These are so absolutely ridiculous. The only (dumb) reason I can think of is that there is a large ML model which got used to seeing certain character sequences as not spam and spammers are starting to exploit it.

It's kinda shocking as Gmail spam filtering was virtually flawless for over a decade, and now it's falling apart.

Maybe the spammers learned about adversarial networks?

Any non-ML method would trivially catch these spammers though. They share the common traits of

1. Sending identical emails to large numbers of users. 2. Using fake emails from fake domains. 3. Not looking at all like a regular email.

This is the stuff that 90s era spam filters could block.

> This is the stuff that 90s era spam filters could block.

But we are now in 2022. Those filters are loooong gone. I bet that in 20 years they will be sold as new technology.

I received 3 of these the other day. For those not aware, Dicks is the largest sporting goods store chain in the USA.

DICKS SPORTINGGOODS!! <[email protected]>

Subject: You've beean chosen! SPF: PASS with IP 40.107.117.103 Learn more DKIM: 'PASS' with domain acohhovldzbqmulu.ml

Dicks Sporting Goods Winner <[email protected]> Subject: -You've been chosen! SPF: PASS with IP 40.107.215.70 Learn more DKIM: 'PASS' with domain chistezlhekofu.ml Learn more

Google detects them all as Persian, and asks if I want to translate.

Also interesting:

Message ID <[email protected]>

The only text in the message:

Your Name Came Up For a YETI Hopper M//20 Cooler customer Gift

Ends up linking to here: https://templarswoards.com/39adf46955f3971c805bc32b65a2cb08

After filling out a 'survey' it asks for name, address, email, phone

https://www.simplediscountshop.com/staging/backpack/refresht...

It then asks for a credit card number to pay the $6.95 shipping

Funny enough, those emails caught my attention too and I was even trying to `curl -v` my way through the redirect chain before stumbling upon this thread.

Weirdly, in my case the links in the email were pointing at lnkd.in/<some payload>, which is a legit Linked in domain. However, with that payload it was 301-me to some garbage script on google storage and then some shady website. I'm curious how did they make lnkd.in respond with 301 to whatever they want and can't there be a vulnerability of some sort.

I would guess that gmail is using some kind of sender address reputation system, and these hacked accounts have high reputation on account of being used for legitimate mail traffic for a significant amount of time.