Blocking Spam domains not working

[bloop]

After nothing, me too.
It has changed a bit. The final redirected urls are on new domains but still hosted by Hetzner.
Block the whole address noreply@r.groupon.com as "for some reason" that BT don't seem to be able to expain, blocking noreply@r.groupon.com seems to work whereas *@r.groupon.com doesn't.
Whereas after the phishing urls, the emails were padded out with some old Microsoft email, they now seem to be padded with "salesforce" urls.

[Ribblelancs]

@jamiewood 

I'm on Norton 360 at the moment, and considering moving down to BT version of Norton.

In most cases you don't have to open a mail, before you suspect that it's spam. "report as spam" will send the mail to junk.
If you use an email client, it will show mails in "preview" which will show suspect links. Also it will give the option to download pictures, which you don't do if your mail is suspect. Then you could go to BT Mail and report as spam.....A long winded process, perhaps, but should be straightforward even with the BT version. (with Norton 360 this is integrated with the Client options: I don't know about the BT version).
It's the point of using "block sender" in BT Mail which 9 times out of 10 leaves you with an error message. This is something which needs clarification.

[Oddbodkin]

Thankfully, all the couponandgo stuff has ceased for me, either through blocking at my sub account level or because the company has indeed removed my emails from their mailing lists.

[andydenyer]

So the latest ones are now coming from *@*.shutterstockmail.com so I've added yet another rule to discard any of these in future (hopefully).

[andydenyer]

I can now add *@*.enemyterritory.org to the ever growing list (and that one got through to my inbox).

[bloop]

I got the shutterstock one too.   Toilet paper? Laced with malware.

The urls don't play properly through the sandbox but I'm assuming its for Andrex and its nothing to do with Andrex whatsoever and is just a phish to get your details for which they are paid E1.40 for each set of personal data they collect.   You can see the afilliate ad offer here on the website of a UK Limited company.  WOWTRK searches and indexes affilliate offers.

https://www.wowtrk.com/offer/portal-leads-toilet-paper-uk-cpl/

Adsmain, who are running the offer (presumably on behalf of somebody else?), is an American company.   Adsmain must know  which affiliates they have signed up and who the sponsor is?  Obviously they are not going to tell me, but I don't think it would be that hard for law enforcement to find out?

From one of the intermediate redirect urls:

a=4410&oc=11475&c=33385&m=3&s1=405&s2=7335_16&s3=76_436406_58_85597_md

I think a is affillate id, oc is the customer and c is the campaign?  That's as far as I've got.

[Bloodnock]

It's pretty pointless,  Spammers seem to have an infinite supply of throw way sender address's, I never see the same senders address twice so blocking them is like a game of Whack-a-Mole.

Why the bother even sending them is an enigma to me as I can't believe anyone one computer literate enough to use email would be stupid enough use the contents of these spam mails.

Surely BT can filter out key words like U-N-S-B-C-R-B-E  or other misspelt variations on words as well as email address that have a random address containing 25 random consonants either before or after the @

[Bloodnock]

BT really doesnt care that much about the problem,  I get up 30 spams a day and BT takes my Broadband Payments without a blink.

[Oddbodkin]

The rubbish way BT email is programmed doesn't help.

I have all my sub account emails sent to my main account but that means there's nothing in my sub account to allow me to block the spam sending domain. Blocking it at my main account doesn't work.

[NeilO]

Hi, @Oddbodkin when setting up the auto-forward in your sub-account you need to make sure that you've ticked Keep a copy in your inbox. That will allow you to set up rules and block from the sub-account as the emails will still be there. 

Thanks

Neil