Getting more Spam?

[ChinaLamb]

I am getting a lot more spam lately that is getting through the spam filters without even getting a low spam score on it.

Most all of these are blank emails with an attachment - either rtf or jpg...

Anyway to tweak the filter to block these?

Thanks!

/CL

[Shelded]

In the last 30 days or so I get a spam a day. That's a 100% increase. I think all are of the type you describe, an attached image. They're all using two-letter domains so I am blocking those specific country codes.

[ChinaLamb]

I am getting 4-5 of these per day... But then I do have 7 actie email addresses...

Not all are two letter tld's though.

/cl

[n5bb]

And I seem to be getting less spam than normal recently. So my guess is that this is just a statistical fluctuation. Since only those with high spam report here, and spam attacks seem to come in waves, I think it's very hard for us to make any reasoned theories about changes we see. That's why Fastmail has per-user Bayes and user rules -- your spam may be different from my spam!

Bill

[COUME]

Chinalamb,

Same here. Was only getting the odd spam a week that was ending up in my inbox but currently it is several a week....

[DrStrabismus]

Image spam has made a bit of a comeback in the last month, it's been quite widely reported.

[COUME]

Originally Posted by DrStrabismus

Image spam has made a bit of a comeback in the last month, it's been quite widely reported.

The ones I received are not limited to image ones...

[ChinaLamb]

Originally Posted by n5bb

and spam attacks seem to come in waves,

Last year, I used to get one spam per month, now I get 4-5 per day. For me, this has not been waves, but a very steady increase in the amount of spam I get, and it is not going down... Anyhoo, hope the bayes or something finds a way to start tagging these as spam.

What is surprising is that it doesn't even seem to trip anything in the spam filter - there is no spam score on these emails at all. Ideally it would at least have a little bit of a spam score...

/cl

[n5bb]

Originally Posted by ChinaLamb

...What is surprising is that it doesn't even seem to trip anything in the spam filter - there is no spam score on these emails at all. Ideally it would at least have a little bit of a spam score...

I'm not seeing any of these -- or maybe they are just being filtered out. In the Options>Account Preferences screen near the bottom you can add headers (separated with commas) in the Extra Headers field, such as X-Spam-hits and X-Delivered-To. This allows you to see your spam hits and the message delivery address (even for BCC) when reading messages, without needing to choose to open the full headers.

• What do you see when you look at the X-Spam-hits header for these messages?
• If you are using the user Bayes filter, you should see "BAYES_USED user".
• Do you get a negative Bayes score (such as "BAYES_00 -2.599") or a positive Bayes score?
• If there is image spam, it will often trigger a spam hit such as "HTML_IMAGE_ONLY_28 1.561".
• Are you marking all of these as spam, so that your user Bayes filter is trained?

Bill

[ChinaLamb]

Originally Posted by n5bb

I'm not seeing any of these -- or maybe they are just being filtered out. In the Options>Account Preferences screen near the bottom you can add headers (separated with commas) in the Extra Headers field, such as X-Spam-hits and X-Delivered-To. This allows you to see your spam hits and the message delivery address (even for BCC) when reading messages, without needing to choose to open the full headers.

• What do you see when you look at the X-Spam-hits header for these messages?
• If you are using the user Bayes filter, you should see "BAYES_USED user".
• Do you get a negative Bayes score (such as "BAYES_00 -2.599") or a positive Bayes score?
• If there is image spam, it will often trigger a spam hit such as "HTML_IMAGE_ONLY_28 1.561".
• Are you marking all of these as spam, so that your user Bayes filter is trained?

Bill

Maybe I should clear my bayes database and start over???

Here is my Bayes Database info:
Num spam learned 487
Num non-spam learned 4
Bayes database used Global

I drop all these messages into a folder that hasthe following settings:
Spam learning: As spam [Mon, 1 Jun 2:06 PM (18 hours 43 mins ago)],
Auto-purge: Received > 2 days ago [Mon, 1 Jun 2:09 PM (18 hours 40 mins ago)]


This is what the email Header contains.
X-Sieve: CMU Sieve 2.3
X-Spam-score: 4.5
X-Spam-hits: BAYES_60 1, DCC_CHECK 2.5, RCVD_IN_PBL 0.905, RDNS_DYNAMIC 0.1,
BAYES_USED global
X-Spam-source: IP='77.20.16.153', Host='77-20-16-153-dynip.superkabel.de', Country='DE',
FromHeader='com', MailFrom='com'
X-Spam-charsets:
X-Attached: proved.rtf

Here is another
X-Sieve: CMU Sieve 2.3
X-Spam-score: 3.6
X-Spam-hits: BAYES_50 0.001, DCC_CHECK 2.5, SARE_RECV_VIRTUACOMBR 1.193,
BAYES_USED global
X-Spam-source: IP='201.44.1.145', Host='c92c0191.sts.virtua.com.br', Country='BR',
FromHeader='uk', MailFrom='uk'

And another
X-Spam-score: 3.4
X-Spam-hits: BAYES_50 0.001, DCC_CHECK 2.5, RCVD_IN_PBL 0.905, BAYES_USED global
X-Spam-source: IP='79.235.63.127', Host='p4feb3f7f.dip0.t-ipconnect.de', Country='DE',
FromHeader='cc', MailFrom='cc'
X-Spam-charsets:
X-Attached: narcoleptic.rtf

[n5bb]

Originally Posted by ChinaLamb

...What is surprising is that it doesn't even seem to trip anything in the spam filter - there is no spam score on these emails at all. Ideally it would at least have a little bit of a spam score...

Maybe I misunderstand what you mean by "there is no spam score on these emails at all".

• The email headers you listed have X-Spam-score values of 4.5, 3.6, and 3.4. So they do have a significant spam score. I use a spam score >1 to file into Junk Mail, so all of these would be classified as spam on my account.
• You can see from your headers and Bayes database info that you have not set up your per-user Bayes filter, since the status is Global. If you read the comments in the Spam/Virus Protection screen above the Bayes status, you will see that this feature only works after you have marked 200 messages as non-spam and 200 messages as spam. So you need to mark 200 desirable messages as non-spam and your per-user Bayes filter will be activated.

So there are things which you can do to keep such messages in the Junk Mail folder -- setting your spam settings more aggressively and using the per-user Bayes feature. That's the goal -- spam automatically filed in the Junk Mail folder, with as few false positives as possible. Address Book Whitelisting can keep your false positives very close to zero.

Spam is an awful problem, and unfortunately there isn't a magic wand which makes it go away. The senders are responsible, but unfortunately law enforcement hasn't been successful in shutting them down.

Bill

[robmueller]

Originally Posted by ChinaLamb

Maybe I should clear my bayes database and start over???

Here is my Bayes Database info:
Num spam learned 487
Num non-spam learned 4
Bayes database used Global

No, don't clear your bayes db.

What that shows is you've learnt 487 spam messages, but only 4 non-spam messages! For your personal bayes db to kick in, you need at least 200 of *each*.

So the best thing you can do is go into some folders you have with emails you've saved that are definitely non-spam, select a bunch of messages at a time (eg say 50), and then use the "Report non-spam" action. Do that for a few different folders worth of emails, because usually each folder people have has a different "type" of email (eg saved bank notices in one folder, friends emails in another, etc), and you want to get a good spread of non-spam emails to train your bayes db.

Once you've learnt a bunch, check again that you've got > 200 non-spam emails learnt, and you should find your personal bayes db kicks in, which should help.

Rob

[ChinaLamb]

Ok, Thanks all...

I have learned "non-spam" and now have a respectible number of emails that have gone through the bayes system. Waiting to see if this improves the situation at all. I also changed some of my spam rules to lower the bar for spam...

GREAT! Will see how this goes.



/cl