|
Patch reliability is unclear, but widespread attacks make patching prudent. Go ahead and patch, but watch out for potential problems. |
Recently at the office I had to go in and edit the spam settings because I got tired of all sorts of spam and email threats coming into the office. If
[See the full post at: Are you gettng more spam in your inbox?]
Susan Bradley Patch Lady/Prudent patcher
If you are on Microsoft 365 you can edit the spam levels by following this.
Work/school accounts only. Not Personal/family.
The bother comes in having to empty the spam folder in Outlook.
If you are sure that the emails placed in your Spam folder are Spam and you want to delete them, you can set Outlook up to automatically empty the Spam folder. I set my Outlook to permanently delete all emails in the Spam folder that are 1 day or older; which gives me the chance to view the Spam folder and move any email that I want to another folder.
Here’s how to set the Spam folder to auto delete:
Outlook will now delete all emails in the Spam folder that are 1 day or older.
HTH, Dana:))
I do not use Outlook or Microsoft 365. My email ISP is AT&T, which contracts with Yahoo! to provide the email service. I am using the Firefox browser. Ublock Origin has been doing a decent job of blocking advertisement emails. (If I disable Ublock Origin, these advertisement emails will appear).
But, there is now another kind of e-mail that is slipping through and this is becoming more and more frequent. I don’t know whether to call it spam or a phishing scam. For simplicity, I’ll call it “fake e-mail”.
They all purport to be from some legitimate website, whose URL is specified in the email header, and the sender is an e-address from that URL. But the email message itself is about ADT services, solar installation, a lapsed Amazon Prime membership , etc. They all have a “Get My Quote” or “Update Payment Details” button to click on. There is an “unsubscribe” link at the bottom of the message. I’ve been getting 3 or 4 of these fake e-mails a day for the past 2 or 3 months. I haven’t look at the raw messages of them all, but the most recent ones have a return path with a character string that ends in “@netorg12345678.onmicrosoft.com” or ends in “@msn.com”.
I have sent all of these to the Yahoo! SPAM folder, where Yahoo! mail is supposed to be keeping a record of them and consequently filtering them out in the future, but since the sender is some ever-changing e-address at some ever-changing legitimate URL, the spam filter is short-circuited. For the same reason, it won’t do any good to block the sender. And, I agree with Susan that clicking on the “Unsubscribe” link would only confirm my existence.
There is some commonality in them all (i.e., in some aspect of the return path). but I don’t see any way in AT&T’s Yahoo! mail to set up filtering rules.
Here is one purporting to be from riptapparel.co, (a website I’ve never, ever visited), but the email message is about ADT services with a button to click on to get a quote. The URL underlying the quote button is “amj.m0nster.co/ (very long string of characters)”. The e-address in the ‘TO’ line is not my email address, yet the email reached my inbox! (Some of these fake e-mails do have my e-address in the “TO” line.) The return path in the raw message is “<cZP1HyDmqyUKmurHyN@netorg13076102.onmicrosoft.com>”.
This morning, I received 2 that are almost the same, with a header that says “www.lacounty.gov”, a “From” address that says “ADT Security Systems <ph@subscriptions.lacounty.gov>”, a “To” address that is my e-address, and a message about ADT services. The “Get My Free Quote: button has a “google.softmedicaly.com/(long string of characters)” underlying it. When I look at the raw message of the 1st email, the return path is “<obKrGembv3RnbMRexp@netorg13028351.onmicrosoft.com>”; the return path of the 2nd email is “<o48NG1tXvnWCOcXC0u@netorg13032052.onmicrosoft.com>”.
Yesterday, I got fake e-mail purporting to be from “Susan@kidsmatterscouneling.com” . The message was about a lapsed Amazon Prime Membership and contained a button to “Update payment details”. I get lots of these and they have a return path “<1Return.(character string).msn.com>”. I don’t have an Amazon Prime subscription, so I know these are fake.
I don’t know what I can do to stop them from appearing in my Inbox. And it looks like Yahoo! mail doesn’t know what to do either.
[This reply specifically referenced the post by WCHS, from 8/13.]
My email details line up rather substantially with yours, with a few minor differences. There is a steady stream of clearly bogus credit card signup or loan offers, none of which would remotely be of any interest — even in the very remote event that they were genuine. The other predominant spam lately is a daily stream that is supposedly from Zales or a couple other national jeweler outlets. (I’ve never browsed anything online that might suggest an interest in that consumer category.) The thing that really stands out with these is that they made no attempt at all to have their (phony, spoofed) Sender’s address match up with the header or ostensible subject. If I had a dog, even he could see through that ! All of this CRAP just makes processing email much more of a time-consuming chore. I can and do select ‘Block Sender’ on these, for the future iterations, but they obviously have easy ways of getting around that. Yahoo Mail just ain’t up to the task. (Here’s hoping it does not share the 500 Senders or Items blocking limit that EarthLink previously had — which might only stand up to 2 – 3 weeks of this.)
What might be a lot more useful would be an ability to zap emails based on the presence of some recurrent, telltale keyword — like “Zales“, as per my example — particularly in the header.
I’m leery of entrusting some third-party solution like Mail Washer to deal with this. You could never be entirely certain that it did not automatically toss out something that proved to be legit and of some importance.
Rarely. Thunderbird sometimes flags a message “this might be spam” or “this looks like spam” and puts it in a junk folder. Those messages have always been from familiar sources, I click “not spam”, and they are returned to the inbox.
Win 10 Pro, 64-bit, 22H2, Firefox, Thunderbird, Duckduckgo, Office 2007 Enterprise (working fine so far, no reason to change yet, only use Word, Publisher, occasionally Excel).
I have not noticed an increase in spam, at least yet.
I have several email addresses, but Yahoo is my main one from many years ago. I’ve hung on it and here’s why:
You can create up to 500 unique disposable addresses that do not expire until you delete them. You first create a unique “header” that remains the same. Examples:
“header” = your unique header.
header-amazon@yahoo.com
header-github@yahoo.com
header-HowToGeek@yahoo.com
header-netflix@yahoo.com
And so on…
I find them a very handy in two everyday scenarios:
1) Say you’ve subscribed to a Netflix newsletter and you later “unsubscribe” multiple times, but keep receiving them anyway. Just delete the disposable address. You can re-create the same address or a different one later.
2) If you start getting email from a different website using one of your disposables, you’ll know from where they got it immediately. I used to see this scenario routinely, but it’s very rare now.
I have created about 350 of the allowed 500 disposable addresses over several years. For me it’s P.O.M.
Custom desktop Asus TUF X299 Mark 1 16GB RAM i7-7820X
4 27" 1080p screens 2 over 2.
Laptop Clevo/Sager i7-9750H - 17.3" Full HD 1080p 144Hz, 16GB RAM Win 10 Pro 22H2 all
The place to interact with spam (and false positives) is via the web client for your mail provider.
These days, most servers (especially Microsoft and Gmail) use a tool called “Bayesian filters” as a part of how they interact with incoming mail. The idea of a Bayesian filter is that if a message is marked as spam (or not spam) than other messages that are sufficiently similar will be considered the same way. The Bayesian filter focuses on the entire package of the message (not just the headers). All it takes is to use the web client’s Junk button to inform the server. As such, it’s good for catching near-identical messages that appear to be coming from different sources.
Depending on how the server is implemented, a Bayesian filter can force spam into a Junk folder, and in some circumstances, be enough to force rejection of a message entirely.
With this in mind, it’s also essential to correct false-positives, if a legitimate message gets put in a Junk folder.
Although stand-alone clients (e.g., Thunderbird, desktop Outlook, etc.) also offer spam-filtering tools, the value of them is limited. The server tools are a part of the server’s setups and are active at the time the message is being delivered to the server. By contrast, client tools can only interact with a message after it’s been accepted by the server, and messages already written to the Inbox (or in the case of false positives, the Spam folder).
Do you Right-click the email in question and select Filter emails like this from the context menu?
I’ve looked at the link and have right-clicked to see the screen for filtering. I don’t think this is going to work b/c a) the sender address always changes, b) the subject line always changes, and c) the “msn.com” or “.onmicrosoft.com” is not in the body of the email; it’s in the RETURN-PATH — examples are — Return-Path: <1NFZ4PNTgA1lXpbKme@ealbuhdw.onmicrosoft.com> or Return-Path: <ncujhwqjvfwem@msn.com>. I don’t think these lines are considered the “email body”.
The email body in the raw message does not even correspond to the message I see in the message box. For example, in one SPAM email, the body of the raw message references Cinemark Media, but the message itself (i.e., the message as I see it in the message box) is about ADT services (Home Alarm Systems).
There is subterfuge at every angle (sender, subject, email body), which makes it impossible for any filtering to work. The only constant info that identifies the email as spam is some part of the Return Path and some part of the X-Originating-Ip and these are in headers, not email body. (For example, the X-Originating-Ip that is associated with the “@msn.com” Return-Path is “X-Originating-Ip: [40.95.”)
When there is a constant – there is a solution in a Thunderbird Filter.
1 – Create a Filter
2 – At the bottom of the default list of labels (Subject, …), is Customize.
3 – Here, insert the Header Label of inspection (X-Originating-Ip)
4 – ‘Match any’; select that newly defined Label / Contains / [40.95
5 – You may need to experiment with various criteria (they OR and AND, depending).
There is subterfuge at every angle (sender, subject, email body), which makes it impossible for any filtering to work. The only constant info that identifies the email as spam is some part of the Return Path and some part of the X-Originating-Ip and these are in headers, not email body. (For example, the X-Originating-Ip that is associated with the “@msn.com” Return-Path is “X-Originating-Ip: [40.95.”)
Two weeks ago I was getting 8-10 fake e-mails a day where some part of the Return Path had the characters “@msn.com”/X-Originating-Ip: had the characters “[40.95.” or the Return Path had the characters “.onmicrosoft.com’/X-Originating-Ip had the characters “[104.47.”. I always sent them to the SPAM folder and sent an email to ‘abuse@yahoo.com’ that had the raw message pasted in the message box. In the last few emails, I suggested a filtering algorithm that would catch these characters in the Return Path and/or X-Originating-Ip.
For the past three days, no fake e-mails have appeared in my inbox. I’d like to think that Yahoo! has gotten wise to the subterfuge and has figured out how to filter them out!
Knock on wood.
The last two weeks I’ve had to add a couple of filters, in Thunderbird, to a couple of my email addresses. These could have been combined into one. I haven’t investigated to see if this could be done in a webmail access.
The problem with services like Outlook, Yahoo, etc. is over the past 2-3 years they’ve frequently denied legitimate incoming mail that *I WANT* to receive.
Since Outlook/Yahoo/et. al. are frquently rejecting these messages (not always, but maybe 90% of the time) at their ESMTP servers, the messages [addressed to me with proper DMARC/DKIM/SPF headers from a clean IP] never hit my Inbox (or even Spam folder). Ironically, spam messages I DON’T want get through (often to Inbox).
Gmail has also had this issue from time to time, but significantly far less frequently than other mail providers. (Maybe 1% rejection?)
If an email provider prevents me from reliably receiving ALL my legitimate email (so that it doesn’t even show up a Spam folder), that provider is useless to me regardless of how much legitimate spam they properly kill/block from my Inbox/Spam folder.
I’m fine with with providers trying to sort real email from spam, but disagree with them censoring/preventing any message from being reviewed by me; if they don’t like a message for some reason, it should always be visible in my Spam folder.
Edit killed my post, F5 and poof, nowhere to be seen. Let me try this again.
On my personal outlook.com account there are a handful of spam messages going to my inbox. I have to manually mark them as spam. No reason for this to be happening on a daily basis. This is a resonably new phenomenon.
Earlier in the year there was an uptick in the amount of spam I was getting so I started to track it. Over a three month period the average came out to be 68 spam messages a day. Most of which were dating messages from the same domain (.yachts, .cloud, .pro, .bio, .ink, you name it, just crazy).
The above image is what it looks like today. I usually report these messages as phishing because that is what they are IMO. I Report them after done checking them at login and again when logging out. Usually 40 or 50 a day total.
A while back I got frustrated by the uptick and started viewing the message source which includes the headers and all the other hieroglyphics. What I discovered was that a bunch of them were AWS (Amazon Web Services) related as told by the sender IP, so I started to forward them to their abuse department hoping they’d get the message that us peons with free accounts are not enjoying their less than solid methodology for keeping their servers clean. As expected I grew tired of this. The results were mixed. It was like they’d start killing them off then it would start back up again.
There was a time that I had a bunch of keyword filters and IP’s blocked, but I got rid of them after realizing they were ineffective due to the spoofing aspect.
What I learned from all this is that spoofing makes any serious efforts useless for people like me. It ebbs and flows as it will. Simply the nature of having my e-mail address being monetized by the people I do business with. I do not like it, but am realistic about it all. Basstages that they are for choosing not to do the right thing by their customers.
/rant
Win 8.1 (home & pro) Group B, Linux Dabbler
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
