13 ms·
Ask HN: What's happening with Gmail spam filtering?
In the last 2 weeks my gmail inbox went from zero spam to at least 2/3 spam/phishing emails per day on the inbox. I'm marking them as spam but nonetheless it keeps happening. I'm wondering if because spam traffic increased and spammers found a new way to trick anti-spam or if gmail engineers changed something on their end. Is anyone experiencing the same?
Not a big deal as it's been almost a year I'm migrating off gmail and I'm keeping it only for a few things, but still annoying
- break_the_bank 4y agoWas just discussing this with a collage today. I’m getting random emails that are basically PDFs claiming to be crypto invoices from PayPal form random gmail addressees sent to me and CC’d to paypal@noreply.billing
- giuliomagnifico 4y agoSame here, but lots of mails are not spam. I was loosing some important emails. I don’t know but to me looks something wrong from Google side. Maybe they’ve tightened some filters.
- navjack27 4y agoYup same here. I just figure it'll get cleared up "at some point"
- rbinv 4y agoSame, had my first (very obvious) spam mails reach my inbox in months.
- xen2xen1 4y agoActually noticed the same. Saw a spam email and was confused. Had that gmail address a decade or two, and don't remember the last time I saw one.
- jonas-w 4y agoThey announced that their spam filter got to good and that they will allow political spam to go around their spam filter. https://www.androidpolice.com/gmail-political-spam-experiment/ https://www.androidpolice.com/gmail-political-spam-experimen...
- jonas-w 4y agoRelated discussion: https://news.ycombinator.com/item?id=32915287 https://news.ycombinator.com/item?id=32915287
- smt88 4y agoIt's not because the filter was "too good," it's because political campaigns use hyper-aggressive email tactics that they learned from digital marketers. Trump's campaign(s) apparently took this to a new level (a friend of mine says he'd get up to 10 Republican emails every day, many of which had alarming subject lines) and now Republicans are claiming to be treated unfairly.
- mcintyre1994 4y agoI'm not in the US and I don't think I've ever been emailed by a political party in the UK where I live. So I don't know how it normally is. But one of my throwaway emails somehow ended up on a Trump campaign list in 2020 and it was pretty insane. I'd get multiple emails per day saying I'd been hand picked by Trump to do something, which was usually either to send him some money or fill in a survey. Once I was hand picked by someone to e-sign Trump's birthday card, and probably also to send him some money. I can definitely see how any remotely good spam filter would be catching a lot of that stuff. And also there was no opt-in before they started emailing me and their unsubscribe button never worked.
- smt88 4y agoThey get through spam filters by default in my experience. Gmail is pretty lenient on established companies that obey the CAN-SPAM Act. The issue is that many Republican voters were marking them as spam, which then taught Gmail to put them in spam for (at least) that user.
- mschuster91 4y ago> Trump's campaign(s) apparently took this to a new level (a friend of mine says he'd get up to 10 Republican emails every day, many of which had alarming subject lines) and now Republicans are claiming to be treated unfairly. Classic Republican move: they do something bad, and when people complain about that, complain that they're being censored/cancelled/whatever. At that point, we're already in unfair competition area: when Republicans do everything they can to manipulate their voter base to donate money and Democrats refuse to engage in such tactics with their voter base (or at least keep the level down), how can anyone call that a "fair election"? Yes, it may be legal in terms of the law, but absolutely immoral.
- filleokus 4y agoRight now, it's actually not that bad for me, but I (and others) experienced something similar a year ago: https://news.ycombinator.com/item?id=28635313 https://news.ycombinator.com/item?id=28635313
- paulgb 4y agoSame. It’s gotten much better for me since then, it used to be 2-3/day, now it’s ~1/month.
- catfishx 4y agoThats rare, I have my GMail address publicly available on the internet and haven't gotten a single spam email in my life
- witoldw 4y agoJohn Dvorak, is that you?
- Double_a_92 4y agoIt started in the last year. Before pretty much every single spam mail was filtered, now 1-2 per week still make it through.
- fergie 4y agoWhat is your primary spoken language? What language are your emails coming through in?
- hollowturtle 4y agoItalian, why?
- enlyth 4y agoTo offer a singular data point, contrary to other posters here, I am not seeing this at all, and I pretty actively use my two Gmail addresses which have been active since 2005. My spam inbox regularly gets correctly categorized spam, and important emails still correctly land in my inbox.
- gambiting 4y agoSame here - I've had 6 different gmail accounts for years and years, and the frequency with which spam gets through is maybe 1-2 emails a year, if even that.
- fluoridation 4y agoSame. I haven't gotten any spam in my inbox in years. The spammiest mails I get are mailing lists that some business subscribed me to.
- mFixman 4y agoAs a middle point between the main post and your comment, I have been getting 1 or 2 spam emails every week for the last couple of months. Gmail's spam filtering was perfect before, so something is going on on my account (although not as dramatic as OP's).
- rconti 4y agoIt is incredibly strange to hear from you (and others in this thread) who don't have a spam problem with GMail. From everyone I've talked to, it seemed endemic. From my experiences with my own account (circa 2004), GMail has moved backwards in recent years. I'd say it became a serious problem a few years ago. Marking things as spam is useless because then you immediately start getting legitimate mail marked as spam. Marking those as not-spam just leads directly to getting more spam. It happens with a single click. It's a 2 position slider at this point.
- dwringer 4y agoI get an unfiltered spam message in my inbox maybe once every month on average. I always assumed these are new campaigns with the newest "zero-day" exploits of the spam filter. Much more common is getting newsletters for which I have actually signed up, and marked as "Not Spam" in the past, delivered straight to my Spam folder. The number of spam messages I get in general, judging from what shows up in the Spam folder, varies wildly from week to week. Sometimes I'll get five over a two-week period, and then get a week where I receive about 15 per day.
- SirensOfTitan 4y agoIt’s been like this for a year. I don’t use Google services outside of work, but my mom has early Alzheimer’s disease, and emails about outstanding debts or free gift cards can confuse her sometimes. I don’t understand what Google engineers do every day. Google apps are the worst products I interact with: from Gmail spam to daily freezes of the YouTube app on my Apple TV.
- ldoughty 4y agoI'm guessing they are tweaking spam filters and you're in the test pool. I've had very little spam on any of my Gmail addresses for the last 3+ years
- adriancarrieres 4y agoSame, i was clear from spam for so many years, now I sometimes have ten spam/phishing per week, for a few months now
- xchip 4y agoSame here, I get spam everday. Too bad they are not able to catch it :( Where is their AI???
- fareesh 4y agoMidterms are coming up in the USA, expect the people in the tech companies to steer the technology in a direction that helps the party of virtue
- pertymcpert 4y agoAs much as they want to I don't think they're going to help the Republicans this time.
- thegeekpirate 4y agoHad an account since beta. Don't recall receiving a single spam email until a few months ago at the very least, and have been receiving one roughly every couple of weeks. Very odd indeed.
- brushfoot 4y agoThis has been happening to me too but for months now. Fot me, the spam that makes it through all comes from Gmail addresses. Maybe the filter is more lenient with Gmail accounts.
- pcorsaro 4y agoFor me, it just goes in cycles. For a couple of weeks, I'll get these spam emails from "Dick's Sporting Goods" telling me I won a chance at a Yeti cooler or something like that. These emails will make it through gmail's filter for a while, then they catch them, then they figure out how to get through again. That particular set of emails seems to be the only spam that ever makes it through the filter, but the cycle has been happening for quite a while now.
- vidanay 4y agoI'm currently in the "Dick's Sporting Goods" cycle....a few months ago I was in the "Norton Renewal" cycle. In between was 5-6 weeks of silence.
- smt88 4y agoI also get the Dick's Sporting Goods emails and am baffled and amazed that such a stupid, obvious scam is beating the world's best spam filters that have billions of data points in their training set.
- JoeOfTexas 4y agoIt's funny cause the from email is like: aklsdjflkasdjf@dkaljklsdjfls.com
- elondaits 4y agoThe crazy thing is that on the last year I found emails from Google, and Apple, in the spam folder. Apple's were invoices... of which I get a couple a month (iTunes purchases, subscriptions). Google's I think were announcements for services, etc. tied to a Workspaces work account. I can't think of no actions I did (in terms of identifying email as spam) that could suggest I might consider emails from Google or Apple, or any emails with that content, as spam. I mark things regularly, but almost always actual spam / phishing, or commercial mass emails from companies I have no relation with (banks, etc.)
- typeofhuman 4y agoHappening to me on Outlook. Full image emails that are all too obviously spam.
- CannisterFlux 4y agoSame thing for me, last couple of weeks I've seen a few emails appear, before that I've not seen inbox spam for ages. I also started getting Drive share notification spam around the same time, until I turned notifications off, but new random spam shares keep appearing if I check the app.
- radarsat1 4y agoI started getting these Drive share notifications as well, always written in Greek for some reason. (Well, I didn't try translating, so could be just nonsense, but it was strings of Greek characters.) Very strange, seems like an obvious security hole to just allow anyone to pop up notifications on my phone like that.
- sgt 4y agoSame here, got 3 spam emails yesterday. It's been months since I saw that.
- soco 4y agoI constantly receive the same kind of gmail spam: there's a package for me. Half a year already, 3-4 a day, from random addresses like rp.6sgzBKV9UH@mail.4t2d3uxkxo.com / over corpegg.com whatever that is.
- 55555 4y agoDo the emails contain links? 90% of spam filtering is checking if there's a link in the email. Spamming is easy if you don't need to include links, and the package spam often requests you call a phone number, which makes inboxing it trivial.
- soco 4y agoYeah they have t.co links and look like any standard spam, yet I keep receiving them. Go go google filtering.
- LinkLink 4y agoMight be less to do with whats happening with spam filtering and more to do with the evolution and constant arms race spammers are a part of.
- SyneRyder 4y agoThe spam is quite likely coming via Google itself. Google's mail servers have been compromised for several weeks now. It's commonly being used for infected crypto spam (all those "new traderbot" emails with the attached infected PDF, for example). I'm not yet sure if these are just compromised GMail accounts, or if the mail servers themselves have been compromised. There seem to be some reports on AbuseIPDB of intrusion attempts coming directly from Google's mail servers. I've tried reporting it to Google (eg via SpamCop), and Google declines to receive reports. I have been reporting it through AbuseIPDB as well. Here is one Google mail server that has had over 300 abuse reports: https://www.abuseipdb.com/check/209.85.167.48 https://www.abuseipdb.com/check/209.85.167.48 There are many more, and I linked to a few more when I posted about it here on HN over a month ago: https://news.ycombinator.com/item?id=32434810 https://news.ycombinator.com/item?id=32434810
- tallanvor 4y agoUnfortunately every major provider has this happen. Google and Microsoft especially since they have their productivity platforms that send mail through the same infrastructure as their free email services. They also have to deal with more problems through compromised education accounts - students aren't that great at protecting their school credentials, and some businesses aren't much better.
- sodality2 4y agoI don't think that it's common for a Google mail server to be brute forcing SMTP logins for other servers, and also sending high amounts of spam. It looks like the server has been compromised, or else why would Google be making SMTP login requests?
- declon 4y agoYou can give Gmail your SMTP login details and tell it to send your mail via another server.
- 0___0 4y agoweeks? more like months. Yep, can't report them via SpamCop. I always report them via https://support.google.com/mail/contact/abuse?hl=en https://support.google.com/mail/contact/abuse?hl=en Not sure why they can't fix their crap.
- r1ch 4y agoCheck the raw email body and see if it consists of multiple encoded MIME parts. I'm seeing some spammers sending the message body as one part of innocuous content but then a different part is displayed when you open the email. I'm guessing this confuses the spam filter enough to let it through.
- stewx 4y agoI've been getting 2-3 spam emails/day and for many years received 0/day.
- dadoge 4y agoSame
- Daviey 4y agoI've recently had the opposite problem. I had an external host receive email for a domain and then forward to gmail. The message envelope is changed, and SRS records are updated to be from the forwarding domain and DKIM is valid. However, over the last 2-weeks or so, Gmail has been hard rejecting the majority of the mail at SMTP time, which has caused a big pain! I really wish I could say "trust all mail from this mail server, but please also do Spam checking".
- johnklos 4y agoGmail has never properly allowed forwarding. All my users who want to check using Gmail have had to configure Gmail to fetch email from my servers via IMAP because Google otherwise treats my server as if it's a source of spam when it's forwarding.
- bluedino 4y agoI get about 10 per day. They all seem to come from hacked O365/Gmail accounts. All 4 of my Gmail accounts are affected. It's all the same crap that's obviously spam. "Dear Friend, I hope this email finds you well. I need your assistance in a matter..." "You've been chosen!" "Home Depot/TruGreen/Dicks Sporting Goods/ADT-Security" "Invoice enclosed" "You've received a direct deposit..." "Hot sex <insert emojis>" I would guess that Gmail is simply a legacy/commodity function at Google, so they have spam handled by lower-end employees or even contractors.
- civilized 4y agoWeirdly awed and relieved to know that I'm just a small part of the Dick's Sporting Goods spam epidemic.
- tgraham 4y agoThe "Dicks Sporting Goods" email is insane - probably hourly at the moment, from what would appear obviously bogus email senders. What is the non-obvious answer as to why these get through?
- lumost 4y agoThese are so absolutely ridiculous. The only (dumb) reason I can think of is that there is a large ML model which got used to seeing certain character sequences as not spam and spammers are starting to exploit it. It's kinda shocking as Gmail spam filtering was virtually flawless for over a decade, and now it's falling apart.
- Maken 4y agoMaybe the spammers learned about adversarial networks?
- lumost 4y agoAny non-ML method would trivially catch these spammers though. They share the common traits of 1. Sending identical emails to large numbers of users. 2. Using fake emails from fake domains. 3. Not looking at all like a regular email. This is the stuff that 90s era spam filters could block.
- manuelabeledo 4y agoI'm having the opposite problem. The spam filter keeps marking things as spam, when they clearly are not, and I have no way of telling it that they aren't. Now, I mostly don't mind it, but getting credit reports swept off my inbox is starting to get annoying.
- rconti 4y agoSure you can. Mark it as "not spam". Of course, do that once, and you'll immediately start getting more spam, but that's another problem.
- manuelabeledo 4y agoI do. Every time in fact. But the spam filter refuses to “learn”.
- thenickdude 4y agoYou can create filter rules that explicitly mark email from specific senders or with specific keywords as "never send to spam".
- manuelabeledo 4y agoI know that. But it is hard to understand that the same company that literally learns from your online behaviour, in order to target you with ads, cannot make its spam filter a bit smarter.
- kubik369 4y agoFor me, it was happening for most of August. Each day, around 10-20 emails. They were mostly the same 10 emails, verbatim. It has stopped around 2 weeks ago. I have no idea how the emails could have gotten through. It was the most obvious SPAM you could come up with; it didn't even have any weird characters or anything of the sort.
- johnklos 4y agoTangent: I've always wondered if forwarding spam (I don't use Gmail at all) to abuse@google.com works at all. Does marking spam from Gmail as spam count as reporting it? Or is Google one of those companies that either completely ignores spam complaints and/or makes spam reporting only work if you fill out a pain in the ass web abuse form?
- deleted 4y ago[deleted]
- eunice 4y agoI found gmail's spam filtering amazing from 2004 until this year, where it's massively gone downhill and I've been getting tons of obvious garbage hitting the inbox and things I want from known senders landing in junk. Moved my business email to fastmail, perhaps personal will soon follow.
- d3vmax 4y agoIn the last month what services/website did you sign up for online/offline? They maybe the source of the leak/spam. Alternatively, your ID got into the spammers list via a service you must have signed up for prior, which must have got hacked recently. Another scenario is your acquaintance/friend ID must be compromised and they spam everyone on their contact list. The spammers must be keeping it under 500 emails per day / gmail outgoing account to not go over google's thresholds.
- noirbot 4y agoThe issue is less "how did this happen" and more that I've been reporting these obvious spam emails as spam for literally months and I still get copies of the exact same email in my inbox the next day. I'm used to getting spam from all kinds of places, but Google's always been pretty good at having it not hit my inbox until recently.
- aceazzameen 4y agoI'm having the opposite problem. I have a custom domain email address through a webhost, which gets forwarded to Gmail. I've been using Gmail as my client since day 1 (around whenever Gmail first came out). Some time in early summer I stopped getting emails from my wife, who uses a plain Gmail address. I was missing messages in threads if she was the sender. This has never happened before. So I checked the logs on the webhost, and it turns out Gmail was rejecting mail sent from her with an error that her address is spam. And I don't mean it went into the spam folder. It straight up rejected the messages and wouldn't go to the Gmail servers at all. I found this crazy, because it was rejecting a Gmail address that has been used for years. And in message threads that included others with Gmail addresses. And if she emailed me to my actual Gmail address, it was fine and not spam. But her address (and only hers) gets marked as spam if sent to my domain. So my solution was to start using Thunderbird. Her messages were never being rejected by my domain and all the threads are there intact. Edit: This was the SMTP error that Google was telling my domain: "Our system has detected that this message is likely unsolicited mail. To reduce the amount of spam sent to Gmail, this message has been blocked."
- bashonly 4y agoi used to have a custom domain email forwarded to gmail that would receive github notification emails and the same thing happened to me with those a couple months ago
- lkrubner 4y agoThe opposite is also happening: I'm increasingly classified as a "promotion" when I write to my friends. I wrote to my close friend Natalie and I was like "Did you see my email?" and she said "No" and went to search for it, and eventually found it in promotions. I'm now treated as marketing or as spam, for some of my friends. This has been going on for some weeks now.
- projectramo 4y agoBy any chance, were you informing Natalie about a discount at Dick's sporting goods?
- HideousKojima 4y agoI've had a few emails in the last year that were clearly shipping confirmations with tracking numbers etc. that got classified as promotions
- dwighttk 4y agoOnce every 3 or 4 months I go for a week or two getting 2 or 3 obvious spam messages a day on gmail… it is weird because they are all nearly identical so it seems like it would be trivial to round them up once I mark the second one as spam.
- vmoore 4y agoMigrated to Fastmail a few weeks ago. It's going swimmingly. The private addresses feature is brilliant. I can tell what service sold my address or leaked it, or otherwise gave it out somewhere against my consent. If Gmail allowed for private aliases it would thwart spam, but they won't implement it because they're anti-privacy.
- pexabit 4y agoYou can always do "username+<servicename>@gmail.com" for this purpose. Doesn't help with privacy but tells you which service is leaking addresses.
- dmillar 4y agofwiw, companies that are selling/giving away your email address are wise to this 'hack.'
- dylan604 4y ago>You can always do "username+<servicename>@gmail.com" Um, that's a solid maybe. Some services drop everything after the +. Some complain about it being not valid. Use of the word always will pretty much always get you into a strange place
- hollowturtle 4y agoJumped on the fastmail train almost a year ago and can't complain, it's the only inbox I actually enjoy having. But I haven't been able to fully abandon gmail yet, according to my password manager I still have ~70 accounts registered with gmail over 190 total, it's been a pain so far...
- anderspitman 4y agoJust throwing my 2c in. This sounds cool in theory, but after a couple years of doing the same thing, I've identified exactly one case of an org giving my email address to a third party, and it was a local car dealership giving it to siriusXM because a car I bought had hardware for the service. That said, I absolutely love Fastmail and having my own domain for emails.
- stazz1 4y agoMy educated guess is that Political campaigns dumped a ton of money into Google and Google is whitelisting their trash
- ThrowawayTestr 4y agoI've also noticed the occasional spam in my gmail recently.
- FinanceAnon 4y agoYes, several phishing emails got through to my gmail in the last couple of weeks, which never happened before
- htrp 4y agoWe all being a/b tested....
- d23 4y agoI've been having the opposite problem. Things are going to my spam that are obviously not spam. The worst part is gmail automatically deletes after 30 days, with no way to configure that time period. I had to email some people recently to check whether they had reached out to me because I realized it probably went to spam (it did). Who knows how much other stuff I've missed.
- iamyi 4y agoI have been having this problem for at least a few months, when obvious spams by human eyes can get into my inbox daily. For example, I have to use gmail filters to remove the car dealership spams.
- racheltanks 4y agoI haven't had any issues.
- abeppu 4y agoIs this going to lead to a paid, improved spam filter subscription?
- kiseru 4y agoHah! I thought all the new spam was because we had recently moved because it was all dressed up as fake home warranty and insurance emails but a bunch of it has an old name from a breach over a decade ago. (Someone used my email with their name to open an account so a ton of my spam is addressed to some dude named Danny.) I was like, "Oh look, Danny is back." lol
- idk1 4y agoLooking at all the comments here, it looks like they could just check for if the title contains Dick's Sporting Goods and then it'll be spam. Oddly... that's what mine are too. Is this going to turn into some weird bug / edge case where only Dick's Sporting Goods emails can get through the spam filter?
- butz 4y agoIronically, as email services are making creating new accounts even harder, by adding mobile phone verification and Google outright blocking "untrusted" clients - spam count keeps growing from gmail and outlook (hotmail) domains. And looks like gmail spam filter ain't very good either, as no matter how many spam letters you mark as spam, one definitely will get through in the future. Another problem, that one cannot ban gmail or outlook domains for incoming spam, as most business contacts are usually using those.
- cfeduke 4y agoI started experiencing this myself a couple months ago, and of course searching for any sort of solution with modern search engines is a path to insanity. Because almost all of the spam that is getting through - to me, at least - follows a very simple template - something that spam blockers should be incredibly good at handling - I was able to concoct a reasonable solution. Google has this Apps Script thing* where you can deposit JavaScript and then schedule that JavaScript to run every minute. They expose a Gmail API and once you've given your script access to your Gmail inbox, you can process the unread messages and look for telltale signs of spam (for me, inspecting the subject for a regex match of `/confirmation#/i` has been adequate[0]) and finally move the message to spam. Since it runs every minute instead of on an event of new mail, new messages may appear unread for a short period of time. * though there are options to deploy your project it is not necessary to do so in order to run the script on a schedule 0. https://gist.github.com/cfeduke/1dfb7f650b9abbfce549eddffc9678bd https://gist.github.com/cfeduke/1dfb7f650b9abbfce549eddffc96...
- nanidin 4y agoI don’t use gmail but I have also seen a big uptick in spam getting into my actual inbox over the last few weeks. I use a filter that hasn’t been updated in years, combined with spamhaus blacklists. To me this means something like spammers have found a way to evade spamhaus blacklists since they were the most effect block to spam in my email chain.
- disknoir 4y agoThe same thing happened to me with Hotmail. It was previously great at spotting spam, but recently has stopped sending it to junk.
- dmitrybrant 4y agoI have similar issue, but with a different flavor: About 10 times per day I receive a blank email from an obviously throwaway spam account (e.g. vishal382190130 at gmail dot com) For the life of me I cannot understand the purpose or goal of these emails, from the spammers' point of view. I've heard the theory that spammers will send "test" emails to check if a destination account is active... But every day? All the time? Is it possible somehow to assure the spammers that my account is active, and to start sending me actual spam, instead of empty messages?
- Roverlord 4y agoView source, in the ones I get like that there usually is content but for some reason it isn't being displayed.
- narag 4y agoOld news for me. A few months ago, four or five messages a day during a month and then it stopped. It was always the same template written in several languages, English, French, Spanish, with clear signs they were trying to fool the filters with fake unsubscibe links, long generated ids and business keywords. Most of them were classified as spam, but one in ten passed through the filter.
- fwsgonzo 4y agoIt started happening fairly recently to me, and it's not a gmail account, but another popular option. I don't know what caused it.
- SleepilyLimping 4y agoGlad it's not just me. Noticed this issue myself. Have been enjoying ProtonMail.
- julienreszka 4y agoI noticed too. For years I had exactly zero spam but recently a few got through
- good_intentions 4y agoLate to the party here but if you scroll through the source of these messages, there are a few domains they use to host the "image" inside the message. Additionally some of the spammers try and use the "coord" HTML element to put links on their images. If you create a filter to immediately delete the messages with "coord" in the source and these image domains you should be decently covered: iili.io, caringbridge.org, mailingghost.store If anyone is interested in working towards root cause on this please let me know.