Forum Discussion

Metooaswell's avatar
Metooaswell
Tuning in
2 years ago
Solved

Still receiving Spam from addresses on my Blocklist

Getting absolutely plagued with spam lately. Tried adding them all to my blocklist but they are somehow able to bypass it. Tried every combination of filter rule but to zero effect. Can anybody point me in the right direction please.

 

Thank you

  • One possible solution is to:

    • set spam filtering to flag message as spam but leave in inbox
    • create filer rule to discard (permanently delete) messages you do not want to sift through
    • create a filter rule to move any message with "<SPAM>" in subject to Spam folder

     

10 Replies

  • 用心棒's avatar
    用心棒
    Very Insightful Person

    Post screenshots of the:

    • message area being matched against by the filter rule
    • filter rule

    -- 
    I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media. Learn more
    Have I helped? Select Mark as Helpful Answer or 🖒 Kudos to say thanks

    • Metooaswell's avatar
      Metooaswell
      Tuning in

      Hi,

      Sorry, not sure exactly what you mean by the first part. Here is the source of one I have tried to stop. Tried every combination I can think of to stop anything from this source. Obviously I am doing something wrong.

       

      Thank You

       

      Return-Path: <bounce-1906_html-60248146-29661-534007339-0@bounce.best.modernfinancialhabits.com>

      Delivered-To:

      Received: from dcdir7-prd-nl1-vmo.nl1.unified.services ([100.107.82.65])

                      by dcbe8-prd-nl1-vmo.nl1.unified.services with LMTP

                      id lY91AMafNmW+6AwAz3etSA:T4922:P1

                      (envelope-from <bounce-1906_html-60248146-29661-534007339-0@bounce.best.modernfinancialhabits.com>)

                      for <>; Mon, 23 Oct 2023 21:48:36 +0200

      Received: from smtpclienthelo ([100.107.82.65])

                      by dcdir7-prd-nl1-vmo.nl1.unified.services with LMTP

                      id lY91AMafNmW+6AwAz3etSA:T4922

                      (envelope-from <bounce-1906_html-60248146-29661-534007339-0@bounce.best.modernfinancialhabits.com>)

                      for <>; Mon, 23 Oct 2023 21:48:36 +0200

      Authentication-Results: edge.unified.services;

       spf=pass (13.110.237.9;bounce.best.modernfinancialhabits.com);

       dkim=pass header.d=best.modernfinancialhabits.com;

       dmarc=pass header.from=best.modernfinancialhabits.com (p=reject sp=reject dis=pass)

      Precedence: junk

  • 用心棒's avatar
    用心棒
    Very Insightful Person

    You are not doing anything wrong. Email addresses on your blocklist are redirected to your Spam folder; they are not blocked from being delivered to your mailbox.

    For emails arriving in your Inbox consider creating a rule similar to following:

    Any email from miscreant @example.com or example,org will be flagged and moved to Spam folder. The advantage of using a filter rule over Blocklist is flexibility. For example, a common spamming strategy is to randomised the part before the @, i.e. miscreant-0@example.orgmiscreant-1@example.org; the above rule will catch the variation.

    To extend the list append new entries, for instance append |example.net to include it; it is important to separate listed entries with character — resulting in  miscreant @example.com|iexample.org|example.net

    When confident the rule is working as intended consider replacing Actions with Discard action.

     

    • Metooaswell's avatar
      Metooaswell
      Tuning in

      Hi

      Thank you for the reply. I've tested filters in the past, on normal emails, and they have worked. Haven't managed to create one that works on the ones going to spam folder. I've been using conditions similar to the one above. Never used the Regex thing that you have shown. Will try that with a coloured flag to see if it will work for me.

      • 用心棒's avatar
        用心棒
        Very Insightful Person

        Metooaswell wrote:


        … Haven't managed to create one that works on the ones going to spam folder.. …


        Filter Rules only execute against messages delivered directly to your Inbox folder, i.e. they do not against messages delivered to your Spam folder or elsewhere.

  • 用心棒's avatar
    用心棒
    Very Insightful Person

    One possible solution is to:

    • set spam filtering to flag message as spam but leave in inbox
    • create filer rule to discard (permanently delete) messages you do not want to sift through
    • create a filter rule to move any message with "<SPAM>" in subject to Spam folder

     

    • Matthew_ML's avatar
      Matthew_ML
      Icon for Forum Team rankForum Team

      Thank you for posting this advice, if you anyone needs anyone information on this please do let me know. Cheers

    • Metooaswell's avatar
      Metooaswell
      Tuning in

      Thank you. I've done that and now in the process of proving I can flag up the worst offenders before setting the action to delete. They just seem so good at being able to avoid filters.

      • ALF28's avatar
        ALF28
        Super solver

        The IP address of the spam can be looked up on a website abuseipdb, it does indicate possible phishing and spam activity for the IP address mentioned.

        Unsolicited spam emails can be a problem and may contain embedded links to steal data, so wise to filter them out, I use  filters with the action "discard" option so I do not see these repeat emails. I also filter genuine emails to specific folders set up, to separate the good emails away from spam and unknown emails.

        If the sender keeps changing the email address, the the filter can be set condition from contains  @ the actual domain name , thus missing the fist bit which often keeps changing to avoid spam filters, so will filter a particular domain. The the reason that the blacklist often fails because the sender address changes each time, i do not use the blacklist and prefer the setting email filters to block spam, and update the filters each time a new spammer send an email.

        Spam emails often pretend to be from a well known company but the sender address is totally different and not he real company address.

        Some emails are from gmail.com, outlook.com etc and these are designed to bypass spam filters and look like genuine emails, but in the header the received email original source is a different server  used by hackers and then sent via gmail.com with a valid gmail address.

        Knowing the risks of opening spam emails and possible dangerous content, I now try to block all these type of emails with filters and using discard which deletes them out and they are then not received.

        However filters can glitch often and it is possible genuine  emails might be deleted, an alternative is to file the filtered spam emails to a selected folder or to the spam folder.

        I also switch off HTML email settings so the email are read in text only, as most hackers will use HTML and images to get you to click onto a link, also be careful of any extra attachments or images in an email which could be dangerous.

        Some spam emails will link to fake websites set up to mimic real websites and then prompt to enter your passwords, bank details etc.

        Only respond to an email if you know it is genuine and you know the sender and IP address is genuine, and the sender address is genuine.

        The advice given in the previous posts is good, and filters is the way to go, once set up they will block the chosen spam sender using all or part of the sender address, and other filters such as subject, header as well as from can be used.

        I also get lots of spam emails which keep changing, once they have your email address they just keep coming, check your own email address on the have I been pwned website, my VM email address is on the list.

        I have also now switched to other email services such as gmail.com and outlook.com, yahoo.com etc.