HN Explorer

Ask HN: What's happening with Gmail spam filtering?

204 points by mirkodrummer ↗ HN
In the last 2 weeks my gmail inbox went from zero spam to at least 2/3 spam/phishing emails per day on the inbox. I'm marking them as spam but nonetheless it keeps happening. I'm wondering if because spam traffic increased and spammers found a new way to trick anti-spam or if gmail engineers changed something on their end. Is anyone experiencing the same?

Not a big deal as it's been almost a year I'm migrating off gmail and I'm keeping it only for a few things, but still annoying

149 comments

[ 813 ms ] story [ 5840 ms ] thread
giuliomagnifico
Same here, but lots of mails are not spam. I was loosing some important emails.

I don’t know but to me looks something wrong from Google side. Maybe they’ve tightened some filters.

navjack27
Yup same here. I just figure it'll get cleared up "at some point"
rbinv
Same, had my first (very obvious) spam mails reach my inbox in months.
xen2xen1
Actually noticed the same. Saw a spam email and was confused. Had that gmail address a decade or two, and don't remember the last time I saw one.
jonas-w
They announced that their spam filter got to good and that they will allow political spam to go around their spam filter.

https://www.androidpolice.com/gmail-political-spam-experimen...

smt88
It's not because the filter was "too good," it's because political campaigns use hyper-aggressive email tactics that they learned from digital marketers.

Trump's campaign(s) apparently took this to a new level (a friend of mine says he'd get up to 10 Republican emails every day, many of which had alarming subject lines) and now Republicans are claiming to be treated unfairly.

mcintyre1994
I'm not in the US and I don't think I've ever been emailed by a political party in the UK where I live. So I don't know how it normally is. But one of my throwaway emails somehow ended up on a Trump campaign list in 2020 and it was pretty insane. I'd get multiple emails per day saying I'd been hand picked by Trump to do something, which was usually either to send him some money or fill in a survey. Once I was hand picked by someone to e-sign Trump's birthday card, and probably also to send him some money. I can definitely see how any remotely good spam filter would be catching a lot of that stuff. And also there was no opt-in before they started emailing me and their unsubscribe button never worked.
smt88
They get through spam filters by default in my experience. Gmail is pretty lenient on established companies that obey the CAN-SPAM Act.

The issue is that many Republican voters were marking them as spam, which then taught Gmail to put them in spam for (at least) that user.

mschuster91
> Trump's campaign(s) apparently took this to a new level (a friend of mine says he'd get up to 10 Republican emails every day, many of which had alarming subject lines) and now Republicans are claiming to be treated unfairly.

Classic Republican move: they do something bad, and when people complain about that, complain that they're being censored/cancelled/whatever.

At that point, we're already in unfair competition area: when Republicans do everything they can to manipulate their voter base to donate money and Democrats refuse to engage in such tactics with their voter base (or at least keep the level down), how can anyone call that a "fair election"? Yes, it may be legal in terms of the law, but absolutely immoral.

catfishx
Thats rare, I have my GMail address publicly available on the internet and haven't gotten a single spam email in my life
witoldw
John Dvorak, is that you?
Double_a_92
It started in the last year. Before pretty much every single spam mail was filtered, now 1-2 per week still make it through.
enlyth
To offer a singular data point, contrary to other posters here, I am not seeing this at all, and I pretty actively use my two Gmail addresses which have been active since 2005. My spam inbox regularly gets correctly categorized spam, and important emails still correctly land in my inbox.
gambiting
Same here - I've had 6 different gmail accounts for years and years, and the frequency with which spam gets through is maybe 1-2 emails a year, if even that.
fluoridation
Same. I haven't gotten any spam in my inbox in years. The spammiest mails I get are mailing lists that some business subscribed me to.
mFixman
As a middle point between the main post and your comment, I have been getting 1 or 2 spam emails every week for the last couple of months.

Gmail's spam filtering was perfect before, so something is going on on my account (although not as dramatic as OP's).

rconti
It is incredibly strange to hear from you (and others in this thread) who don't have a spam problem with GMail. From everyone I've talked to, it seemed endemic. From my experiences with my own account (circa 2004), GMail has moved backwards in recent years. I'd say it became a serious problem a few years ago. Marking things as spam is useless because then you immediately start getting legitimate mail marked as spam. Marking those as not-spam just leads directly to getting more spam. It happens with a single click. It's a 2 position slider at this point.
dwringer
I get an unfiltered spam message in my inbox maybe once every month on average. I always assumed these are new campaigns with the newest "zero-day" exploits of the spam filter. Much more common is getting newsletters for which I have actually signed up, and marked as "Not Spam" in the past, delivered straight to my Spam folder.

The number of spam messages I get in general, judging from what shows up in the Spam folder, varies wildly from week to week. Sometimes I'll get five over a two-week period, and then get a week where I receive about 15 per day.

nkozyra
It comes periodically for me - I'll get 4-5 in a week and then months or a year will go by without one.

I have manually marked a large amount of prior emails as spam, not sure how personalized the filters are.

twic
Zero spam in my inbox, zero items in the spam folder (where they are deleted after 30 days).

GMail is not my primary email, though. I use it for Meetup.com, Slack, Steam, maybe one or two other things. A quick google search suggests that my email address does not appear on the internet. Maybe people not suffering from spam have similarly private addresses?

fluoridation
My main account is reachable from a few public places. I get spam but all of it goes to the spam folder and none of it to the inbox.
mrguyorama
I'm pretty sure my main gmail account has actually been dumped in a hack somewhere, it's old as time itself, and I STILL don't get any spam in it.

In fact, I actually miss occasionally useful stuff because half my incoming email gets classified as "promotions" and put in a separate folder I never check that was automatically created when I made the account. It's stuff like emails from humble bundle about new bundles and GOG about sales etc, so spam-adjacent

devilbunny
That subfoldering made me miss a lot of important stuff too. I turned it off when I realized what I wasn’t seeing.

Everything goes to inbox now. I heavily pruned the number of lists I’m on and just deal with the spam-adjacent stuff as it comes in; better than missing something I need to know.

enlyth
I agree it seems that there is a very polarized effect happening, according to the comments some people get constant spam in their inbox and some people have never gotten anything.

It would be interesting to know the cause. I have actually signed up to loads of dodgy websites over the years, my email has been "pwned" according to haveibeenpwned, etc. So there's nothing particular that I've been doing to shield myself from spam, but Google still catches it all perfectly.

But then again, I completely believe all the other people saying they _have_ had spam come through, so it remains a mystery as to why. Is it some specialized spam list of a certain group that know how to bypass the spam filter? Is it Google A/B testing their spam filter? Who knows.

ChrisRR
Same here. I've had one or two that slip through the cracks once every few months, but otherwise all spam gets sent to the spam box
noirbot
I have the middle of this - I have a couple Gmail adddresses/accounts. One of them is reliably getting spammed, often to the order of messages every hour some days, and has been for months. The others are all clean/getting their spam caught in the filter.
1123581321
I could’ve written your post (except I would’ve said 2004 instead of 2005) until a few months ago. Since then, about 10-20 of these types of emails get through the spam filter daily. I’ve had some luck creating filters after they hit my inbox, but about half of them don’t have predictable elements.

So I do believe something has changed and I wish I was still in your situation.

crazygringo
Same here. I haven't had Gmail let a single spam email through in years.

To the contrary, I find myself going through my spam folder to mark as NOT spam things like monthly newsletters from arts organizations. There are a bunch of concerts and plays I've sadly missed because of this. (Which I can only assume comes from people abusing the mark-as-spam button instead of properly unsubscribing, which sucks because it leads to other people missing the legitimate emails.)

Also things like invoices from Apple purchases (e.g. a paid app or AppleCare) show up in spam. Which isn't a biggie, but it does seem like bizarre that Gmail could ever get that wrong.

mavhc
99% fine here too
HideousKojima
I'm not getting as much as the OP, but I'm getting 1-3 obvious spam emails in my inbox a week, whereas it was once a month if ever before.
PascLeRasc
Same thing here, I can't think of a single spam email I've received since before the pandemic.

As a side topic, I've heard a lot of people say that the Gmail UI has changed and that it's unusable now. This is what mine looks like and I really like it, is it not how everyone else's looks too? https://imgur.com/a/3ahD0Ta

dpkirchner
Same -- I have three accounts on gmail that I check regularly and I haven't seen spam make it past the filters for months. One of the accounts uses an email address that is, I think, 20 years old and that I have used publicly throughout (and thus gets a fair amount of spam).
jeffbee
Also just offering anecdata, the last 10 messages in my spam folder have these origins:

1) 3 "legitimate" spams, i.e. unsolicited messages that the senders believe they should have sent. 3 of these. 2 via Constant Contact and 1 via Salesforce.

2) 1 random porn spam, via random spammer domain with valid SPF and DKIM.

3) 2 phishing scams with the same body arriving from random commercial domains without DKIM. These are almost certainly spread via malware/viruses/worms.

4) 1 Google promotion originating from Google with valid DKIM, because I mark all these as spam.

5) 2 phishing messages, with the phishing warning, that originated from gmail itself via HTTP. These are pwned google accounts or google accounts logged in on machines with malware (effectively, same thing).

6) 1 idiot Republican politician, via Mailchimp.

jader201
+1. I have a ridiculous number of Gmail accounts (like 20+), and regularly monitor 5 of them, and none are seeing regular spam.

I will say I’ve gotten what I consider spam from Experian where they claim to be MSAs (mandatory service announcements) on my account, but they’re clearly marketing, and I’ve just set up a rule to delete those. Done.

I also have gotten on political lists where unsubscribing doesn’t seem effective, so set up another rule to block those. Done.

Other than these 2 edge cases (that don’t seem to be blatant spam, just dark patterns), my inboxes are clean of spam.

I also have family (wife and two older sons) on Gmail, and haven’t heard them complain about spam.

One potential hint though: all of my Gmail comes through personal domains. So maybe these spam attempts are targeting gmail.com domain? I do have a gmail.com email, though, that gets forwarded to my personal domain one, and I still haven’t noticed any spam, FWIW.

SirensOfTitan
It’s been like this for a year. I don’t use Google services outside of work, but my mom has early Alzheimer’s disease, and emails about outstanding debts or free gift cards can confuse her sometimes.

I don’t understand what Google engineers do every day. Google apps are the worst products I interact with: from Gmail spam to daily freezes of the YouTube app on my Apple TV.

fergie
What is your primary spoken language? What language are your emails coming through in?
ldoughty
I'm guessing they are tweaking spam filters and you're in the test pool.

I've had very little spam on any of my Gmail addresses for the last 3+ years

adriancarrieres
Same, i was clear from spam for so many years, now I sometimes have ten spam/phishing per week, for a few months now
xchip
Same here, I get spam everday. Too bad they are not able to catch it :( Where is their AI???
fareesh
Midterms are coming up in the USA, expect the people in the tech companies to steer the technology in a direction that helps the party of virtue
pertymcpert
As much as they want to I don't think they're going to help the Republicans this time.
thegeekpirate
Had an account since beta. Don't recall receiving a single spam email until a few months ago at the very least, and have been receiving one roughly every couple of weeks. Very odd indeed.
brushfoot
This has been happening to me too but for months now.

Fot me, the spam that makes it through all comes from Gmail addresses. Maybe the filter is more lenient with Gmail accounts.

pcorsaro
For me, it just goes in cycles. For a couple of weeks, I'll get these spam emails from "Dick's Sporting Goods" telling me I won a chance at a Yeti cooler or something like that. These emails will make it through gmail's filter for a while, then they catch them, then they figure out how to get through again. That particular set of emails seems to be the only spam that ever makes it through the filter, but the cycle has been happening for quite a while now.
vidanay
I'm currently in the "Dick's Sporting Goods" cycle....a few months ago I was in the "Norton Renewal" cycle. In between was 5-6 weeks of silence.
smt88
I also get the Dick's Sporting Goods emails and am baffled and amazed that such a stupid, obvious scam is beating the world's best spam filters that have billions of data points in their training set.
JoeOfTexas
It's funny cause the from email is like: aklsdjflkasdjf@dkaljklsdjfls.com
elondaits
The crazy thing is that on the last year I found emails from Google, and Apple, in the spam folder. Apple's were invoices... of which I get a couple a month (iTunes purchases, subscriptions). Google's I think were announcements for services, etc. tied to a Workspaces work account.

I can't think of no actions I did (in terms of identifying email as spam) that could suggest I might consider emails from Google or Apple, or any emails with that content, as spam. I mark things regularly, but almost always actual spam / phishing, or commercial mass emails from companies I have no relation with (banks, etc.)

tnolet
Yep. Same on Outlook (née Hotmail). Announcements from Microsoft in spam.
ridgered4
> Google's I think were announcements for services, etc. tied to a Workspaces work account.

That kind of sounds like spam to me!

typeofhuman
Happening to me on Outlook.

Full image emails that are all too obviously spam.

CannisterFlux
Same thing for me, last couple of weeks I've seen a few emails appear, before that I've not seen inbox spam for ages. I also started getting Drive share notification spam around the same time, until I turned notifications off, but new random spam shares keep appearing if I check the app.
radarsat1
I started getting these Drive share notifications as well, always written in Greek for some reason. (Well, I didn't try translating, so could be just nonsense, but it was strings of Greek characters.)

Very strange, seems like an obvious security hole to just allow anyone to pop up notifications on my phone like that.

sgt
Same here, got 3 spam emails yesterday. It's been months since I saw that.
soco
I constantly receive the same kind of gmail spam: there's a package for me. Half a year already, 3-4 a day, from random addresses like rp.6sgzBKV9UH@mail.4t2d3uxkxo.com / over corpegg.com whatever that is.
55555
Do the emails contain links? 90% of spam filtering is checking if there's a link in the email. Spamming is easy if you don't need to include links, and the package spam often requests you call a phone number, which makes inboxing it trivial.
soco
Yeah they have t.co links and look like any standard spam, yet I keep receiving them. Go go google filtering.
LinkLink
Might be less to do with whats happening with spam filtering and more to do with the evolution and constant arms race spammers are a part of.
SyneRyder
The spam is quite likely coming via Google itself.

Google's mail servers have been compromised for several weeks now. It's commonly being used for infected crypto spam (all those "new traderbot" emails with the attached infected PDF, for example). I'm not yet sure if these are just compromised GMail accounts, or if the mail servers themselves have been compromised. There seem to be some reports on AbuseIPDB of intrusion attempts coming directly from Google's mail servers.

I've tried reporting it to Google (eg via SpamCop), and Google declines to receive reports. I have been reporting it through AbuseIPDB as well. Here is one Google mail server that has had over 300 abuse reports:

https://www.abuseipdb.com/check/209.85.167.48

There are many more, and I linked to a few more when I posted about it here on HN over a month ago:

https://news.ycombinator.com/item?id=32434810

tallanvor
Unfortunately every major provider has this happen. Google and Microsoft especially since they have their productivity platforms that send mail through the same infrastructure as their free email services. They also have to deal with more problems through compromised education accounts - students aren't that great at protecting their school credentials, and some businesses aren't much better.
sodality2
I don't think that it's common for a Google mail server to be brute forcing SMTP logins for other servers, and also sending high amounts of spam. It looks like the server has been compromised, or else why would Google be making SMTP login requests?
declon
You can give Gmail your SMTP login details and tell it to send your mail via another server.
0___0
weeks? more like months. Yep, can't report them via SpamCop. I always report them via https://support.google.com/mail/contact/abuse?hl=en Not sure why they can't fix their crap.
SyneRyder
Thank you! I somehow never came across that URL before. It's worth a try, though I'm not very optimistic it will help!

I'd genuinely be interested to know from someone working at Google why Google can't / won't solve this, even for the narrow clearly-defined cases I see.

stazz1
Occasionally I e-mail code@google.com I think someone somewhere actually reads it
dylan604
A) How much money does it cost Google to fix a problem?

B) How much money does it cost Google to not fix a problem?

If A > B then, duh!

hulitu
How many Google "engineers" do you need to change a lightbulb ?
dylan604
Apparently, 10% less than they currently have?
mrguyorama
100: 1 to actually change the lightbulb and 99 to build a new chat app
dylan604
How many GoogExes does it take to unscrew the lightbulb is the next question that comes to mind
alexvoda
Just set a filter to automatically forward spam to sundar (at) google (dot) com
dylan604
You assume of course someone not related to Googs other than having a gmail account is NOT the one with that email address.
nwellnhof
Yes, I've noticed this crypto/traderbot spam campaign a few weeks ago, and it definitely comes from Gmail itself. It's nice to see that it also affects other Gmail users. Maybe Google will finally get their act together and stop all the Gmail spam. Right now, I get about 100 spam emails from Gmail each month, making it the biggest source of spam for me. If it wasn't that half of the world uses their services, I'd have blocked Google's mail servers a long time ago.
jeffbee
Those outbound VIPs aren’t attached to “a mail server”. If some outside party has gained the level of access you are suggesting, to just freely use these VIPs, then they have compromised the entire Google.
mc32
Whatever happened to the Postini acquisition, did they get diluted over the years?
chrisjc
> compromised GMail accounts

If it is coming from compromised Gmail accounts, I wonder if these same accounts are also being used to post the handful of deep-fake Elon Musk crypto YouTube Shorts that inundate the Shorts feeds.

There's hundreds, maybe thousands of these videos being posted making Shorts practically unusable. And no amount of reporting or downvoting seems to affect their algorithm.

r1ch
Check the raw email body and see if it consists of multiple encoded MIME parts. I'm seeing some spammers sending the message body as one part of innocuous content but then a different part is displayed when you open the email. I'm guessing this confuses the spam filter enough to let it through.