Ask HN: Are you also getting extremely obvious spam bypassing Gmail's filters?
For the past weeks I've been receiving emails that are pretty obviously spam. Here's one I just got:
sender: Динасий Колпаков <kolpakovdinasij@gmail.com> subject: Q7425 7235 F0 8741 (empty body)
They all have similar formats, with a .htm attached file with ridiculous names like "Elon secret invitation" or "how to get free bitcoin".
They are all look like 90's era spam. Yet not only aren't they caught in the spam filter, they arrive to my main inbox, they aren't even classified as promotions or anything.
I can also see a long CC list, since it's not hidden.
Are any of you also having a similar problem?
284 comments
[ 3.7 ms ] story [ 267 ms ] threadI haven't heard anything about this when I asked colleagues / IRL friends... I wonder what is going on over at Google
Except for the last one, all the calls to action seem to be crypto related, but I don't know if that's relevant to the origin of this attack. Perhaps it's just the most successful way of getting clicks nowadays (?).
It's baffling that google are letting these ones slip. Even marking some as spam does nothing to prevent new ones from coming.
Why would it be baffling? Google’s spam filters have always been extremely low quality, even mistaking email generated by Google itself as spam. They simply don’t have the pride of craftsmanship to improve it.
In my world, spam was a true problem that was killing email. Truly killing it. You would have to create a new address every 6 months to stay ahead of the spam and have a functioning inbox. Very different world.
Gmail fixed that. And for me, there have been issues from time to time and in fact i am getting this very spam myself, but gmail permanently stopped the hordes for me in 2004.
Now, don’t get me started on their insane categorization choices.
Hardly. They didn't invent the tech. And they didn't perfect it. They haven't even tried. The evidence is in my Spam folder. I mean they mark messages they themselves originate as dangerous spam. "Dangerous" being their word, not mine. Screenshot from within the last hour:
https://imgur.com/IjQUGaY
I was in that earlier world too. They papered the problem over, a little. But no, they didn't fix it.
The return address is:
Google Alerts - googlealerts-noreply (at) google.com
Now, my impression is that all of the well-regarded email providers do a good job of handling spam—it's no longer a differentiator. (Although it might start to be again if Google has genuinely let their guard down.) Fastmail does a good job in my experience.
Title: Rc 2 Xq 1677 Riyw 532
Sender: Чеслав Сальников <zeqiyic@gmail.com>
Body: 3688 867 8383 4 3 784
Attachment: Free Bitcoin - DELL .html
Title: V10 YU L2 RUO T778 ZRD
Sender: Тельман Кудряшов sefovuz@gmail.com
Body: 3484 2 0812 61 3
Attachment: Blockchain Prizes 3883 .htm
Probably a whole lot of dont-give-a-darn-about-e-mail, because it's not new and sexy, and likely doesn't drive revenue.
Also, the people who suffer from gmail spam are often non-users of gmail. I.e. neither customers of Google, nor targets of its advertising, nor sources of personal information.
Google doesn't care if <you@filleocus.com> is getting Gmail spam, because that's an outside entity whose existence does not benefit Google.
Plus, Google knows that Gmail is so huge, that nobody can just block all of Gmail. Unlike some small-time mail domain, they do not feel any risk that, if they don't take action to combat spam, they will be blocked as a whole.
If a small-time domain's machine gets listed in some DNS black-hole lists or other dynamic anti-spam databases, they have to care, or they don't get to send mail. It's a dire situation to which they have to respond.
If a Google machine gets listed in these databases, Google doesn't have to care. Anyone actually blocking Gmail machines is essentially just cutting themselves off from a huge e-mail communication hub. It's almost as if that operator were blacklisting itself.
Small fry: OK, that does it, I shall not receive Gmail!
Google: Hahaha; say bye bye to more than half your contacts, then!
In other words, Google knows that e-mail operators who are using blacklists have to pretty much whitelist Gmail servers, and so it doesn't care about blacklists.
Interestingly, they can change the font of the subject lines which no valid email I have ever received in gmail has a subject with a different font.
That would be an interesting filter: if subject is !Font, then spam.
Phones must be insufferable for most people.
It's pretty rare for me to receive more than a couple notifications a week at most.
If this was all part of some clever conspiracy then it would be, well, more clever...
I think Googles spam detection is a bit too much lax when the sender itself is using gmail.
These might as well be hacked accounts which have already proven themselves to be valid and "human" at a previous point in time? I doubt gmails spam detection would let a brand new account spam CC'd emails without any sort of detection.
It must be all the pesky Russian disinformation that's everywhere, right? Surely google wouldn't tweak an algorithm to further anyone's narrative?
onload="document.location.replace(window.atob('aHR0cHM6Ly9ibG9jay1jaGFpbi1ib3gudGsvbXpwaWwvP3RldHRoa3Yg'));"
Which if you decode you get a strange domain.
I assume gmail only looks for urls which in this case is not visible without decoding it
"Profitability 28388 .htm"
The administrator of my email servers has a vested interest in making sure I get all valid emails and in junking the garbage.
Gmail administrators are interested in pleasing their boss and getting paid -- the quality of their spam filters and especially your interests aren't even in their top ten important issues.
The only problem with my set up is that if my email administrator gets bored, I'm screwed. Fortunately, that's unlikely as I am my email administrator.
I expect that many folks will dismiss this email as just some rando who doesn't understand just how important it is to have gmail or some other provider's email service because reasons.
But the truth is that quality service is based on having the right incentives. And Google (and by extension, their employees and contractors) have zero incentive to consider the needs and interests of their product.
And why should they? If you're a car salesman, do you worry about how a particular car will feel if sold to a jerk? If you're a barista, do you care if the lattes you make are consumed or thrown away?
I could go on, but I expect I've made my point.
Interesting how people can have such different experiences.
i get so few of them now i removed all those extra tabs and filters a year ago, but it was pretty useful to get my total inbox as clean as it is now :)
Unfortunately, all I'm probably doing is just confirming my email address to generate future "mailing list" subscriptions.
“Unknown / trusted / spam senders” lists are a basic implementation of this concept.
Gmail thought that adding Snooze was enough to get feature parity and kill Inbox, but Bundles were by far the feature keeping me on Inbox.
If you're a regular unsubscriber, your email box is only ever filled with relevant important items.
I do the same thing with my phone notifications. If my phone ever gets a notification, it's something that directly concerns me.
I don't know how people live getting bombarded with stuff all day, but like you said, everyone's different.
I'm really surprised most people aren't realizing this.
Add to that that when that recruitment system was implemented, the recruiter probably didn't bother updating/customizing the default templates, making their emails just the same as everyone else's.
I drag them to the proper tab each time, but it doesn't seem to fix anything.
At the same time, all sorts of ads fall into my inbox repeatedly, even I deliberately mark them as spam or junk.
( Being cautious, I just checked the promotions again. And there is another important email lying. WTF!)
Then for every email interaction with a 3rd party you make a unique address like amazondotcom3823@yourdomain.com.
You can then just add rules for each incoming mail domain to send them to a junk folder, especially if it was was a one time transaction and subsequent emails are just going to be marketing junk.
It also lets you know who has had their mailing lists compromised as there is virtually zero chance someone would guess the email address like the example above.
Does that work for you? Have you caught many companies sharing your address?
I’ve been making unique addresses for a decade, and it has been a complete failure. I haven’t caught any companies sharing them, and it hasn’t stopped spam in the slightest. I’m not sure where spammers get my mail email address from, but they do, and so far I’m not seeing them get the individualized addresses, like ever.
Before setting up a catch all domain I had 3 distinct email addresses I used as high/medium/low priority which helped, but its much simpler with the catch all domain as it goes into the same inbox, just with different "To:" addresses that you can easily filter on - I just right click in outlook and select move all mail to recipient to junk.
To be fair most of the mail I get is marketing and I could probably unsubscribe, its just easier to make a rule to filter them to junk.
Literally everyone claiming they never miss emails in spam, never have delivery issues with their custom domains or mailservers, etc
If you are a corporation using gmail then you will likely have emails going into a shared mailbox or public folder and have team members triage emails as sales lead, spam, upset customer, etc.
What I did to reduce the noise in my mailbox is to unsubscribe from all marketing emails, and I move the ones that still come through to spam folder. It was a bit tedious at first, but now gmail is doing a pretty good job at automatically filtering out senders that do not respect my request to unsubscribe.
Am I missing something obvious?
https://imgur.com/4efNttg
It's very obvious; I'm sure the gmail team must know about it. I'd be curious to know whether they're planning on returning the spam detection back to the previous low false-negative rate.
Of course they do. Its from all of the phone calls they've been receiving from their help lines and helpfully answering? Or maybe the bank of humans they have responding to emails sent to support.