH9rtDx+lFhfcG+vpMAo0GG8ghVHc60pOcpU92MLZ5RyjG/T7Omr9C5m6YD
4cFjIr0m0poJ/by7BesyebQhb4P9WTsODFWKBzO13nyd3qE82tjYLrE6bNpTvZlrv0Q7
RZdg==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@microsoft.com header.s=s1024 header.b=pDEO1j8L;
spf=pass (google.com: domain of unmonitored@microsoft.com designates 65.55.52.232 as permitted sender) smtp.mailfrom=unmonitored@microsoft.com;
dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=microsoft.com
Received: from smtpi.msn.com (co1gmehub04.msn.com. [65.55.52.232])
by mx.google.com with ESMTPS id a10si19458664iln.121.2019.11.28.07.01.40
for <anotherperson@gmail.com>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
Thu, 28 Nov 2019 07:01:41 -0800 (PST)
Received-SPF: pass (google.com: domain of unmonitored@microsoft.com designates 65.55.52.232 as permitted sender) client-ip=65.55.52.232;
Authentication-Results-Original: mx.google.com; dkim=pass
header.i=@microsoft.com header.s=s1024 header.b=pDEO1j8L; spf=pass
(google.com: domain of unmonitored@microsoft.com designates 65.55.52.232 as
permitted sender) smtp.mailfrom=unmonitored@microsoft.com; dmarc=pass
(p=REJECT sp=REJECT dis=NONE) header.from=microsoft.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=s1024; t=1574953294; h=From:Subject:Date:Message-ID:To:MIME-Version :Content-Type:Content-Transfer-Encoding; bh=whL+Bbwy59ZWOnMnh+b2PYhKLMSFR IIp3ml0a5Lz0mE=; b=pDEO1j8Lim2Ln0F//7dB4lofUoeP5IlDa16PHY/0Hl+GNNprz2DLKv n1xXNnXF4s0mIMtTAO4UaQqU2AsSX5BEg2djuUJznPrxwJgar1CWZdhKTzOIBHXWIlnuq9ykD Um3RJccIqtzjUGg5P8m9tFDAhT83gR+w7+J6QEnWimFw=;
From: McAfeAnti-Virus <unmonitored@microsoft.com>
Date: Thu, 28 Nov 2019 15:00:58 +0000
Subject: Your Subscription may have ended?! Renew Now!
Message-ID: <BY0TXFU179U4.H0JKFUFQUCSL@localhost.localdomain>
To: x.x@btinternet.com
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-DKIM-Signer: DkimX (v1.11.111)
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 6d89ad39-e8a5-49b2-ecb9-08d9d8405904
X-MS-TrafficTypeDiagnostic: FR0P281MB0834:EE_
X-Microsoft-Antispam-PRVS:
<FR0P281MB0834C243193A912FF3566CAAFE559@FR0P281MB0834.DEUP281.PROD.OUTLOOK.COM>
X-MS-Oob-TLC-OOBClassifiers: OLM:9508;
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?utf-8?B?SnZvYjZQNWVVeWRPbTBNaTJ5OVNTdUdSQTlOV0ZOMkNuWmtoWEdOcGhLNGU4?=
=?utf-8?B?NzhoSTU3L2RhWUYremtJb2ZjL1RBd2YrUjEvWU04Y0hYSGRZVy9xN3RkOTZz?=
=?utf-8?B?MFpubGJndnpFMHJBbTJvOG1kWi9QTjJLa2Jid2xHS2lxV2JkbUFjTFJGSURJ?=
=?utf-8?B?L2daZXNjcDJuOTI1cUg1cGJSMkY5U0NQSm54Nnc1SVZIRytwQTFUOWZGNWpj?=
=?utf-8?B?MDV1WUFOWUtkVlQ4cy9GbE9OSUZPR3F5NDJ1Y21nWmhWazF5dU1wRndtUHNx?=
=?utf-8?B?eDBlUHRQSEM1VHNTb2xyM082M0t5endSQ3RzaVlQVmcvUnZoRkJMem9NTUpz?=
=?utf-8?B?UDBPUzB0OENjekRHSVQrNGxvTDVvL0dBOGhGcjhoYlVkWWdEa1ZIZFVod3FZ?=
=?utf-8?B?MjQyQnk5dTZjTlhjM0p4d2dZL2hrc0lJTWpWZkt2azU3Um5PbmVsYW1ocEpU?=
=?utf-8?B?QTFSWGlqSW9hUEJzQVNQR2RDZW9jVEViMS9YaFFlV3o1ZDlOODlpVGI4MDZn?=
=?utf-8?B?ZmY0ZndGUUVsZ3V0SW5oYXRaZldVMElUdDBXcTBtN2ZBUzBRQkNGRCtLanZF?=
=?utf-8?B?NzNFYkc3MllvRTlQTm9yVWVBcWV4MmoxY0JIaHdpY3hSSDZXaTJ6QjAxamQ2?=
=?utf-8?B?VGM4clJnNVdQTnB0bGN5VGtLWGtRc0xHUitOMmVMVXRXeURRR05LUmJZR1pB?=
=?utf-8?B?aFpHcGRVWmVBNXFwZXMwWThyc0JMSFhVSFpZUGU5R2tFbEs5dEY4R3JBOTd6?=
=?utf-8?B?Y0s4NG03QUozbDhCVldxYnRXb0JBU1FQZVlPcUQ2MVdrWm1lV0tneGxSbEx6?=
=?utf-8?B?K0p0dTJ3dU1xaTBnY1owdnJTZWJoVFkzZllXdFRvb21reG43RW9Zc0xzN2hj?=
=?utf-8?B?NEQ2bTBibXA0bStQbHdlaHhTdld4eGVoRWcvSlRvbFZpYnkyc29NZXg5aVEz?=
=?utf-8?B?dm9saVFza3cxZTdNUjJsNlEwMXhtRWcybFV3U2NiT1lxZkpBUUFpaFVLMmJj?=
=?utf-8?B?ZGp1NitmTHZxc3MvbDBDcWoydnpJVzFFMHd5QWdrc1p3eVhxQUVjbnI3VXRl?=
=?utf-8?B?VUhwU0hiNTFvYlEwbHJ6ZGRoaUVCZGtsd0sxZEk2Y09tT0pxWDhub0JxVVNW?=
=?utf-8?B?aE5JNThvclllNlczOUtIS2hUSjFBOGc2TWtrQzhWNUluNERGcnVsWjZaZzZK?=
=?utf-8?B?WitJSjZtYlhxMi9lS1ZkTmR2UUtOZS92WDY5V3ZObCsvaUdlbzJtcnJZZnBw?=
=?utf-8?B?MzBxRk1JRFJ0UHFSZnkyYzZ1K29oQ05MVzBiNzhuaGZnVmtCc0EwQVNGOTdr?=
=?utf-8?Q?1ruQrqPbBH2Ts=3D?=
X-Forefront-Antispam-Report:
CIP:95.217.0.148;CTRY:FI;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:rockillers.club;PTR:rockillers.club;CAT:NONE;SFS:(13230001)(39510400003)(376002)(396003)(346002)(34096005)(39860400002)(136003)(448600002)(47690400004)(36840700001)(46966006)(40480700001)(121820200001)(956004)(52230400001)(166002)(83380400001)(186003)(7066003)(356005)(7596003)(7636003)(26005)(84870400001)(47076005)(6916009)(36200700002)(10290500003)(82740400003)(83080400002)(36860700001)(33656002)(9686003)(2906002)(6666004)(5660300002)(82310400004)(66574015)(70586007)(70206006)(8936002)(8676002)(574094003)(336012)(83170400001)(34020700004)(42882007)(519844004)(90702004)(86972001)(84790400001)(15450700017)(20210929001);DIR:OUT;SFP:1501;
X-OriginatorOrg: somebodyelse.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Jan 2022 16:01:52.7169
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 6d89ad39-e8a5-49b2-ecb9-08d9d8405904
X-MS-Exchange-CrossTenant-Id: e0654e9c-b01d-4683-abc6-a8acb9d2408b
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e0654e9c-b01d-4683-abc6-a8acb9d2408b;Ip=[95.217.0.148];Helo=[rockillers.club]
X-MS-Exchange-CrossTenant-AuthSource:
FR2DEU01FT026.eop-deu01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: FR0P281MB0834

[jn_girl]

@gg30340  Thanks GG, no I hadn't seen your previous message 15 which explains how gmail.com got into the blocked sender list.