8 ms·
Spam domains that plague my email
- elashri 4y agoI am surprised to see Washington state university emails used for spam to that extent.
- NikhilVerma 4y agoI am seeing Google constantly fail to catch obvious spam emails. At this point I suspect there is some institutional error on their part, where bad actors inside the org are allowing certain domains to simply not be spam filtered.
- fuckcensorship 4y ago“Never attribute to malice that which is adequately explained by stupidity.”
- SoftTalker 4y agoSorry, a "your account has been locked, please reset your password" email to an .edu address from a gmail.com address is 100% always fraudulent, a 5th grader could tell you that, yet google lets it go through.
- rdpintqogeogsaa 4y agoCould be a study to see how much response such an obviously fraudulent e-mail gets, sent from that same university conducting the study. I admit that it's a fringe case, but it could be a thing.
- prawn 4y agoI mark email from someone spam over and over, and it can still get past Gmail. It's infuriating.
- 2143 4y agoCreate a custom filter in Gmail to delete it; let it bypass the inbox and go straight to trash. (There's a "Filter messages like these" option somewhere)
- krageon 4y agoYour fix is essentially "roll your own spam filter"
- prawn 4y agoI'm aware, but I would've thought that marking something as spam would stop more almost-identical messages from the exact same email address. Having to create a custom filter for all the individual spammers that make it through is frustrating.
- r1ch 4y agoI've been seeing some cleverly encoded emails with multiple MIME parts that bypass the spam filter. Gmail decodes one representation but displays another. Luckily the content they show to the spam filter is mostly static so a regular filter can catch it.
- chaoz_ 4y agoI've done some experiments with Gmail/Outlook/other spam detection clients on different types of spam/phishing etc. There's always someone who claims simple naive bayes algo would do better than Google. I'm not able to share the research data, but Gmail filter is a lot better than everything else you see on the market, especially when it's not a newsletter-like advertisement spam, but an actual phishing attack on Org. Some people say Outlook has better filtering func, but usually tests are not representative and Outlook simply has stricter rule for unwarmed-ip. Which is not that great of a feature in real world scenario.
- 2Gkashmiri 4y agohow do mail delivery services work with this in protecting users from spam because their aim is to reach the inbox for their customers, spammers included
- Beltalowda 4y agoAnecdotally, I have to say I rarely have issues with FastMail's spam filtering, which uses SpamAssassin (not sure what their setup is exactly of course). I rarely get spam in my inbox (maybe an email or two a month), and it almost never marks things as false positives (last one was years ago).
- TheNewsIsHere 4y agoMy experience mirrors yours. Fastmail’s filtering is at least as good as Google’s for my inboxes, but Google and the other big players don’t seem to have spam filtering better than Fastmail’s on balance. Casually controlling for things like inbox age, I still get a bit more spam in my Google inboxes than in my Fastmail inboxes. Once you’ve warmed up/activated the personal mail filter in Fastmail, it seems to work better than anyone else’s.
- chaoz_ 4y agoSpamAssasin does ok only on subset of spam emails.. The problem is that underlying model is not capable to differentiate fake email from your boss (unless it's really simple) VS many other external emails you get. I guess you would still want that 2nd level of protection for your ORG with sensitive data even if some "please buy X" - spam emails are still getting in. Ofc Google is also not ideal :)
- lwf 4y agoSurprised to not see gmail.com in the list[1]. [1]: https://drewdevault.com/2021/02/25/Gmail-is-a-huge-source-of-spam.html https://drewdevault.com/2021/02/25/Gmail-is-a-huge-source-of... , https://news.ycombinator.com/item?id=26265329 https://news.ycombinator.com/item?id=26265329
- inferiorhuman 4y agoWhen I self-hosted email I used Spamhaus to as a block list and Spam Assassin to filter the rest. Gmail users made up the biggest chunk of spam that got through but it was never from Google/Gmail domains, it was almost always from a Gmail user with a custom domain.
- djbusby 4y agoI've used Postgrey, for Postfix, and it's greatly reduced my spam. However, first emails from new folk are delayed a bit. https://postgrey.schweikert.ch/ https://postgrey.schweikert.ch/
- sylware 4y agogrey listing seems to be the only reasonable way to keep the Email in the "free world" (namely where spammers are allowed to do their "thing"). But gmail will do everything to take over the Email using the "spammers" as an excuse.
- shapefrog 4y agoI wonder if SPF / DKIM / DMARC have improved this. Google domains doesnt make it quite as easy as other hosting providers, and to be honest if they were super serious about email abuse they should encourage every domain to use it.
- xmodem 4y agoThere is a marketing company that is constantly adding me to new spammy lists they are creating. They are using AWS SES / SendGrid / other reputable providers. The emails all pass SPF/DKIM/DMARC and filing abuse reports seems to get me taken off the list I complained about but I quickly get added to a different one. I am this close to auto-blocking anything from these large providers and switching to allow-listing the legitimate domains that can send me e-mail.
- nubela 4y agoThese are usually domains that belong to a disposable email service, be it public or private. I maintain a 100% free API [1] to check if an email belongs to a disposable email service. We dogfood the same API endpoint to prevent users who abuse disposable emails to create fake accounts for free trial credits. We use the domains found at https://www.stopforumspam.com/downloads https://www.stopforumspam.com/downloads amongst other sources of data. Works pretty well. We have close to eliminated fake account registration with the use of Recaptcha. [1]: https://nubela.co/proxycurl/disposable-email-checker-api https://nubela.co/proxycurl/disposable-email-checker-api
- r1ch 4y agoWhy does your API want the full email address? That becomes a privacy liability as surely the domain alone is enough.
- 8organicbits 4y agoCould be for aliases. foo+bar@gmail.com routes to foo@gmail.com, but you may prefer to only allow a single account for foo@.
- uallo 4y ago> We dogfood the same API endpoint to prevent users who abuse disposable emails to create fake accounts for free trial credits. I usually use disposable emails to test services but don't want to be spammed. Often, I later upgrade to a paid plan if I like the service. If they block disposable email addresses, I will not even try them at all.
- krageon 4y agoCongratulations, you make the internet worse for actual humans and better for corporations. Making the world a net worse place, for everyone that matters.
- nikanj 4y agoI use a disposable email address because I don’t want the organization to have my email. Thank you for making that harder.
- Brajeshwar 4y agoLooks like a very personal list. I would not advice anyone using this as part of anything. Rohith[1] is in India and most of the spam domains (did a quick split) in the list are similar sounding names of a lot of Indian companies/Startups. Not that the companies do not spam (they do) but emails/domain registration has become so easy that there are tiny setups/operations in every nook and corner of the streets/chawls/shanties of India trying to spam people. 1. https://drive.google.com/file/d/1Z7bBo_rMQB0nJYUs8wl4pZeZVUv6l6eH/ https://drive.google.com/file/d/1Z7bBo_rMQB0nJYUs8wl4pZeZVUv...
- krageon 4y agoYou appear to be trying to argue against something, but it reads as "this is a lot of Indian stuff, which is chock-full of spammers". Read like that, it seems like the list is a good one.
- Brajeshwar 4y agoAh! I'm sorry if it came out wrong. However, I was trying to make an observation when I saw the list. You want to start optimizing your spam-block list or something like that and realized you are not typically the target. You might end up looking and scouting to hit something that never came your way. My email(s) on my own domains has been on the Internet for more than two decades and I'm always happy to look at ways to prevent spam on them.
- butz 4y agoIn theory one can set any domain to "from" field, what about actual servers that sent the spam? How many of those spam emails have unsubscribe and/or complaint headers?
- avian 4y agoIn theory the domain you set the "From:" field to will have DMARC, DKIM and SPF set up and in theory the recipient that implements those protocols will discard your mail as sent from an unauthorized server.
- chaoz_ 4y agoAnd if you don't have at least DKIM + SPF, then you will not even reach any public provider's inbox.
- Ensorceled 4y agoThe spam emails pretty much ALL have unsubcribe headers now. I mean, they are all WORSE than useless since they are sending signal back to spammers, but Gmail is asking me to [Unsubscribe and Report Spam] anyway.
- Wronnay 4y agoI have a similar list: https://gitlab.com/cmiksche/blacklists/-/blob/master/hosts https://gitlab.com/cmiksche/blacklists/-/blob/master/hosts Did you think about adding your list to well known blocklists? You can add it to e.g. OISD
- onphonenow 4y agoThe Democratic Party and ngp van?
- egberts1 4y agoBut of course, https://www.theverge.com/2022/6/28/23186742/google-spam-proposal-republicans-democrats-campaign-fundraising https://www.theverge.com/2022/6/28/23186742/google-spam-prop...