The "Dicks Sporting Goods" email is insane - probably hourly at the moment, from what would appear obviously bogus email senders. What is the non-obvious answer as to why these get through?

These are so absolutely ridiculous. The only (dumb) reason I can think of is that there is a large ML model which got used to seeing certain character sequences as not spam and spammers are starting to exploit it.

It's kinda shocking as Gmail spam filtering was virtually flawless for over a decade, and now it's falling apart.

Maybe the spammers learned about adversarial networks?

Any non-ML method would trivially catch these spammers though. They share the common traits of

1. Sending identical emails to large numbers of users. 2. Using fake emails from fake domains. 3. Not looking at all like a regular email.

This is the stuff that 90s era spam filters could block.

> This is the stuff that 90s era spam filters could block.

But we are now in 2022. Those filters are loooong gone. I bet that in 20 years they will be sold as new technology.

I received 3 of these the other day. For those not aware, Dicks is the largest sporting goods store chain in the USA.

DICKS SPORTINGGOODS!! <[email protected]>

Subject: You've beean chosen! SPF: PASS with IP 40.107.117.103 Learn more DKIM: 'PASS' with domain acohhovldzbqmulu.ml

Dicks Sporting Goods Winner <[email protected]> Subject: -You've been chosen! SPF: PASS with IP 40.107.215.70 Learn more DKIM: 'PASS' with domain chistezlhekofu.ml Learn more

Google detects them all as Persian, and asks if I want to translate.

Also interesting:

Message ID <[email protected]>

The only text in the message:

Your Name Came Up For a YETI Hopper M//20 Cooler customer Gift

Ends up linking to here: https://templarswoards.com/39adf46955f3971c805bc32b65a2cb08

After filling out a 'survey' it asks for name, address, email, phone

https://www.simplediscountshop.com/staging/backpack/refresht...

It then asks for a credit card number to pay the $6.95 shipping

Funny enough, those emails caught my attention too and I was even trying to `curl -v` my way through the redirect chain before stumbling upon this thread.

Weirdly, in my case the links in the email were pointing at lnkd.in/<some payload>, which is a legit Linked in domain. However, with that payload it was 301-me to some garbage script on google storage and then some shady website. I'm curious how did they make lnkd.in respond with 301 to whatever they want and can't there be a vulnerability of some sort.

I would guess that gmail is using some kind of sender address reputation system, and these hacked accounts have high reputation on account of being used for legitimate mail traffic for a significant amount of time.

Yes! I'm getting around 10 Dick's Sporting Goods emails per day. It's a relief to know it's not just me.

I'm expecting my Yeti cooler any day now

That's what so crazy. Millions of people marking the Yeti cooler mail as spam, yet the same email continues for months.

I have 4 Dicks yeti emails, all in my spam folder.

Im waiting for the M20 cooler and the Samsung Neo QLED 8K Smart TV

I got one Dicks sporting goods spam and it was almost convincing because I’m pretty sure I signed up for a raffle in store recently

Haven’t been seeing any more since that one though.

Same here, started a few months ago.

Weirdly awed and relieved to know that I'm just a small part of the Dick's Sporting Goods spam epidemic.

In my case is a meeting invite: "Invitación: Great, you are now the winner of the mega prize! ⬅ Cada día de 18:00 a 19:00 (CST)" every day, although I marked it as phishing. I would have thought that at this point all prizes had been marked as spam.

There are no humans "handling" spam. It's done by AI.