Ask HN: Are you also getting extremely obvious spam bypassing Gmail's filters?

575 points by kace91 ↗ HN
For the past weeks I've been receiving emails that are pretty obviously spam. Here's one I just got:

sender: Динасий Колпаков <kolpakovdinasij@gmail.com> subject: Q7425 7235 F0 8741 (empty body)

They all have similar formats, with a .htm attached file with ridiculous names like "Elon secret invitation" or "how to get free bitcoin".

They are all look like 90's era spam. Yet not only aren't they caught in the spam filter, they arrive to my main inbox, they aren't even classified as promotions or anything.

I can also see a long CC list, since it's not hidden.

Are any of you also having a similar problem?

284 comments

[ 3.7 ms ] story [ 267 ms ] thread
YES! I posted about this two weeks ago, one person agreed but the post never got any traction: https://news.ycombinator.com/item?id=28437472

I haven't heard anything about this when I asked colleagues / IRL friends... I wonder what is going on over at Google

Well that's good to hear, I can't find any mention about this problem anywhere and I was starting to think that I was being specifically targeted.

Except for the last one, all the calls to action seem to be crypto related, but I don't know if that's relevant to the origin of this attack. Perhaps it's just the most successful way of getting clicks nowadays (?).

It's baffling that google are letting these ones slip. Even marking some as spam does nothing to prevent new ones from coming.

> It's baffling that google are letting these ones slip.

Why would it be baffling? Google’s spam filters have always been extremely low quality, even mistaking email generated by Google itself as spam. They simply don’t have the pride of craftsmanship to improve it.

You live in a different universe than I do. Fascinating.

In my world, spam was a true problem that was killing email. Truly killing it. You would have to create a new address every 6 months to stay ahead of the spam and have a functioning inbox. Very different world.

Gmail fixed that. And for me, there have been issues from time to time and in fact i am getting this very spam myself, but gmail permanently stopped the hordes for me in 2004.

Now, don’t get me started on their insane categorization choices.

>Gmail fixed that.

Hardly. They didn't invent the tech. And they didn't perfect it. They haven't even tried. The evidence is in my Spam folder. I mean they mark messages they themselves originate as dangerous spam. "Dangerous" being their word, not mine. Screenshot from within the last hour:

https://imgur.com/IjQUGaY

I was in that earlier world too. They papered the problem over, a little. But no, they didn't fix it.

Just curious if you would post a little more of the screenshot? I don't think there's enough in the image for me to tell if it's from a spam address or not.
It’s from Google.

The return address is:

Google Alerts - googlealerts-noreply (at) google.com

I really want an inbox where i never see what anyone wrote if they don’t pay me the current price of a first class letter.
Spam wasn't killing email for me, but Gmail was a noticeable step up for sure. I do wonder how much was innovation on their part and how much of it was simply executing the same filtering techniques really well.

Now, my impression is that all of the well-regarded email providers do a good job of handling spam—it's no longer a differentiator. (Although it might start to be again if Google has genuinely let their guard down.) Fastmail does a good job in my experience.

I've also been getting the crypto spam in my inbox, usually as one of a ton of recipients. e.g:

Title: Rc 2 Xq 1677 Riyw 532

Sender: Чеслав Сальников <zeqiyic@gmail.com>

Body: 3688 867 8383 4 3 784

Attachment: Free Bitcoin - DELL .html

Same with me, been happening for a couple of weeks now. Sometimes multiple times a day. Just yesterday I had the following:

Title: V10 YU L2 RUO T778 ZRD

Sender: Тельман Кудряшов sefovuz@gmail.com

Body: 3484 2 0812 61 3

Attachment: Blockchain Prizes 3883 .htm

You are not the only one. Its been BAD for me for at least two months.
It is happening to me too, starting about a week ago.
> I wonder what is going on over at Google

Probably a whole lot of dont-give-a-darn-about-e-mail, because it's not new and sexy, and likely doesn't drive revenue.

Also, the people who suffer from gmail spam are often non-users of gmail. I.e. neither customers of Google, nor targets of its advertising, nor sources of personal information.

Google doesn't care if <you@filleocus.com> is getting Gmail spam, because that's an outside entity whose existence does not benefit Google.

Plus, Google knows that Gmail is so huge, that nobody can just block all of Gmail. Unlike some small-time mail domain, they do not feel any risk that, if they don't take action to combat spam, they will be blocked as a whole.

If a small-time domain's machine gets listed in some DNS black-hole lists or other dynamic anti-spam databases, they have to care, or they don't get to send mail. It's a dire situation to which they have to respond.

If a Google machine gets listed in these databases, Google doesn't have to care. Anyone actually blocking Gmail machines is essentially just cutting themselves off from a huge e-mail communication hub. It's almost as if that operator were blacklisting itself.

Small fry: OK, that does it, I shall not receive Gmail!

Google: Hahaha; say bye bye to more than half your contacts, then!

In other words, Google knows that e-mail operators who are using blacklists have to pretty much whitelist Gmail servers, and so it doesn't care about blacklists.

I too have been seeing this the last couple weeks, sorry to see I'm not the only one!
I've posted/commented about it as well.

Interestingly, they can change the font of the subject lines which no valid email I have ever received in gmail has a subject with a different font.

That would be an interesting filter: if subject is !Font, then spam.

I got a few of those myself. They use Unicode characters that look like ASCII letters and probably Google doesn't handle it well.
+1 I have the same issue, receiving similar emails every day with iOS notification
It's astounding to me that the default behavior on the gmail app is to actually push notify on every email, and that millions and millions of people leave this on.

Phones must be insufferable for most people.

At least with iOS you get asked the first time you install an app whether you want notifications or not. Android allows them by default, and apps are not shy to spam you to get to open them.
It's not every email, it's just the ones in the main inbox (as opposed to notifications, promotions, social, etc). At least for me, it usually maps almost perfectly with human-sent emails, so it's a good feature because I very rarely check my email manually.

It's pretty rare for me to receive more than a couple notifications a week at most.

yep. I am starting to get very annoyed with it .
Yes. Some reaching the Primary box.
Yep. This has happened a few times over the years and always seems to resolve after a while. I guess in the eternal game of cat and mouse in the world of spammers, sometimes the mouse gets the cheese.
Yet legitimate mail from my server with valid DKIM, DMARC, SPF, PTR record, decade old domain lands in spam. Good job, AI first Google/Gmail.
Who is to say that it isn't working as intended in building a higher wall around their ad garden? There should be a way for them to accept mail from self hosted users, or even provide some sort of testing tools (perhaps validated by credit card some type of bar to increase accountability? At least an RBL or something) for those who do, but nope.
I am beginning to think that the simplest explanation is the most likely one. Google is just bad at stuff...

If this was all part of some clever conspiracy then it would be, well, more clever...

Or more simple still, it's a hard problem to solve and when there's billions of emails flowing through the pipeline every hour small mistakes can look big to individual users.
Same as with gaming search, it’s possible that spammers are catching up with the Google smarts, and from this point it’s unclear how to proceed.
"Never attribute to malice that which is adequately explained by stupidity", except for the "promotions tab", that was clear malice to increase their ads revenue.
I don't think they're bad, it feels more like they hit the 80/20 point and move on to something else. In the case of spam detection, whatever worked ten years ago set and forget without anyone quality assuring it as things evolve.
Also, they want more people to use Gmail or GSuite. If that's the way to reach an Inbox on GMail, people simply choose the path of least resistance.
Have gotten multiple such emails the last couple of weeks.

I think Googles spam detection is a bit too much lax when the sender itself is using gmail.

These might as well be hacked accounts which have already proven themselves to be valid and "human" at a previous point in time? I doubt gmails spam detection would let a brand new account spam CC'd emails without any sort of detection.

GMail has been making it harder to sign into old accounts, forcing me to verify my device and also add a phone number to my old email accounts, and then sometimes still refuses to let me sign in.
Seen it too.

It must be all the pesky Russian disinformation that's everywhere, right? Surely google wouldn't tweak an algorithm to further anyone's narrative?

I just got one like this 5 minutes ago. They are getting clever i saw that they are embedding this.

onload="document.location.replace(window.atob('aHR0cHM6Ly9ibG9jay1jaGFpbi1ib3gudGsvbXpwaWwvP3RldHRoa3Yg'));"

Which if you decode you get a strange domain.

I assume gmail only looks for urls which in this case is not visible without decoding it

I thought you couldn't embed scripts/iframes into a html email?
These emails often include an attachment with an HTML file. My guess is depending on your client, it might just open a new browser window with the file (after it’s downloaded)
It is in an attached file. In my case the file is named

"Profitability 28388 .htm"

Yes, and don't forget to check your spam folder regularly because a bunch of legit email ends up in there too.
Couldn't believe how many legit emails were in there. Missed a handful of important emails and who knows how many more, since they're deleted after 30 days.
>Couldn't believe how many legit emails were in there. Missed a handful of important emails and who knows how many more, since they're deleted after 30 days.

The administrator of my email servers has a vested interest in making sure I get all valid emails and in junking the garbage.

Gmail administrators are interested in pleasing their boss and getting paid -- the quality of their spam filters and especially your interests aren't even in their top ten important issues.

The only problem with my set up is that if my email administrator gets bored, I'm screwed. Fortunately, that's unlikely as I am my email administrator.

I expect that many folks will dismiss this email as just some rando who doesn't understand just how important it is to have gmail or some other provider's email service because reasons.

But the truth is that quality service is based on having the right incentives. And Google (and by extension, their employees and contractors) have zero incentive to consider the needs and interests of their product.

And why should they? If you're a car salesman, do you worry about how a particular car will feel if sold to a jerk? If you're a barista, do you care if the lattes you make are consumed or thrown away?

I could go on, but I expect I've made my point.

Thanks. Just found a bunch of legit emails. Perhaps HN needs a monthly banner that says: check your Spam folder for real email before it expires for this month!
Yes! I don't know if it's related but some emails I've recently sent went to spam in other people's inboxes.
+1. In my case, it's not that many, maybe a few a week but enough for me to notice it. Most of them are offering "Free Online Quote" for car insurance and such.
Yes, I only mentioned it today to two coworkers who hadn't seen it on their mailboxes. I've been getting a few a week, some go to spam and some don't.
Yes. I send them to abuse@ every time I get them.
For the last year or so I've noticed an increasing amount of my legitimate professional interactions going into my "Promotions" tab in Gmail. The effect of which has been, after discovering a few mishaps of this sort, to now regularly and meticulously go through a massive pile of "Promotions" just to make sure I haven't missed something legitimately urgent or important. Prior to Google's classification errors producing this particular anxiety I used to basically treat the "Promotions" tab as spam to never look at. Now I'm going through all of it with prejudice which means I'm waaaaaaay more aware of marketing drivel than I used to be. As such, I'm pretty sure this "error" is intentional on Google's part to produce exactly this outcome of drawing eyeballs to inbox advertising.
I just disable this filtering. It’s more damage than good nowadays…
Nowadays? Try day one. I always thought of this as a misfeature and disabled it from the start. I have no idea how this would be useful to me.
For me, it's been the single greatest boost to email productivity. It works great 99%+ of the time for me where I only keep any eye on Updates and Primary, and maybe once a week clear out the Promotions tab. Forums and Social I can usually clear out without even looking.

Interesting how people can have such different experiences.

sort of this: i treated the Promotions tab as a "unsubscribe from these mailing lists ASAP" tab as soon as the category feature came out

i get so few of them now i removed all those extra tabs and filters a year ago, but it was pretty useful to get my total inbox as clean as it is now :)

Right, exactly. I want my "promotions" to land square one in my inbox, because then I'm going to deal with them right then and there. Unsubscribe comes first. A filter comes next, if they keep sending.
Gmail has a “report spam and unsubscribe” button which I use liberally.
I feel guilty using it the first go. I figure I will click on their unsubscribe link first. And then I will click the report spam button if they continue to send me email

Unfortunately, all I'm probably doing is just confirming my email address to generate future "mailing list" subscriptions.

Classical AI (i.e. manually-constructed email rules) is much better for this kind of thing, in my experience. You don't get spurious false positives; you can predict every false positive in your head before you even get the email, and if you want you can even add an extra rule to prevent it from happening in the first place!

“Unknown / trusted / spam senders” lists are a basic implementation of this concept.

This is why Inbox's Bundles feature was amazing. User-defined rules, emails either show up live or in digest form throughout the day, shown in your (one) inbox, not in some panel where secondary "labels" or "folders" are relegated to. Collapsed by default, but expandable.

Gmail thought that adding Snooze was enough to get feature parity and kill Inbox, but Bundles were by far the feature keeping me on Inbox.

I, for one, don't use that feature because I use two email addresses. People who know me personally only know one of them, and I use the other for registrations and subscriptions.
This has also had the greatest effect for me. If you don't share your main email with sketchy reselling parties, it remains surprising clean. And this on a 10 year old+ account.
I think it's the difference between people that unsubscribe from lists and those that don't.

If you're a regular unsubscriber, your email box is only ever filled with relevant important items.

I do the same thing with my phone notifications. If my phone ever gets a notification, it's something that directly concerns me.

I don't know how people live getting bombarded with stuff all day, but like you said, everyone's different.

I get quite a bit of emails that are not completely spam, but by no means urgent to see. The filtering has been great to let me focus on things I need to see immediately, without having to scroll through 50 different promotional things
If you didn't realize it, Google has managed to get you to waster your time actually going through advertising (instead of putting that on the side for you).

I'm really surprised most people aren't realizing this.

Huh. I thought it had something to do with my subscription to oss-security (the plain-text email causing some confusion in the filters). But clearly it's not just me...
Just made an account to let you know that this specific comment made me check my Promotions tab, which happened to contain… an invitation to schedule a software engineering interview. Would definitely have missed that if I didn’t get bored and read this HN thread midway through my lecture.
Life pro tip: most recruiters can't write emails that look like they came from humans rather than spambots. If you're actively looking for a job, check all your spam folders daily. I can't tell you how many actual job leads have ended up in mine.
Also, recruiters sends large numbers of similar emails so they look like a spammer to the filters. Then if people who get them just mark them a spam rather than deleting or responding, the problem is compounded.
Depending on your definition of spam, the recruiters might actually be sending spam. I once had a recruiter try to hire me for the company I was already working at and had clearly indicated on my Linkedin...
People who get them might not have opted into them. That is spam, by definition. Elephant in the room of "foot-in-the-door marketing"? I guess.
Many recruiters are sending their emails from a system, not writing them by hand. They look they came from a template, because they did.

Add to that that when that recruitment system was implemented, the recruiter probably didn't bother updating/customizing the default templates, making their emails just the same as everyone else's.

I received recently one of the most bizarre emails via gmail: one email completely written in Chinese. I was curious precisely because it didn't go to the spam folder. After running it through Google translate it actually looked like a legit job offer. What a pity life is so short and I have so many responsibilities, it would have been cool to grab a laptop and just go.
Its actually worth going through and unsubscribing to those promo emails just to make this easier.
This is an unusual problem that I also witness over and over again. The unusual part is that I'll get same-source emails (eg: mailing lists that I follow) scattered between two different tabs, so it is like Google only forgets where they go sometimes.

I drag them to the proper tab each time, but it doesn't seem to fix anything.

This HN submission is getting spam from gmail accounts, not to your gmail account.
This also happened to me. A very important email was put under the promotions. Usually I just kept the gmail tab open and didn't check my phone. Fortunately for me, I noticed this mail on my phone when I was clearing the unread status.

At the same time, all sorts of ads fall into my inbox repeatedly, even I deliberately mark them as spam or junk.

( Being cautious, I just checked the promotions again. And there is another important email lying. WTF!)

The only reliable low maintenance solution is to get your own domain with a catch all mail service.

Then for every email interaction with a 3rd party you make a unique address like amazondotcom3823@yourdomain.com.

You can then just add rules for each incoming mail domain to send them to a junk folder, especially if it was was a one time transaction and subsequent emails are just going to be marketing junk.

It also lets you know who has had their mailing lists compromised as there is virtually zero chance someone would guess the email address like the example above.

> Then for every email interaction with a 3rd party you make a unique address

Does that work for you? Have you caught many companies sharing your address?

I’ve been making unique addresses for a decade, and it has been a complete failure. I haven’t caught any companies sharing them, and it hasn’t stopped spam in the slightest. I’m not sure where spammers get my mail email address from, but they do, and so far I’m not seeing them get the individualized addresses, like ever.

Yep I've noticed a few, most of the breaches were disclosed to the public which is good. I've stopped using those services so I've just send them straight to trash now as they get non stop spam.

Before setting up a catch all domain I had 3 distinct email addresses I used as high/medium/low priority which helped, but its much simpler with the catch all domain as it goes into the same inbox, just with different "To:" addresses that you can easily filter on - I just right click in outlook and select move all mail to recipient to junk.

To be fair most of the mail I get is marketing and I could probably unsubscribe, its just easier to make a rule to filter them to junk.

I actually have a rule in my work email that tosses everything that contains the word "unsubscribe" and where I am the sole recipient. Hasn't done me wrong for years, as far as I know.
> as far as I know

Literally everyone claiming they never miss emails in spam, never have delivery issues with their custom domains or mailservers, etc

You know you can have a reliable custom domain hosted by companies like fastmail right?
Same observation here. My first two email addresses were ruined by what I presumed were data leaks (I was getting hundreds of spam emails a day in the hotmail era). Since using unique addresses, I've only had two compromised with spam. The original email addresses still are firehoses of spam though.
This would be illegal in Germany where you must take notice of every email accepted by your email server. The junk folder doesn’t help because you would need to read through it nonetheless.
What do you mean? Why would it be harder to notice mails with a catch all in place?
I'm not sure what German law forces Germans to read emails to a personal account which is the context of this thread.

If you are a corporation using gmail then you will likely have emails going into a shared mailbox or public folder and have team members triage emails as sales lead, spam, upset customer, etc.

lol either this is a dumb rule or a very dumb interpretation of a rule, please link a source if you can.
I could have written this. The exact same thing happens to me and now I am realizing you might be right and it might be on purpose so we scroll through all the unnecessary ads. Arrgh.
You can disable the grouping feature.

What I did to reduce the noise in my mailbox is to unsubscribe from all marketing emails, and I move the ones that still come through to spam folder. It was a bit tedious at first, but now gmail is doing a pretty good job at automatically filtering out senders that do not respect my request to unsubscribe.

There is no way to sort in gmail satisfactorily that I know? Like sort by subject, sender, etc... I can search, but I cant SORT.

Am I missing something obvious?

This is what decline looks like
Has always been a cat and mouse game with things shaking sometimes.
Yes, but also getting obvious non-spam going to spam, likewise with it being categorized as Promotions. It got to a point that I don't filter by Category now, I just have a standard 'Inbox' with Starred at the top.
Oops. I forgot to negate my if test.
Yes - I commented about the same awhile ago. How are spam filters not grabbing these "Amazon gift card" offers like the one I received below.

https://imgur.com/4efNttg

Yes, but fortunately on a secondary account. My main account still seems to be safe from it, but my secondary account has been getting spammed to hell the past week. CCs are the same username @ aol.com and other domains, which is amusing because those aren't domains I've ever used (with that username, and I haven't used AOL since 1995 or so).
I've gotten one of these every few days for the last couple weeks. It's bizarre. I report all as spam and haven't gotten one since Friday.
It's still better than Outlook which regularly sends legitimate emails into the spam folder.
Yes, it started in the last 3-4 days. I was going to ask on here if there were any high-profile data breaches recently. I never used Epik.
Yes, for me, gmail spam getting into my inbox increased from zero to one or two per day a few weeks ago.

It's very obvious; I'm sure the gmail team must know about it. I'd be curious to know whether they're planning on returning the spam detection back to the previous low false-negative rate.

>I'm sure the gmail team must know about it.

Of course they do. Its from all of the phone calls they've been receiving from their help lines and helpfully answering? Or maybe the bank of humans they have responding to emails sent to support.