Gmail spam is out of control | Hacker News Reader

Gmail spam is out of control

88 pointsgcatalfamo94 comments

Seriously, what is going on?

I am receiving tens of emails daily that don't get filtered by Gmail which are clearly junk.

It has been going for at least a couple of weeks.

I'm more confused by the youtube comments. They have thousands of employees, couldn't they get an intern to write a bot that bans anyone who posts the same link in a dozen commment sections?

Exactly. Or literally ban any comment saying you won something. The fraud spam is totally out of control.

I used to be 100% sure that Youtube was the most dogfooded[1] website on earth. Now I have my doubts.

I mean, there's no way the developers haven't seem the deluge of spam.

The "can you recommend me a service to download movies for free" one was a thing for about two years. Now it's "you won join our Telegram", literally everywhere.

[1] For those who don't know: https://en.wikipedia.org/wiki/Eating_your_own_dog_food

I guess the devs are working on higher priority work and don't have the autonomy to choose what to work on

Simple explicit filters like that always snag up tons of random innocent users too. The important and hard problem of content moderation is you need to understand the context of the comment/post and that includes cultural context which means it's an even more difficult problem than simply comprehending the language which is a near hard AI problem on it's own.

Have you seen those, though?

The "sender" name is always "Text me on telegram (hand-emoji) @channel_name" and the text of the body is always the same. This has been going on for months now, in some channels.

This is something that pg's 2002 Bayesian filter would very easily catch. http://www.paulgraham.com/spam.html

I have yeah. Extremely specific spam like that is doable but the filters need to be very specific to avoid false positives and then you're just playing whackamole with minor variations to the spelling or wording.

Irony (or not?) ... I [legit] won something by commenting on a YouTube video a couple years ago

People can post links? I have never been able to post a link in a YouTube comment. 100% blackholed when there's a link in it.

The ones I've seen post Telegram handles and ask people to send a message.

They probably rotate accounts, but still, those "I need a financial advisor / SamSpam worked for me, telegram->" comment clusters feel like they've been the dominant form of spam for years but shouldn't have taken years to target with a model.

It's even worse on eBay, where there is a spammer who has used the same set of fake pictures and listings for at least 5 years now. I call them the "Comic Sans Scammer" for reasons you can probably guess and they still drop junk into my feeds like clockwork every weekend. Ugh.

I'm sure I don't see all the fronts of these battles, but with the size of the companies in question it feels like I should be seeing more back-and-forth in the fronts that are visible to me.

How do they have so many accounts? Phone numbers cost money

Not super positive, but I think there is/was a concern over "moderation"

If they are a "platform" that only responds to "complaints", there's more lax rules / risks in court battles.

If they proactively moderate too much, they would expose more legal risks.. "why are you removing links to (my product) but not (similar product)?"

When it's proactive vs clearly illegal stuff, they can point to the fact they are following the law, which requires them to take action proactively even as a "platform".

Of course, you could argue lots of ways why they should do it, but what is Google's incentive? People are not flocking away from Gmail or YouTube. Of course, more and more people complaining could lead to people doing so.

This is not at all true. Section 230 provides Google with safe harbour to moderate as the see fit with no risk of legal action.

Strange, I have iCloud instead of Gmail, but I'm also receiving a humongous amount of spam recently too, and while (so far) it goes to the "Junk", it's still a bother when I check daily for missed messages.

Before I would get about 3 or 4 "Junk" messages per week, tops. Now it's more like 20-30 per day.

I wonder if spammers figured out some new method of not being blocked.

EDIT: Someone else is getting the same emails I am: https://news.ycombinator.com/item?id=34898655

Maybe that new method is ChatGPT-related.

Just one data point, but Gmail spam filter has been extremely good for me. I probably get like one spam make it's way into my inbox a month or so, and that's because it's a spam email sent from a new Gmail account to a very few other Gmail accounts. I always report it.

Genuinely useful emails ending up in spam happens rarely too.

When compared to any other email services I use, including my organization email, Gmail is way better at spam filtering - I imagine they're also doing it at scale since Gmail might be the most popular email service to attack for spammers.

It’s the threaded conversations that sales people have with themselves, marked as important by gmail, that drives me mad.

“Hi Mark, Just wanted to close the loop today and see if it made sense for us to connect.”

“Hi Mark, I hope you are having a successful week. Did you manage to check on below email?”

“Checking in, Mark - do you have 15 minutes next week to discuss your goals?”

All unsolicited spam and all marked important by gmail. I just ignore most email these days. Seriously. People who know me know how to find me on closed loop systems like WhatsApp, Slack, etc. Gmail sucks.

Hi Mark, you sound a bit frustrated about it, but it is what it is. Let's touch base and circle back to our discussion when you're ready to take our goals to the next level.

I kill you! ;-)

The crazy thing is that this is a function of CMS applications.

And some of those are infuriating. I had about 3 or 4 people so far spam me, and after 5 or 6 unanswered emails the message is "I noticed you're not answering me. I'm really sorry if I did something that offends you".

Someone even showed me a closed beta of a service like this that uses OpenAI. I'm expecting hilarious results.

Yeah that last one is hilarious. “Oh jeez I’m so sorry I hurt your feelings anonymous spammer friend. Let’s be bros and you can sell me some stuff.”

It is insane that our society considers this sort of thing as "legitimate" for a business to engage in.

Tell me about it!

I think the fact this is just another "option" in an application normalizes it for users of those apps. Companies like Hubspot are not only selling software, they're also doing the marketing training for thousands of companies, so it's in their interest to say that this is entirely normal.

It's similar to how it became normal for company blogs to be full of SEO spam written by underpaid content-farm workers, or even AI now. I mean, is that the kind of thing a company wanted to be associated with its image? I guess it is now... :(

I put my job title on LinkedIn as something ridiculous so I occasionally get recruiter-spam with such phrases as, "What do you like most about being $COMPANY's Senior Rainbow Starfish?" Now I can be entertained by their clearly insane ramblings.

Nowhere near as problematic as the titled problem which has recently included emails (sometimes outgoing!) in known good ongoing threads being sent to Spam!

I have noticed a huge uptick recently in emails (I use Gmail) from legitimate companies telling me the likes of: I registered but never logged in, I still have something in my cart or "thanks for your feedback - we'll be in touch".

I imagine it's spammers trying to screw up the spam filters but since most of them get through (makes sense), having to deal with the 20 or so a day is irritating.

It's such a shame, when they bought Postini[0], it was the pre-eminent email security product on the market, and was largely part of Gmail's anti-spam reputation. Since they discontinued it as a commercial concern, it seams to have languished.

[0]https://en.wikipedia.org/wiki/Postini

Edit: The controls in workspace are still good, but in all reality some kind of SEG is advisable.

You'd think that these billion dollar companies could defeat spam. It's sad really. Facebook is loaded with it in the comments. I keep getting those random emails you speak about, whether its related to pharma or trying to convince me I have an invoice for $382 with McAfee or Norton virus scanner. Not hard to note that once it's marked as "spam", it should be able to grab those keywords and pattern of text and block it. It doesn't seem like by allowing it there's much in it for them.

Now that you mention it, I've been getting bizzarre "Award/promotion" emails daily. All easily identifiable. Usually no proper formatted text and an attempt to load images.

Always from someone with "ace" in the email. It goes straight to report as spam but daily for the last few weeks they've been seeping in. It's annoying given how blatantly obvious spam they are.

Those are the ones I just mentioned I'm getting too! [1]

They do go to the Junk folder, but I've never seen such a massive volume of messages.

[1] https://news.ycombinator.com/item?id=34898400

I'm confused.

I have 7 Gmail accnts across my various personas and corps and spam has never been an issue.

Maybe actually take 10 seconds to mark things as spam and move on.

For the last 1+ years I've been getting spam. I've marked it loads of times but it doesn't work.

I run my own mail setup with Postfix, Dovecot, and SpamAssassin. I've had great results with zero false positives and over 99% successful spam filtering after a little bit of tweaking and training the bayesian filter.

I used to do the same. One thing I learned- you can fight spam (and quite successfully!). But you cannot fight awfully formatted marketing emails that you or your clients require. Lots of times, these scored multiple times more than actual spam :(

Thankfully I don't need to worry about that for my use case, but you could probably solve a lot of this by whitelisting mailchimp, constant contact, and a few other providers that probably cover a large percentage of "legit" marketing mail.

How do you tweak/train? I only have roughly 50% success using only sa-learn (however zero false positives).

It's completely bizarre to me that I can open and then mark as spam e-mails from the same sender half a dozen times without Gmail blocking mail from that address. Why even have the button?

Because senders can be forged, probably. It’s not uncommon (or at least it used to be) to receive spam seemingly from addresses you know but not actually sent by them.

You can always view the full message headers and report the spammer to the abuse department at the ISP that delivered the spam to your mail provider. This was common practice in the early days of email, there were services that would automate the whole thing for you (spamcop is still around!) and the old ways still work.

When gmail was good at detecting spam it really reduced the need for that kind of thing, but it was just sweeping the problem under the rug, out of sight, not actually dealing with the bots sending spam. If google doesn't care to keep up their filtering efforts, maybe folks will have to revert to cleaning up compromised machines and open proxies to keep the spam out.

One of my accounts is getting large amounts of obvious spam since at least 2021. I'm not using this email anywhere anymore so it's all the more puzzling for me.

You don’t need to continue using an email address to continue receiving spam on it. I have email addresses I haven’t used over a decade that still receive spam. Nothing puzzling about it, the address databases used by spammers keep old addresses, in particular if those don’t bounce.

Yes, that's my experience too. Gmail spam filters worked perfectly for 10 years or more and then suddenly started letting through 1-2 obvious spam emails per day in the last couple of years. It's always seemed strange to me -- an obvious regression that's trivial for them to detect.

Definitely agree. It's been more like two years for me now. I get spam in my inbox, and similar emails from the same senders in my spam box too. The spam filter is definitely working, but it's leaking badly.

In my inbox now, obvious spam, subject "Verification", sender "You're Approved" with gibberish in the body. Auto insurance spam, also gibberish in body. A new one, "Emergencymail.org" and that's just in the last hour.

Worse: Gmail is labeling as spam emails that aren't. I send out email newsletters for my HOA using MailChimp and about 10% of the recipients (all Gmail users) never see the emails in their inbox. I've started texting them when there's a new email; half of them find it in their spam folder, half can't find it at all (and I see confirmation from the MailChimp side that the email was sent and did not result in an NDR).

Maybe it helps that I pay for Google Workspace, but my pretty well known emails do not really receive that much "spam". However, it depends what you consider spam and I have a pretty strict definition to be automated junk/phishing messages I never consented to receiving. I also include non-"junk" mailing list messages (some semblance of not being a scam or coming from a semi-legit org) that I either never consented to.

I imagine for a lot of people they, unknowingly?, subscribed to a lot of things they don't end up caring about and never try to unsubscribe. In Gmail they can even automate this for you to some extent. And I am pretty sure they track that information and if a mailing list isn't respecting those unsubscribes their email is going to start being dropped entirely.

Consider the possibility they someone is subscribing you to nonsense? I think Gmail's filters work pretty well. In fact I am very surprised how well they work because for a while I was getting a ton of spam in the inbox and losing important messages (~max 3 years ago). Now I can't remember the last time it happened.

> I imagine for a lot of people they, unknowingly?, subscribed to a lot of things they don't end up caring about

Driven largely by being forced to give an email address for almost any online interaction/transaction, and then being automatically placed on a subscription list with no notice or opportunity to opt out. I thought that had become illegal, but either I'm wrong or there's no enforcement. (I suppose the fact that I don't know how to report these offenders indicates why enforcement might be low.)

You get what you pay for. Come join us over at Fastmail. The fee is low and the spam filters are superb.

All the best, a happy user of many years.

In recent weeks I have been receiving about a dozen spam messages every day from different .shop domains to my Gmail address. I've never seen this before.

At my business address on Office 365, we've been inundated with spam from different Gmail addresses but we have created more sophisticated rules that have helped handle the volume except for the Unicode-obfuscated stuff and password-reset phishing.

With respect, I wouldn’t say it’s out of control. Take a look at your spam folder. Obviously, I’d like to see it an improvement but I’m still amazed at how well they do.

I highly recommend uses unique email addresses for anything you sign up for. I do this on Fastmail and I can disable the alias/have it bounce incoming emails whenever I want. I vastly prefer this over filtering to garbage because I feel like it annoys the sysadmin that's sending the spam. I actually had my brokerage company send me a mean letter saying that I was required to give them a working email address or they'd close my account - hah.

i have been getting a lot of gmail spam recently also, and they all come from .gmail accounts too. its turned into a bunch of things from like

a.b.person.s.s.s@gmail.com,

person.a.b.s.s.s.s.s@gmail.com,

...

I suspect they're going to bring out a "premium" spam filter at some point, as a way of monetizing individual Gmail accounts.

If that ever happens, I'm promise HN I'll write a email client like original gmail with the original promises. I'm a paying customer for lots of Google products, but damn them if they end up making the experience worse in order to eventually add a paid feature.

We already have great email clients, the problem isn't with MUAs it's server side filtering we want and anyone starting their own email service now is going to have to fight for their legitimate mail to be delivered since some people effectively blacklist anything that doesn't come from a handful of major email providers.

I don't suggest trying outlook if you're troubled by spam. Gmail seems to do a lotter better in prevention in my case.

Better than 365, which does exactly the same thing, but also sends tons of legitimate emails to spam with no way to prevent it.

Just another data point. I use gmail as my primary personal mail and I'm not seeing any uptick in spam making it to my inbox. The normal rate is very low, 1 every 2-3 months. I have a much higher incidence of random people using my email to sign up for things, and wrong address (i.e. the sender just typed my email by accident).

Hmm, I've always been rather impressed by Gmail's spam controls. It's really rare that a spam email gets through - maybe a couple of times a year at most. On the flip side, legitimate mails occasionally go into the Spam folder, maybe a couple a month.

Yes! I've noticed it's 10x worse for my professional email address than my personal one; nearly all of the spam that gets through Gmail's filters is (horribly targeted) B2B marketing. Is that what others are seeing too?

Most of mine lately are "people" sharing documents with me in Google drive

+1 i get so many obvious spam emails delivered to my gmail account yet they block / filter my emails any of the 3+ times i have tried to host my own email. The email monopoly/ centralization it out of control.

I can concur with this.

This week specifically I have noticed tons of scammy spams getting into my main inbox.

Up until this past weekend, almost all of them got caught in the spam folder, but there's an epidemic in my inbox this week.

They seem to be monetising the service more now (my free tier own-domain email for instance). Maybe this is the new strategy to drive buyers. I have not had an increase in spam on my paid-for service.

Ya mine has been very bad too for Gmail and outlook, wtf is going on?

Seems like this has been going on for over a month:

https://news.ycombinator.com/item?id=34411009

I'm more concerned with the newsletter I signed up for going into it's spam folder, and me not knowing how to force it to always go to the main folder

I'm getting them too. I know these emails are not going through paid accts (workspace). Are they trying to integrate bard with gmail?

They are preparing for a premium service where AI will "resolve the spam problem in your inbox". Mark my words.

They had that, in 2004. Emails that were obvious spam back then, and were correctly blocked, are now coming through. Something must have changed, and I doubt that the spammers got so much wiser because the spam is obvious.

Haha, nope, it never worked. Such issue started from the very first day. I was one of beta testers that got invitation from Google directly. I was super surprised that new created email address started to receive spams almost immediately. So I requested a blocking list to be implemented and was told something like "No, you don't need that, our spam filters are good enough...".

So be it.

Substack spam is annoying. I do not need a dozen updates/week when I am subscribed to just 3 blogs.

They seem to offer RSS feeds, maybe you could use them instead?

Since 2006, my Gmail has hardly ever contained spam. Hotmail, however, receives over 600 each month.

I'd love to see a screenshot of an inbox with these messages if any one is so inclined.

This is generally what my primary Gmail inbox looks like on a daily basis. It beggars belief -- the inability to identify cold emails from recruiters is bad enough, but half of those are just... junk with random characters (I guess to test if my email is active?) - https://i.imgur.com/I8LG3wh.png

Does anyone know how it's quite that bad?

It's so bad that the spammers don't even bother to spam via GCal emails.

Google recently updated the Google calendar preferences where you can select if you want to see events from people outside your contacts in your calendar or not effectively solving the calendar spam issue.

I have had almost no spam with Google Workspaces (formerly GSUITE).

i dont use my gmail for yeads but just looked. my inbox has tons of garbage emails of various casing, 100s of obvious spam emails. very few went into spam

been going on for a few months for me, some where obviously spottable, Tons of word.s.like.this in the subject and also random numbers a la 12895830

it's not just gmail

I've been seeing a huge increase in Outlook.com, O365 (or is it M365 now?), and iCloud spam, too

report and move on is about all I can suggest

Personally not receiving any spam, whatsoever.

For me, it's spam FROM gmail.

why would somebody use gmail if there is fastmail.com?

I have had legit emails end up in the spam folder since 2011 or so

gmail coders are dumb

Or maybe it's a hard problem?

Gmail sometimes lets through particularly obvious spam, of the kind that heuristics could definitely catch.

It's almost certainly a lack of will, or an insistence on filtering in a particular way. (Eg. considering themselves above heuristics, insisting a fancy AI must catch it)

To give you an example, one piece of spam that hit my Gmail inbox recently came from an address like: 6UGH578FDJ3@abusejan.beauty

On that email, Gmail shows a warning that the sender's domain didn't encrypt the message. The email is in a mixture of German & English. Most of the email is one big image. The unsubscribe link text is: "To be removed from our mailing list please?Click Here? Unsub-HERE"

> Gmail sometimes lets through particularly obvious spam, of the kind that heuristics could definitely catch.

I administer email for the company I work for. You might be surprised how often perfectly legitimate email looks a hell of a lot like spam.

  - individuals who can't spell and write stream of consciousness near-nonsense
  - companies forging the from: header with the target's own address
  - companies sending mass mail with red flag keywords from rando cloud instances
  - small companies using personal gmail accounts and including any kind of money-related term

...to name a few. Spam is a hard problem and marketers and scammers (same diff) are working hard every day to defeat any system you put in place to stop their bullshit.

I once ignored an email that was pretty obviously spam. It claimed to be from my bank, but had email links to another domain and not my bank, and a header looked like it was scanned from a piece of paper, badly, and was the only logo on the page.

Turned out to be completely legit. They really were trying to contact me to tell me they didn't get my proof of insurance.

When I told them my concerns, they didn't understand.

The thing is, as a user, I'm going to be very understanding if something that looks a lot like spam coming from an unrecognized address ends up in spam.

Most users are. Some very much are not. Guess which ones tend toward the top of the org chart?

me too! I would not have got my current job if I didn't randomly check my spam folder. Tbf it was a cold email from a recruiter

Never had that problem my man. Stop entering your email in shitty websites

Also check haveibeenpwned.com

Reply on news.ycombinator.com