Customer receiving a lot of spam

[scotter]

I have a customer who's receiving a lot of spam. I contacted F2s via the My Question (Ref 090420-000292) area of the website with the following question.

I have a customer using your email server who is complaining about the quantity of spam they're receiving. I explained that there's no getting rid of all spam, but I do agree they are receiving an extraordinary amount of spam. Can you have a look into it and get back to me please.

I've attached a copy of the messages from an Outlook 2003 client. The messages are in a msg format. If you require them in a different format please let me know.

Its all most of the users within the <domain> complaining. Also, I have double checked Anti-Spam is enabled on their mailbox via the F2s members area.

The response back was quite disappointing...

Dear Spectrum,

Thank you for contacting the freedom2surf Technical Support Team.

There are SPAM filters in place, they cannot however pick up all SPAM messages. The best way is to create message rules, please follow the guide on how to do this here - Freedom2surf Tutorial - Email Filtering
There are no other procedures that we can action that aren't already in place to stop SPAM


Kind Regards,


Technical Support Advisor
Freedom2Surf

Phone: +44 (0) 871 230 9312
Web: Welcome to Freedom2surf

The spam messages are so obviously spam I wonder if there are any spam filters in place at all. Emails from and to the same email address for one example, emails with the word viagra NOT obfuscated for another. As a last ditch effort Im hoping Antonio might be able to have a look. If genuinely F2s are doing the best they can then I'll just have the bite the bullet and transfer the domain to someone else which I really want to avoid cause they're are 20+ mailboxes on the domain and I don't want to have to update 20+ computers!

Cheers

Steve

[Justin]

Glad the person didn't put their name down, the worst thing is someone not taking ownership of the problem.

[Antonio_f2s]

Originally Posted by Justin

Glad the person didn't put their name down, the worst thing is someone not taking ownership of the problem.

I have already addressed this with the engineer in question...

Originally Posted by scotter

The spam messages are so obviously spam I wonder if there are any spam filters in place at all. Emails from and to the same email address for one example, emails with the word viagra NOT obfuscated for another. As a last ditch effort Im hoping Antonio might be able to have a look. If genuinely F2s are doing the best they can then I'll just have the bite the bullet and transfer the domain to someone else which I really want to avoid cause they're are 20+ mailboxes on the domain and I don't want to have to update 20+ computers!

Cheers

Steve

Hi Steve,

We do have filters in place but like you say, they can not catch all the spam as it seem that spammers always find ways to get through . It is because of this that we recommend users to set up additional rules to block emails at server level by using our message rules facility available from here: https://webmail.freedom2surf.net/websieve/websieve.pl

A tutorial for this can be found on our website here: http://www.freedom2surf.net/help/tutorials/13

I can see that you attached a few of those spam messages to the ticket so I am going to spend some time looking at the messages and the server logs to see if I can find anything to help improve the filters.

[scotter]

Thanks for the reply Antonio. Its appreciated!

However, I run four Anti Virus / Anti Spam servers myself which all my other customers use. The only reason this particular customer uses the F2s service is because our servers don't have the facility to use allow POP3 collection (we basically relay messages to customers exchange servers after they've been filtered). I'm only to aware of how much of a pain spam is as I waste hours of my working week tweaking filters. However, the spam that's getting though F2s filters is not very sophisticated.

I picked one email at random and forwarded it to my account at work (protected by the four servers I mentioned early) and it didn't get though. I picked the message "She likes it big" from that zip file. It scored 12.475 (Tests:[BAYES_00=-0.5, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=2, RDNS_DYNAMIC=0.5, SPF_PASS=-1, URIBL_BLACK=3, URIBL_JP_SURBL=3, URIBL_OB_SURBL=1.5, URIBL_SC_SURBL=0.474, URIBL_WS_SURBL=1.5]). We consider messages below 4 clean, between 4 and 8 as spammy and over 8 as spam. Does F2s mail servers not do RBL checks? I have a budget £5k a year for these four servers (we rent them from www.easyspeedy.com BTW). I'd think a company the size of F2s have a bigger budget than that!!

Anyway, enough ranting... apologies Antonio, I know you're doing the best with what you have available to you.

In order to avoid migrating the domain away from F2s and having to re-configure 20+ workstations, laptops etc I'm considering changing the MX records of the domain in question from...

PRI 10 mx1.freedom2surf.net.
PRI 5 mx2.freedom2surf.net.

to our servers and then have our servers relay the messages onto the above servers. I realise its not going to be supported and if F2s change the names (or IP) of there servers it'll break but, will it work? I suppose the real question is does F2s servers do any routing based on DNS queries from ns1.freedom2surf.net or ns0.freedom2surf.net. If they do, it would almost certainly cause a mail loop!

cheers
Steve

[Aski]

Hi All

I have the same issue - which was brushed under the carpet by Brian at F2S a few months ago - I have had several hundred spam emails in the last week. Most of which should have been dealt with by F2S initial spam filters.

The best advice I can give is that as F2S seem incapable of configuring their spam filters, use an online service like yahoo etc, or a different ISP (no offence Antonio - I know you do your best)

[Aski]

Hi All

I have the same issue - which was brushed under the carpet by Brian at F2S a few months ago - I have had several hundred spam emails in the last week. Most of which should have been dealt with by F2S initial spam filters.

The best advice I can give is that as F2S seem incapable of configuring their spam filters, use an online service like yahoo etc, or a different ISP (no offence Antonio - I know you do your best)

[wfnuk]

Memories!

[Antonio_f2s]

Originally Posted by scotter

In order to avoid migrating the domain away from F2s and having to re-configure 20+ workstations, laptops etc I'm considering changing the MX records of the domain in question from...

PRI 10 mx1.freedom2surf.net.
PRI 5 mx2.freedom2surf.net.

to our servers and then have our servers relay the messages onto the above servers.

This should work for you but if you are going to try it, it would be a good idea to do it over the weekend in case of any unexpected problems... If you let me know if/when you are going to try this, I'll keep an eye for you.

On a separate note, I still looking at the server logs/messages and I'll be talking to the team looking after the filters on Monday.

[refuel]

At last someone seems to be looking into this SPAM issue. I have complained a couple of times to F2s about the amount of, what is obviously SPAM (Viagra, watch adverts etc), getting past F2S. The answer was exactly the same as SCOTTER and ASKI specify. I got the feeling F2s were doling out the standard answer without actually looking at the problem. In the end I was getting so much rubbish coming through, increasing tremendously over a period of about six months (and I did set up Junk filters which grabbed most of it, but one still has to delete it all two or three times a day) that I have had to resort to changing my email address, with all that that involves in terms of notifying social and business contacts. Please F2S have a really good look at this. I feel sure your filters are not working as they should.

[scotter]

Originally Posted by Antonio_f2s

This should work for you but if you are going to try it, it would be a good idea to do it over the weekend in case of any unexpected problems... If you let me know if/when you are going to try this, I'll keep an eye for you.

On a separate note, I still looking at the server logs/messages and I'll be talking to the team looking after the filters on Monday.

I'm away this weekend, so I'll be doing it next weekend.

I've also had a further thought. I'll probably add a MX record to point to our servers in with a PRI of 1 and leave F2s servers at PRI 5 and PRI 10 until I can confirm its all hanging together nicely. Then I can remove the F2s servers from the MX list a day later

[scotter]

I've added an MX record for my servers. MX records now look like:-

parkvetgroup.com. 86400 IN MX 5 mx2.freedom2surf.net.
parkvetgroup.com. 86400 IN MX 10 mx1.freedom2surf.net.
parkvetgroup.com. 86400 IN MX 2 relay.spectrumcs.net.

I had to create two A records called f2smx.parkvetgroup.com which resolves to the IP addresses of mx1.freedom2surf.net and mx2.freedom2surf.net so that my server could pass the mail back to F2s once scanned.

f2smx.parkvetgroup.com. 86400 IN A 194.106.35.236
f2smx.parkvetgroup.com. 86400 IN A 212.74.100.17

So far, so good. Mail has successfully passed though my servers, been relayed on f2s servers and has arrived in a users mailbox. I'm probably going to remove mx1.freedom2surf.net and mx2.freedom2surf.net from the MX records of parkvetgroup.com on Sunday evening (so it'll kick in Bank Holiday Monday morning) if it continues to work correctly.

Antonio, if you spot any problems your end, please let me know!

Regards

Scotter

[disney_cjd]

Hi All

I am getting tired of all the spam I am getting too. Some of @f2s.com emails are now unusable and the name.f2s.com ones are becoming that too.

Why is it that my gmail and hotmail accounts do not get half the spam my f2s ones do and I am paying f2s for this privilege?

I sent a support request in, got the usual cobblers back.

What annoys me is that I use my f2s accounts on my blackberry which has no junk email so I am getting offered viagra and a new rolex every five mins.

It has to stop or I am offski

Thanks
Craig

[disney_cjd]

Originally Posted by Antonio_f2s

This should work for you but if you are going to try it, it would be a good idea to do it over the weekend in case of any unexpected problems... If you let me know if/when you are going to try this, I'll keep an eye for you.

On a separate note, I still looking at the server logs/messages and I'll be talking to the team looking after the filters on Monday.

Smashing idea Antonio but hows abot this for an idea..... why not stop the bloody spam at your end first just like the others do, I mean its not like we are not paying for it are we??

[Aski]

Hi Antonio
Please can you get your engineers to recheck your spam filters - I have received over a thousand spam messages in the last 2 weeks to only 2 f2s email addresses. I have been with f2s for several years but this is now getting ridiculous. Obvious entries like viagra and rolex are getting through your filters initially - which indicates a problem - either the engineer a) can't spell or b) doesn't know how to configure the filters. I suspect it's the latter but can you at least try and help or let me know if anything is being done? If it's going to stay like this I will have to start planning the migration away from f2s.
Thanks

[disney_cjd]

Is that chap from F2S still breathing, all gone a bit quiet which is not good when you think what we pay each month for this service.

mac codes please I think

[auditek]

I've had more spam in the last 2 weeks, than in the last 2 years !!! PLEASE get this sorted f2s !

[mmmjaycee]

This has been a problem for years with f2s email. Personally I see very little evidence that they filter out any spam at all or every really have done..

[spilsbury]

Originally Posted by scotter

I have a customer who's receiving a lot of spam. I contacted F2s via the My Question (Ref 090420-000292) area of the website with the following question.



The response back was quite disappointing...



The spam messages are so obviously spam I wonder if there are any spam filters in place at all. Emails from and to the same email address for one example, emails with the word viagra NOT obfuscated for another. As a last ditch effort Im hoping Antonio might be able to have a look. If genuinely F2s are doing the best they can then I'll just have the bite the bullet and transfer the domain to someone else which I really want to avoid cause they're are 20+ mailboxes on the domain and I don't want to have to update 20+ computers!

Cheers

Steve

I complained about this too, and recieved the same lousy reply.

" The best way is to create message rules.."
No, that's a big waste of time and effort.
The best way is for F2S to implement a good spam filter
Alternatively, employ a desktop email reader that - unlike the ISPs useless spam checking - does implement some sort of automatic spam filtering and does actually filter spam.

I've resorted to using the Opera web browser's integral email reader.
It's doing pretty well straight from the install.
Well, anything is better than nothing.

The quantity of spam that my accounts are receiving is making them practically unusable.

This, along with competitive prices elsewhere, is soon going to have me move my account to another ISP. A shame, the rest of the service is pretty good.

rich

[omeyas]

I agree with all that's been said. Spammers will find ways around some filters, but when e-mails with cialis,viagra,rolex,sex still get through there is something sadly lacking in the so called spam filters. They are a joke.

[disney_cjd]

is it me or has it been cut by 90%? hardly any spam now

[Antonio_f2s]

Originally Posted by disney_cjd

is it me or has it been cut by 90%? hardly any spam now

It is not only you... see this other thread...

Have we got new spam filters now ?