Spam domains that plague my email • Hacker News Board

Re: Spam domains that plague my email

#11

Post by r1ch » Mon, Jul 18, 2022, 6:48 AM UTC

nubela wrote: post #8

These are usually domains that belong to a disposable email service, be it public or private. I maintain a 100% free API [1] to check if an email belongs to a disposable email service. We dogfood the same API endpoint to prevent users who abuse disposable emails to create fake accounts for free trial credits. We use the domains found at https://www.stopforumspam.com/downloads amongst other sources of data. Works pret…

Why does your API want the full email address? That becomes a privacy liability as surely the domain alone is enough.

Re: Spam domains that plague my email

#12

Post by r1ch » Mon, Jul 18, 2022, 6:50 AM UTC

NikhilVerma wrote: post #2

I am seeing Google constantly fail to catch obvious spam emails. At this point I suspect there is some institutional error on their part, where bad actors inside the org are allowing certain domains to simply not be spam filtered.

I've been seeing some cleverly encoded emails with multiple MIME parts that bypass the spam filter. Gmail decodes one representation but displays another. Luckily the content they show to the spam filter is mostly static so a regular filter can catch it.

Re: Spam domains that plague my email

#13

Post by rdpintqogeogsaa » Mon, Jul 18, 2022, 6:51 AM UTC

SoftTalker wrote: post #5

fuckcensorship wrote: post #3

Earlier quoted context omitted.

“Never attribute to malice that which is adequately explained by stupidity.”

Sorry, a "your account has been locked, please reset your password" email to an .edu address from a gmail.com address is 100% always fraudulent, a 5th grader could tell you that, yet google lets it go through.

Could be a study to see how much response such an obviously fraudulent e-mail gets, sent from that same university conducting the study.

I admit that it's a fringe case, but it could be a thing.

Re: Spam domains that plague my email

#14

Post by Brajeshwar » Mon, Jul 18, 2022, 7:04 AM UTC

Looks like a very personal list. I would not advice anyone using this as part of anything. Rohith[1] is in India and most of the spam domains (did a quick split) in the list are similar sounding names of a lot of Indian companies/Startups. Not that the companies do not spam (they do) but emails/domain registration has become so easy that there are tiny setups/operations in every nook and corner of the streets/chawls/shanties of India trying to spam people.

1. https://drive.google.com/file/d/1Z7bBo_rMQB0nJYUs8wl4pZeZVUv...

Re: Spam domains that plague my email

#15

Post by butz » Mon, Jul 18, 2022, 7:28 AM UTC

In theory one can set any domain to "from" field, what about actual servers that sent the spam? How many of those spam emails have unsubscribe and/or complaint headers?

Re: Spam domains that plague my email

#16

Post by chaoz_ » Mon, Jul 18, 2022, 7:34 AM UTC

NikhilVerma wrote: post #2

I am seeing Google constantly fail to catch obvious spam emails. At this point I suspect there is some institutional error on their part, where bad actors inside the org are allowing certain domains to simply not be spam filtered.

I've done some experiments with Gmail/Outlook/other spam detection clients on different types of spam/phishing etc. There's always someone who claims simple naive bayes algo would do better than Google.

I'm not able to share the research data, but Gmail filter is a lot better than everything else you see on the market, especially when it's not a newsletter-like advertisement spam, but an actual phishing attack on Org.

Some people say Outlook has better filtering func, but usually tests are not representative and Outlook simply has stricter rule for unwarmed-ip. Which is not that great of a feature in real world scenario.

Re: Spam domains that plague my email

#17

Post by uallo » Mon, Jul 18, 2022, 7:44 AM UTC

nubela wrote: post #8

These are usually domains that belong to a disposable email service, be it public or private. I maintain a 100% free API [1] to check if an email belongs to a disposable email service. We dogfood the same API endpoint to prevent users who abuse disposable emails to create fake accounts for free trial credits. We use the domains found at https://www.stopforumspam.com/downloads amongst other sources of data. Works pret…

> We dogfood the same API endpoint to prevent users who abuse disposable emails to create fake accounts for free trial credits.

I usually use disposable emails to test services but don't want to be spammed. Often, I later upgrade to a paid plan if I like the service. If they block disposable email addresses, I will not even try them at all.

Re: Spam domains that plague my email

#18

Post by avian » Mon, Jul 18, 2022, 7:47 AM UTC

butz wrote: post #15

In theory one can set any domain to "from" field, what about actual servers that sent the spam? How many of those spam emails have unsubscribe and/or complaint headers?

In theory the domain you set the "From:" field to will have DMARC, DKIM and SPF set up and in theory the recipient that implements those protocols will discard your mail as sent from an unauthorized server.

Re: Spam domains that plague my email

#19

Post by krageon » Mon, Jul 18, 2022, 7:52 AM UTC

nubela wrote: post #8

These are usually domains that belong to a disposable email service, be it public or private. I maintain a 100% free API [1] to check if an email belongs to a disposable email service. We dogfood the same API endpoint to prevent users who abuse disposable emails to create fake accounts for free trial credits. We use the domains found at https://www.stopforumspam.com/downloads amongst other sources of data. Works pret…

Congratulations, you make the internet worse for actual humans and better for corporations. Making the world a net worse place, for everyone that matters.

Re: Spam domains that plague my email

#20

Post by krageon » Mon, Jul 18, 2022, 7:54 AM UTC

Brajeshwar wrote: post #14

Looks like a very personal list. I would not advice anyone using this as part of anything. Rohith[1] is in India and most of the spam domains (did a quick split) in the list are similar sounding names of a lot of Indian companies/Startups. Not that the companies do not spam (they do) but emails/domain registration has become so easy that there are tiny setups/operations in every nook and corner of the streets/chawls/…

You appear to be trying to argue against something, but it reads as "this is a lot of Indian stuff, which is chock-full of spammers". Read like that, it seems like the list is a good one.