Mail spam filters and phishing

Yesterday's UK Sunday Times gave an email address to which sufferers were advised to forward bank phishing emails - it is, presumably, a bank sponsored site which allows them to try and trace and/or stem this ever increasing tide of spam.
Most of these bank phishing emails are caught by me ISP before I even get them, but several do make it into my spam folder or in-tray. If the latter, I mark them as spam manually.
If I were to forward the emails that do reach me (after being manually marked or automatically filtered as spam) to the suggested address, would that affect the "learning" process of my Apple Mail spam filter?
I can't think how it could and I'm keen to help the banks reduce this tiresome avalanche of rubbish (which seems to be increasing) but I don't want to confuse my filtering process.
Thanks.

Thanks, mhunter, most helpful.
The article, for those interested, is about 2/3 the way down this page:
http://www.timesonline.co.uk/article/0,,2097-2382411.html
and is entitled "Website that deals with dodgy emails".
The Bank Safe Online website is at
http://www.banksafeonline.org.uk
but, even though obviously UK orientated, it has some good generic advice which would be valid in other countries.
The email address to which UK victims can forward bank scam/phishing eMails (after they have been identified as spam of course is [email protected]

Similar Messages

Mail spam filters stopped working

About 2 weeks ago, I started getting a lot more spam than before. Looking closer, I saw that messages very similar to the new wave of spam were previously moved to the junk folder, but the new junk stayed in my inbox instead.
The same day I started getting more spam, my wife complained of having the exact same problem. We're using different computers, different OS versions (10.8 vs. 10.9). I could understand if some spammers managed to avoid being flagged, but not all of them on the same day! Is there a server that Apple checks against that went down?

It's possible that Apple's spam filters need updating. I use SpamSieve. You might give it a try. Has a demo.
http://c-command.com/spamsieve/

Mail Spam gone mad

Mail spam filtering is too strong!
I ask here, as I don't mind delving into XML files and doing search and replace with Textwrangler if someone has an idea how to isolate what is spam and what is not. So is there a file I can edit that forces it to only consider certain keywords and e-mail addresses spam?
I want to create an automatic filter that is neither too strong, nor too weak.
Thank you.

Hi Tim.
This kind of problems are caused by some corruption in one or more of the files used by the junk filter. Try this first:
1. Go to Preferences > Junk Mail and disable junk mail filtering.
2. Quit Mail, then open it again.
3. Go to Preferences > Junk Mail, enable junk mail filtering, and configure it however you wish.
4. Reset the junk database (Preferences > Junk Mail > Reset).
Alternatively, instead of (or in addition to) disabling/enabling the junk filter, you may try switching from Automatic to Training mode, quitting Mail, then switching back to Automatic mode.

Mac Mail and Poor Spam Filtering

Hello. Is anyone else having issues with Mail not filtering Spam correctly? I have been battling something since early February. I'm getting hit with Spam every half hour. It's from 20+ different places and there special offers. About 50 spams a day.
This has only been a real problem since 2 months ago.
I've tried going into preferences in Mail and junk mail and then click advance and add the key words I don't want accepted, with no luck. My Advance filter system is so bogged down, I can't even see the end anymore.
Here's my settings in Junk Mail:
1. Enable Junk Mail Filtering = Yes
2. When Junk Mail Arrives = Move to the Junk Mailbox Automatic
3. The Following types of messages are exempt from junk filtering= all 3 on
4. Trust junk mail headers set by you ISP = Yes
Then in Advanced I have all the popular key Spam words in=
Wal Mart, Viagra, Sex, Special Offer, Drugs, Cialus, Target, Sears, Credit, Loans, Hey Baby, Bro, Free Offer, Congratulations, confirmation ETC...
I have the description at the top named "JUNK"
Then under that...
If "ANY" of the following conditions are met:
"Subject" - "Contains" - "the names described above"
But yet still these things keep getting through!!!!!
Please someone help!!!! This is driving me MADDDDD!!!!

Try setting Junk filtering back to Training for a couple of days, then see if it correctly intercepts all junk mail. If it doesn't, mark the escapes as junk and let the system gather knowledge
Trash the junk messages or put them in the Junk folder first (maybe that adds to the learning curve? no idea, but it can't hurt) or erase them via Alt-apple-J

Upgraded to 10.7.5, and my spam filtering doesn't appear to work well in Mail

Sometimes it will put the spam in the Spam folder, and sometimes it won't. Is there any way to force it to always put spam in the spam folder automatically?
Is 10.8.5 or higher any better at spam filtering than 10.7.5?
Yes, I have 10.9.2 on one machine, but have not had a chance to upgrade all the machines.

It is desperately critical to delete all existing PSE preferences when you upgrade OS X. How did you do the upgrade? Did you just install it over your previous system, or did you do an erase install and then migrate back your programs and data?

Spam filtering solution for iPhone and a question.

I've read a lot of posts about spam filtering for the iPhone and have yet another solution and a question. I use SpamSieve and I am not affiliated with them in any way. The nice thing about SpamSieve is that if it is the first rule in your Mail.app rule set any mail that follows has already been filtered. All you need to do then is create another rule that redirects email to what ever mail account you choose. Since my ISP allows multiple accounts, I will simply create an iPhone@myISP account.
Now the question. Is it possible to write an applescript that will turn the redirect rule on or off so that I don't have to dig into the rules section of Mail to get this done?
Thanks

Is it possible to write an applescript that will turn the redirect rule on or off so that I don't have to dig into the rules section of Mail to get this done?
not at present time

Problems with spam filtering (specific and general)

I I am getting messages coming through that are OBVIOUS spam (phishing attempts from [email protected] and
[email protected] saying the at the account was frozen). The address is wrong in the bottom, the domains are obviously wrong, and we've seen these repeatedly. And yet they keep coming through. I was actually told that because it was marked as
NSPM by the filter it should have been delivered, but I'm appalled that it isn't getting marked as spam at all.
I was given a few options for creating manual rules (well, I can do that all day, but then why have a service?) and then reset my SPF and other content delivery conditions for future monitoring. But really what I want is a definite answer as to why something
that any person can look at and recognize is not getting picked up. It's pretty embarrassing to have moved to Office 365 and had spam protection get notably worse than it was under Postini. And then to have support tell me that it got delivered because
it was marked as NSPM ("I know it got marked that, but how in the world did that happen?"). We've been getting these off and on for months.
My more general complaint is how spam whitelists and blacklists are maintained. They are one step up from having to manually edit text files (which would actually be easier to do since I could search those easily). Again- this can't be the best Microsoft
has to offer, and given the global issue that spam has become I can't believe they aren't making this better more quickly.
Received: from BY2PR01MB107.prod.exchangelabs.com (10.242.43.19) by
CO1PR01MB109.prod.exchangelabs.com (10.242.164.146) with Microsoft SMTP
Server (TLS) id 15.0.934.12 via Mailbox Transport; Sun, 4 May 2014 22:42:34
+0000
Received: from BY2PR01CA002.prod.exchangelabs.com (10.255.247.32) by
BY2PR01MB107.prod.exchangelabs.com (10.242.43.19) with Microsoft SMTP Server
(TLS) id 15.0.934.12; Sun, 4 May 2014 22:42:30 +0000
Received: from BL2FFO11FD018.protection.gbl (2a01:111:f400:7c09::198) by
BY2PR01CA002.outlook.office365.com (2a01:111:e400:2c16::32) with Microsoft
SMTP Server (TLS) id 15.0.934.12 via Frontend Transport; Sun, 4 May 2014
22:42:29 +0000
Received: from ios7supp0rt.com (176.58.88.173) by
BL2FFO11FD018.mail.protection.outlook.com (10.173.161.36) with Microsoft SMTP
Server id 15.0.929.8 via Frontend Transport; Sun, 4 May 2014 22:42:28 +0000
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=ios7supp0rt.com;
h=To:Subject:Date:From:Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding; [email protected];
bh=txKF8WnwFM/0C4YId7Ij73YddMc=;
b=ZNL5MeSkubrD8iqoHfwWvIkob+rT9t9OOB4tcYymj2oN6S6u9DvavgjAgzhD06ENEUtOJy+X/AG3
Ttdm6MVp+Qw85SqQIdu9aDO0yvs4SE2jwtLdWq0Rv6ynhqulRFsUKdfrlf+rIUrAgH9ovGmtjBdg
e68KX3Prx0j+6Yqe9H8=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=default; d=ios7supp0rt.com;
b=lUMpjXXTRnieJEsqhu5oDBmNOyNKRNAZ4jzlmeOK51AaGmbtZy7WKaEp2i0/Wmwrzn41EeDDqba3
5Cv3CYXOGg77SvVATHTL4IGlr8taesMd66PkcMMnhAqTa9XqZPo66Aq2nWotZILvjKFzs8kEtmfJ
QstWULOZADNps03bb1c=;
To: [email protected]
Subject: Apple/iCloud Account Frozen
Return-Path: [email protected]
Date: Sun, 4 May 2014 22:42:25 +0000
From: "Apple Europe" <[email protected]>
Reply-To: [email protected]
MIME-Version: 1.0
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Message-ID: <[email protected]>
X-EOPAttributedMessage: 0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-Forefront-Antispam-Report: CIP:176.58.88.173;CTRY:GB;IPV:NLI;EFV:NLI;SFV:NSPM;SFS:(428001)(199002)(189002)(25786004)(31696002)(23846002)(40036003)(74316001)(20776003)(50466002)(85852003)(46102001)(80022001)(99396002)(19617315010)(18206015023)(4396001)(19300405004)(15975445006)(21056001)(83072002)(50986999)(64706001)(77982001)(80976001)(92726001)(79362001)(76482001)(946001)(79102001)(956001)(43066001)(575854001)(19580395003)(81342001)(44976005)(71816001)(70736001)(101416001)(74502001)(83322001)(53806999)(87836001)(19580405001)(33646001)(15202345003)(74662001)(81542001)(54356999)(23676002)(551544002)(307094003)(467094002)(8886004)(575514002)(18016003)(435084004);DIR:INB;SFP:;SCL:1;SRVR:BY2PR01MB107;H:ios7supp0rt.com;FPR:;MLV:nov;PTR:orders.ios7supp0rt.com;A:1;MX:1;LANG:en;
X-MS-Exchange-Organization-Network-Message-Id: 517b8afa-807f-489c-e9f2-08d136014419
X-MS-Exchange-Organization-AVStamp-Service: 1.0
Received-SPF: None (: ios7supp0rt.com does not designate permitted sender
hosts)
Authentication-Results: spf=none (sender IP is 176.58.88.173)
[email protected];
X-MS-Exchange-Organization-SCL: 1
X-MS-Exchange-Organization-AuthSource: BL2FFO11FD018.protection.gbl
X-MS-Exchange-Organization-AuthAs: Anonymous

Hi,
Do you mean your client is list in the spam list by your Exchange Server?
If so, I think the most efficient way is to contact the Exchange Administrator to check the spam list.
Thanks,
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Simon Wu
TechNet Community Support

Spam filters in DMZ and Multiple Gateways

Hello All,
I am trying to set up my mail environment for redundancy including dual ISP's.
Currently using Exchange 2007 and moving to 2013 DAGS.
I have Barracuda spam filters in my 2 DMZ's
I am OK with Multiple MX Records.
I hope to not have any single point of failure.
Where I am having a problem is the Gateways on the exchange servers.
Can the servers be set up to use whatever gateway the smtp request came in from?

Hello Ed thx again.
I am familiar with the DNS MX records controlling the inbound route.
The problem i'm having is I have two ISP's the one where the gateway 192.168.10.1 which is set up on my exchange server works fine. The other ISP gateway 192.168.10.5 sends packets in but does not know how to go back out the 192.168.10.5 gateway.
Get-ReceiveConnector
PS] C:\Documents and Settings\Administrator.CCMA\Desktop>Get-ReceiveConnector
WARNING: column "Enabled" does not fit into the display and was removed.
Identity Bindings
CCMA-MSX-01\Client CCMA-MSX-01 {0000:0000:0000:0000:0000:0000:0.0.0.0:587, ...
CCMA-MSX-01\Internet {0.0.0.0:25}
CCMA-MSX-01\Internal SMTP Hosts {0.0.0.0:25}
CCMA-MSX-04\Default CCMA-MSX-04 {0000:0000:0000:0000:0000:0000:0.0.0.0:25, 0...
CCMA-MSX-04\Client CCMA-MSX-04 {0000:0000:0000:0000:0000:0000:0.0.0.0:587, ...

Can I stop Apple's spam filters restricting genuine mail messages

I suspect that a genuine e-mail has been wrongly treated as spam by Apple's internal spam filters? The item in question is an e-newsletter from a UK preserved railway company of which I am a member. The sender has checked the log files and verified that the item has been successfully sent to the correct address, but it has not arrived in my Mail account, either in the in box or the junk folder. I suspect that for some reason the Apple automatic spam filter is preventing the newsletter from reaching me. How do find out if that is the case and then tell Apple that their filter is treating genuine mail as spam, without having to pay for contact with Apple support?

It's not there either. I suspect that Apple are employing some sort of spam mail filters which come into effect before the mail reaches either my iCloud account or the mail account. In the past I have reported some persistent spam to Apple by forwarding it to [email protected] I then stopped receiving that spam, so they must be filtering it at a higher level. The e-newsletter is sent out by the railway as a bulk e-mail, so I suspect that its falling foul of Apple's filters. How can I get that message to Apple. They are causing the problem, so I don't see why I should have to pay a support fee for the privilege of telling them!

Bypass spam filters for certain mail addresses

I am looking for a way to bypass virus checks on mail from a certain mail user (actually system mail sent from a process that we have, so we can trust it).
I have been playing with the @bypassspam_checksacl = qw( [email protected] ); entry in /etc/amavisd.conf but this doesn't seem to bypass as I would expect.
Does anyone know if this file might be over riden else where or perhaps if I can bypass in another way?
Cheers

Greetings
there is probably more than one way to skin a cat.
here is a postfix only method however i'm not sure if it will pass all before amavid. so see the snippit from the amavisd.conf below.
main.cf
smtpd_recipient_restrictions = hash:/etc/postfix/spamlovers, .....
create a file call spamlovers
[email protected] OK
biggroup.net OK
that will prevent all subsequent anti-spam checks from being applied to
the listed recipient domains/addresses. in short - they want spam, let
them eat spam.
((snip)) amavisd.conf
# %bypass_virus_checks, @bypass_virus_checks_acl and $bypass_virus_checks_re
# lookup tables:
# (this is mainly a time-saving option, unlike virus_lovers* !)
# Similar in concept to %virus_lovers, a hash %bypass_virus_checks,
# access list @bypass_virus_checks_acl and regexp list
$bypass_virus_checks_re
# are used to skip entirely the decoding, unpacking and virus checking,
# but only if ALL recipients match the lookup.
# %bypass_virus_checks/@bypass_virus_checks_acl/$bypass_virus_checks_re
# do NOT GUARANTEE the message will NOT be checked for viruses - this may
# still happen when there is more than one recipient for a message, and
# not all of them match these lookup tables. To guarantee virus delivery,
# a recipient must also match %virus_lovers/@virus_lovers_acl lookups
# (but see milter limitations above),
# NOTE: it would not be clever to base virus checks on SENDER address,
# since there are no guarantees that it is genuine. Many viruses
# and spam messages fake sender address. To achieve selective filtering
# based on the source of the mail (e.g. IP address, MTA port number, ...),
# use mechanisms provided by MTA if available.
# Similar to lookup tables controlling virus checking,
# there exist spam scanning and banned names/types control counterparts:
# %spam_lovers, @spam_lovers_acl
# %banned_files_lovers, @banned_files_lovers_acl
# and:
# %bypass_spam_checks/@bypass_spam_checks_acl/$bypass_spam_checks_re
# (but no bypass_banned_checks, as $bypass_decode_parts controls it
already)
# See README.lookups for detailsabout the syntax.
# The following example disables spam checking altogether,
# since it matches any recipient e-mail address (any address
# is a subdomain of the top-level root DNS domain):
# @bypass_spam_checks_acl = qw( . );
# See README.lookups for further detail, and examples below.
# $virus_lovers{lc("postmaster\@$mydomain")} = 1;
# $virus_lovers{lc('[email protected]')} = 1;
# $virus_lovers{lc('[email protected]')} = 1;
# $virus_lovers{lc('some.user@')} = 1; # this recipient, regardless of
domain
# $virus_lovers{lc('[email protected]')} = 0; # never, even if domain matches
# $virus_lovers{lc('example.com')} = 1; # this domain, but not its
subdomains
# $virus_lovers{lc('.example.com')}= 1; # this domain, including its
subdomains
#or:
# @virus_lovers_acl = qw( [email protected] !lab.xxx.com .xxx.com yyy.org );
# $bypass_virus_checks{lc('[email protected]')} = 1;
# @bypass_virus_checks_acl = qw( some.ddd !butnot.example.com
.example.com );
# @virus_lovers_acl = qw( [email protected] );
# $virus_lovers_re = new_RE( qr'(helpdesk|postmaster)@example\.com$'i );
# $spam_lovers{lc("postmaster\@$mydomain")} = 1;
# $spam_lovers{lc('[email protected]')} = 1;
# $spam_lovers{lc('[email protected]')} = 1;
# @spam_lovers_acl = qw( !.example.com );
# $spam_lovers_re = new_RE( qr'^user@example\.com$'i );
# don't run spam check for these RECIPIENT domains:
# @bypass_spam_checks_acl = qw( d1.com .d2.com a.d3.com );
# or the other way around (bypass check for all BUT these):
# @bypass_spam_checks_acl = qw( !d1.com !.d2.com !a.d3.com . );
# a practical application: don't check outgoing mail for spam:
# @bypass_spam_checks_acl = ( "!.$mydomain", "." );
# (a downside of which is that such mail will not count as ham in SA
bayes db)
I'm sure anyone of these methods will allow the lovers of the blessed spam to fill their hearts content. Hope you have good hard drives
--j

How do I create Outgoing Mail Policie,Outgoing content filters and individual content filters?

IronPort C160.
async OS 6.5.3
Server 1 and server 2 are communicating through ironport.( and also scanning)
Server 1 we have setup domain abc.lk and yy.abc.lk in same server, this reside on DMZ. same segment ironport is connected,
Server 2: we have setup separate server int.abc.lk which is resided on internal lan.
Server 1 and server 2 should have to communicate internally, but server2 should not communicate to outside the world (eg. [email protected])
How do I create "Outgoing Mail Policies, Outgoing content filters and the individual content filters?
Note: Now server 1 and server2 are communicating internal and also communicating external ([email protected]), I need server 2 not to communicate external ([email protected]) it should be block and also do not block server 2 communicating to server1
I have attached diagram also.
Thanks.
sumathi.

/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin:0cm;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:10.0pt;
font-family:"Times New Roman";
mso-ansi-language:#0400;
mso-fareast-language:#0400;
mso-bidi-language:#0400;}
Hello Sumathi,
(Thanks for adding a diagram, that helps understanding your situation)
I think the simplest solution is to create a filter that allows server 2 (based on it's IP) to communicate with the internal domains, and drop the messages when they are targeted to any other domain
so:
filter source IP = servers
condition: message to: is NOT abc.lk or yy.abc.lk
action: drop message
hope this helps!
Steven

E-mail filtering in iCloud mail is amateurish and nearly useless. No booleans. No nested rules. Can anyone suggest how I can get these things in iCloud or Mac Mail?

I need some real sophisticated filtering and I can't figure out how to do this with Mail on the iPad. No booleans, (and, not, etc.) no redirects. This is nearly useless in a real world setting

I'm afraid that whether or not there are any plans about this, Apple don't tell us. If they do decide to increase the facilities we will only know when they implement it. (And by the Terms of Us of these Discussions we are not allowed to speculate.)

HT1277 Can you use Apple Mail program Rules and Gmail filters together?

Can you use Apple Mail program Rules and Gmail filters together? Does the gmail filtering override the Mail Rules?

Mail > Window > Previous Recipients

Mail doesn't keep junk mail filtering and rules

I noticed that all over sudden whenever I close mail the rules and junk mail setting in mails prefs are not kept anymore so that
I have to enable each rule and junk mail filtering whenever I open mail again.
Used to work fine.
Any idea / remedy ?

Open Disk Utility and Repair disk permissions on the First Aid tab.
Then, Restart and boot into Recovery Mode by holding down cmd-r on restart until you see a gray screen. When the Mac boots, you will be presented with some options. Choose Disk Utility and select your Hard drive volume (Macintosh HD is the default name). Then, on the First Aid tab, click Repair Disk (not permissions).
If that doesn't help, you could try installing the 10.8.2 combo updater from the Apple Downloads site:
http://support.apple.com/kb/DL1581

Mavericks Mail; difference in delete folder and trash folder? I don't know which folder to use clearing out old messages, spam, junk and other detrious I might want to recover in the future and which folder for highly sensitive or personal informa

I don't know which folder to use clearing out old messages, spam, junk and other detrious I might want to recover in the future and which folder for highly sensitive or personal in formation I want to keep confidential.

More to my question regarding standard Mail folders, how do Trash and Delete differ in function?

Mail spam filters and phishing

Similar Messages

Maybe you are looking for