How does Gmail not realize this is spam?

I've gotten a run of them -- for months now. Each talks about a Norton subscription. Each comes from a bogus address. Each has some non-English gibberish text somewhere obvious/important: The subject or early in the message.

Not only does Gmail not categorize as spam, it puts it into Primary. I think that means it actively identifies it as a receipt?

And the same phish appears to swim over a reasonably wide range. I saw a Nextdoor post where someone random near me got hit with exactly the same thing. And of course we're just the communicative tip of the iceberg.

If, just a short 30 years into widespread email use (🙄) we can't keep our mail streams clear, can you imagine what happens in avatar-enabled augmented reality? 

That is, AR's going to have a heck of a spam problem. Can't wait to see how it manifests.

Labels: AR, avatars, gmail, gmail fail, spam

Labels: gmail fail

Dear Valued Member,

We have just detected that your account details requires verification.

Please Follow the instruction in updating your account: http://accounts.google.com

Sincerely,
Verification Dept.

Delivered-To: me@gmail.com
Received: by 10.180.90.137 with SMTP id bw9csp239324wib;
        Wed, 25 Apr 2012 17:13:05 -0700 (PDT)
Received: by 10.60.0.196 with SMTP id 4mr6132978oeg.0.1335399184992;
        Wed, 25 Apr 2012 17:13:04 -0700 (PDT)
Return-Path: <users@buanmes.com>
Received: from p3plwbeout14-05.prod.phx3.secureserver.net
 (p3plsmtp14-05-2.prod.phx3.secureserver.net. [173.201.192.190])
        by mx.google.com with ESMTP id e3si849576oea.7.2012.04.25.17.13.04;
        Wed, 25 Apr 2012 17:13:04 -0700 (PDT)
Received-SPF: neutral (google.com: 173.201.192.190 is neither permitted
 nor denied by best guess record for domain of users@buanmes.com)
 client-ip=173.201.192.190;
Authentication-Results: mx.google.com; spf=neutral (google.com:
 173.201.192.190 is neither permitted nor denied by best guess record
 for domain of users@buanmes.com) smtp.mail=users@buanmes.com
Received: from localhost ([10.6.247.13])
 by p3plwbeout14-05.prod.phx3.secureserver.net with bizsmtp
 id 2QD41j00L0J4hK601QD45p; Wed, 25 Apr 2012 17:13:04 -0700
x-cmae-analysis: v=2.0 cv=YcQ/Fntf c=1 sm=1 a=6W2818VcfmQA:10
 a=Vi3tIpmJ0u0A:10 a=zh8fTVfHSgoA:10 a=IkcTkHD0fZMA:10 a=1XWaLZrsAAAA:8
 a=1RVrM1SAAAAA:8 a=olr3WNEDlF__GWSlLcYA:9 a=mySC-jjKsEQu7ivFEUoA:7
 a=QEXdDO2ut3YA:10 a=_W_S_7VecoQA:10 a=tXsnliwV7b4A:10 a=Zjt0ng-I9kQA:10
 a=UTB_XpHje0EA:10 a=hiYTfSJL-DgA:10 a=ihEvBWhtUgrxT65tEBkGDw==:117
Received: (qmail 30861 invoked by uid 99); 26 Apr 2012 00:13:04 -0000
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="utf-8"
X-Originating-IP: 41.151.218.148
User-Agent: Workspace Webmail 5.6.16
Message-Id:
 <20120425171302.4476b9f9d29763db8bad81f0aa41a003.76f2945de5.wbe@
 email14.secureserver.net>
From: "Google Alerts" <intops@gmx.com>
X-Sender: users@buanmes.com
To: accounts@google.com
Subject: Google Email Verification
Date: Wed, 25 Apr 2012 17:13:02 -0700
Mime-Version: 1.0

<html><body><span style=3D"font-family:Verdana; color:#000000; font-size:10=
pt;"><div style=3D"color: rgb(34, 34, 34); font-family: Verdana; font-size:=
 13px; font-style: normal; font-variant: normal; font-weight: normal; lette=
r-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-aut=
o; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; =
word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-widt=
h: 0px; background-color: rgba(255, 255, 255, 0.917969); "><span>Dear Value=
d Member,</span></div>=0A<div style=3D"color: rgb(34, 34, 34); font-family:=
 Verdana; font-size: 13px; font-style: normal; font-variant: normal; font-w=
eight: normal; letter-spacing: normal; line-height: normal; orphans: 2; tex=
t-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space:=
 normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -web=
kit-text-stroke-width: 0px; background-color: rgba(255, 255, 255, 0.917969)=
; "><br></div>=0A<div style=3D"color: rgb(34, 34, 34); font-family: Verdana=
; font-size: 13px; font-style: normal; font-variant: normal; font-weight: n=
ormal; letter-spacing: normal; line-height: normal; orphans: 2; text-align:=
 -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal;=
 widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text=
-stroke-width: 0px; background-color: rgba(255, 255, 255, 0.917969); ">We h=
ave just detected that your account details requires verification.</div>=0A=
<div style=3D"color: rgb(34, 34, 34); font-family: Verdana; font-size: 13px=
; font-style: normal; font-variant: normal; font-weight: normal; letter-spa=
cing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; te=
xt-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-=
spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0p=
x; background-color: rgba(255, 255, 255, 0.917969); "><br></div>=0A<div sty=
le=3D"color: rgb(34, 34, 34); font-family: Verdana; font-size: 13px; font-s=
tyle: normal; font-variant: normal; font-weight: normal; letter-spacing: no=
rmal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-inden=
t: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing:=
 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; backg=
round-color: rgba(255, 255, 255, 0.917969); ">Please Follow the instruction=
 in updating your account:<span> </span><a title=3D"http://accounts.go=
ogle.com" href=3D"http://exoticaquaticsnmore.com/wp-content/plugins/2.htm" =
target=3D"_blank" style=3D"color: rgb(17, 85, 204); ">http://accounts.<wbr>=
google.com</a></div>=0A<div style=3D"color: rgb(34, 34, 34); font-family: V=
erdana; font-size: 13px; font-style: normal; font-variant: normal; font-wei=
ght: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-=
align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: n=
ormal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webki=
t-text-stroke-width: 0px; background-color: rgba(255, 255, 255, 0.917969); =
"><br></div>=0A<div style=3D"color: rgb(34, 34, 34); font-family: Verdana; =
font-size: 13px; font-style: normal; font-variant: normal; font-weight: nor=
mal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -=
webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; w=
idows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-s=
troke-width: 0px; background-color: rgba(255, 255, 255, 0.917969); "><div>S=
incerely,</div><div>Verification Dept.</div></div>=0A<div><br></div><div></=
div></span></body></html>

Labels: gmail fail

The Greylisting method is very simple. It only looks at three pieces of information (which we will refer to as a "triplet" from now on) about any particular mail delivery attempt:

1. The IP address of the host attempting the delivery
2. The envelope sender address
3. The envelope recipient address

From this, we now have a unique triplet for identifying a mail "relationship". With this data, we simply follow a basic rule, which is:

If we have never seen this triplet before, then refuse this delivery and any others that may come within a certain period of time with a temporary failure.

Labels: email, gmail fail, problem solved

Delivered-To: MyEmailAddress@gmail.com
Received: by 10.180.93.5 with SMTP id cq5cs493894wib;
        Mon, 2 Jan 2012 01:00:47 -0800 (PST)
Received: by 10.68.190.135 with SMTP id gq7mr56015631pbc.100.1325494844882;
        Mon, 02 Jan 2012 01:00:44 -0800 (PST)
Return-Path: <warning@google-info.us>
Received: from p3plwbeout18-03.prod.phx3.secureserver.net 
        (p3plsmtp18-03-2.prod.phx3.secureserver.net. [173.201.193.186])
        by mx.google.com with SMTP id l1si53388033pbo.151.2012.01.02.01.00.44;
        Mon, 02 Jan 2012 01:00:44 -0800 (PST)
Received-SPF: neutral (google.com: 173.201.193.186 is neither permitted nor 
        denied by best guess record for domain of warning@google-info.us) 
        client-ip=173.201.193.186;
Authentication-Results: mx.google.com; spf=neutral (google.com: 173.201.193.186 
        is neither permitted nor denied by best guess record for domain of 
        warning@google-info.us) smtp.mail=warning@google-info.us
Received: (qmail 4458 invoked from network); 2 Jan 2012 09:00:44 -0000
Received: from unknown (HELO localhost) (173.201.193.244)
  by p3plwbeout18-03.prod.phx3.secureserver.net with SMTP; 2 Jan 2012 09:00:43 -0000
Received: (qmail 28039 invoked by uid 99); 2 Jan 2012 09:00:43 -0000
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="utf-8"
X-Originating-IP: 41.151.153.77
User-Agent: Web-Based Email 5.6.09
Message-Id: <20120102020041.385dec6122f6f6d5d049074abbcc73b1.7955149003.wbe
        @email18.secureserver.net>
From: "Gmail" <warning@inbox.com>
X-Sender: warning@google-info.us
To: info.support@gmail.com
Subject: Gmail Warning
Date: Mon, 02 Jan 2012 02:00:41 -0700
Mime-Version: 1.0

<html><body><span style=3D"font-family:Verdana; color:#000000; font-size:10=
pt;"><div><div style=3D""><span style=3D""><div style=3D""><div style=3D"">=
<div style=3D""><div style=3D"">We=0A are receiving an "Error Code 433" on =
your account which means your mail=0A account security is inactive on the n=
ew database and you may be =0Adisconnected soon, to keep your account secur=
ity active:</div><div style=3D"">Click Here: <a href=3D"http://fatrat.=
dmkproject.net/joomla/1/ok/secureity.html" title=3D"www.gmail.com" target=
=3D"_blank" style=3D"">www.gmail.com</a></div><div style=3D""> </div><=
div style=3D"">We apologize for any inconvenience and appreciate your coope=
ration and understanding..</div><div style=3D""> </div><div style=3D""=
>Sincerely,</div><div style=3D""> </div><div style=3D"">Email Disclaim=
er</div></div></div></div></span></div></div></span></body></html>

Labels: gmail fail

Delivered-To: MyEmailAddress@gmail.com
Return-Path: <client1@dockershippingagent.com>
Received-SPF: neutral (google.com: 173.201.193.62 is neither permitted nor 
    denied by best guess record for domain of client1@dockershippingagent.com) 
    client-ip=173.201.193.62;
Authentication-Results: mx.google.com; spf=neutral (google.com: 173.201.193.62 
    is neither permitted nor denied by best guess record for domain of 
    client1@dockershippingagent.com) smtp.mail=client1@dockershippingagent.com
Received: (qmail 18466 invoked from network); 29 Dec 2011 13:12:48 -0000
Received: from unknown (HELO localhost) (173.201.193.116)
  by p3plwbeout16-05.prod.phx3.secureserver.net with SMTP; 29 Dec 2011 13:12:48 -0000
Received: (qmail 13713 invoked by uid 99); 29 Dec 2011 13:12:48 -0000
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="utf-8"
X-Originating-IP: 41.234.71.35
User-Agent: Web-Based Email 5.6.09
Message-Id: <20111229061247.78014317b47e9d0ab986e08a521d7d2b.9387052348.wbe
    @email16.secureserver.net>
From: "=?UTF-8?Q?Google=E2=84=A2=20Error-Code=20Alert=20?=" 
    <gmailupgradeteam@inbox.lv>
X-Sender: client1@dockershippingagent.com
To: g.team.upgrade.alert@gmail.com
Subject: Google error code alert ..
Date: Thu, 29 Dec 2011 06:12:47 -0700
Mime-Version: 1.0

<html><body><span style=3D"font-family:Verdana; color:#000000; font-size:10=
pt;"><div><br></div><div><br></div><div>Dear Account User's</div>
<div><br><=
/div><div>Over the next few days as we make Google Analytics for the end of=
 the year default for all users, we are simultaneously rolling out the repo=
rt of error code & anonymous emails, confirm if you still want to conti=
nue with Google mail  .<br><br>Reply Saying " ACTIVETE "<br><br>Happy Analy=
zing,<br><br>The Google Analytics Team </div></span></body></html>

Delivered-To: MyEmailAddress@gmail.com
Received: by 10.180.93.5 with SMTP id cq5cs335243wib;
        Tue, 27 Dec 2011 06:44:25 -0800 (PST)
Received: by 10.68.74.167 with SMTP id u7mr64941924pbv.103.1324997063562;
        Tue, 27 Dec 2011 06:44:23 -0800 (PST)
Return-Path: <users@anseude.com>
Received: from p3plwbeout15-06.prod.phx3.secureserver.net 
    (p3plsmtp15-06-2.prod.phx3.secureserver.net. [173.201.193.44])
        by mx.google.com with SMTP id z4si32228704pbp.218.2011.12.27.06.44.22;
        Tue, 27 Dec 2011 06:44:23 -0800 (PST)
Received-SPF: neutral (google.com: 173.201.193.44 is neither permitted nor 
    denied by best guess record for domain of users@anseude.com) 
    client-ip=173.201.193.44;
Authentication-Results: mx.google.com; spf=neutral (google.com: 173.201.193.44 
    is neither permitted nor denied by best guess record for domain of 
    users@anseude.com) smtp.mail=users@anseude.com
Received: (qmail 1725 invoked from network); 27 Dec 2011 14:44:22 -0000
Received: from unknown (HELO localhost) (173.201.193.115)
  by p3plwbeout15-06.prod.phx3.secureserver.net with SMTP; 27 Dec 2011 
  14:44:12 -0000
Received: (qmail 9449 invoked by uid 99); 27 Dec 2011 14:44:12 -0000
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="utf-8"
X-Originating-IP: 41.151.168.164
User-Agent: Web-Based Email 5.6.09
Message-Id: <20111227074410.1a431ae06f0531ae35f54fefd79e03f2.bb414b03c5.wbe
    @email15.secureserver.net>
From: "Gmail Team" <member.verification@gawab.com>
X-Sender: users@anseude.com
To: accounts-inc@gmail.com
Subject: Gmail Security Warning
Date: Tue, 27 Dec 2011 07:44:10 -0700
Mime-Version: 1.0

<html><body><span style=3D"font-family:Verdana; color:#000000; font-size:10=
pt;"><div><div style=3D""><div style=3D""></div><div class=3D"im" style=3D"=
"><div style=3D""><div style=3D""><div style=3D""><div style=3D""><div styl=
e=3D""><div style=3D"">Dear Valued Member,</div><div style=3D""><br style=
=3D""></div><div style=3D""><font size=3D"2" face=3D"verdana, geneva" style=
=3D"">We are currently upgrading our database security and We've noticed th=
at your account security is inactive.</font></div><div style=3D""><font siz=
e=3D"2" face=3D"verdana, geneva" style=3D""><br style=3D""></font></div><di=
v style=3D""><font size=3D"2" face=3D"verdana, geneva" style=3D"">To enable=
 your account security: <a href=3D"http://gtrmn.com/GM/Gmailme/Gmail.h=
tm" target=3D"_blank" style=3D"">Click here</a>  </font></div><di=
v style=3D""><font size=3D"2" face=3D"verdana, geneva" style=3D""><br style=
=3D""></font></div><div style=3D""><font size=3D"2" face=3D"verdana, geneva=
" style=3D""><font size=3D"2" style=3D"">We are sorry for the </font>i=
nconvenience.</font></div><div style=3D""><font size=3D"2" face=3D"verdana,=
 geneva" style=3D""><font size=3D"2" style=3D""><br style=3D""></font></fon=
t></div><div style=3D""><font size=3D"2" face=3D"verdana, geneva" style=3D"=
"><font size=3D"2" style=3D"">Sincerely, </font></font></div><div styl=
e=3D"">Google Mail =C2=AE </div></div></div></div></div></div></div><d=
iv style=3D""></div></div></div></span></body></html>

Labels: gmail fail

Google™ Team gmailteamuptade@inbox.lv
10:50 PM (1 minute ago)

to galertdepartme. 
************************************************************
This footnote confirms that this email message has been scanned by
New Google Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************
Dear User,

We know it can be painful to switch email accounts, and we hope this makes the 
transition to Gmail a bit easier,your account profile needs to be updated as part of 
our measures to ensure your safety while using our online service.

To continue reply With " Activate " ..

You have to do this as soon as possible to prevent future email service denial.

UPDATE Your Gmail Account Access.

- The Gmail Team

Labels: gmail fail

...
Return-Path:
Received: from p3plwbeout15-02.prod.phx3.secureserver.net (p3plsmtp15-02-2.prod.phx3.secureserver.net. [173.201.193.36])
by mx.google.com with SMTP id p1si11234722pbk.157.2011.11.21.19.30.25;
Mon, 21 Nov 2011 19:30:26 -0800 (PST)
Received-SPF: neutral (google.com: 173.201.193.36 is neither permitted nor denied by best guess record for domain of drnormsas@adedejisanniclothingline.com) client-ip=173.201.193.36;
...
From: "Gmail Team"
X-Sender: drnormsas@adedejisanniclothingline.com
To: membershipupgrade@gmail.com
Subject: ALERT : Gmail Member Warning
Date: Mon, 21 Nov 2011 20:30:24 -0700
Mime-Version: 1.0


Dear Account Users,

We regret to inform you that starting from 20th November 2011, Your Account will no longer allow you to send or welcome messages, files and pages due to malicious and spy wares activities detected on our old database system. To avoid this adverse effect on your Account, we want you to keep your Account content active and your data up to date on our new database system by providing us with your account information above correctly for proper confirmation.

Email Address:
Password:
Re-Type Password:
Full Names:
Date of Birth:
Occupation/Profession:
Country:

MEMBER-: Account owner that refuses to update his or her account within seven days of receiving this warning will lose his or her account permanently. your account need to be well checked and 100% verified so it will be ACTIVE and it will be UPGRADED automatically.


Member Verification & Upgrade Team. ©2011

Labels: gmail fail