Getting spam from people you know

If you get a suspicious or malicious email from someone you know, their email address or server may have been compromised.

Hackers make money by selling email lists to companies and people who send spam and email blasts. Unsecured email accounts get hacked more and more often. Yahoo, for example, is notorious for it. When real addresses are hacked or spoofed, it is hard for spam filters to spot their messages as threats until they start acting suspiciously.

If you got little or no spam at EnGuard and are suddenly flooded, odds are one of the people you email has been hacked. Spammers have now added your address to 100's or even 1,000's of spam-sending servers. We stop tons of spam every day behind the scenes, but even the best filters cannot block a large-scale, zero-day attack, because new compromised servers come online every minute.

What hackers do with a hacked email account

1. Steal information from emails, such as passwords, logins and other personal data.
2. Use the account to send a one-time mass mailing of spam before the email provider shuts it down or the server is blacklisted.
3. Take all the email addresses in the address book to build lists for sale.

Other ways you end up on spam lists

Also make sure your email address is not publicly shown on any website. Spammers run crawlers, like search engines do, to collect as many exposed email addresses as they can. See our other guide for more information about increased spam.

If spam has already gone up a lot

If you already see a big jump in spam, the damage is likely done. The spambots or spammers that got your address can keep adding it to new spam lists forever. Often, by the time a spam server is blacklisted, it is already too late for our spam filters (or any spam filters) to block it.

If you are a victim of a spam attack

1. We can turn on "greylisting" for your account. Greylisting blocks a message on the first attempt and forces it to be sent again later. Spam servers normally send a message just once, so this is very effective. Real email servers retry several times before giving up. The downside is that every real sender is blocked at first too, so their emails to you are delayed on the first try. When a message is delivered the second time, we whitelist their IP address for 36 days, and during that time they can email you without delay.
2. Set up a content filtering rule in webmail to block all incoming email, then add allowed senders one by one. You must keep this list up to date, or many messages will bounce. You also risk missing important messages from people you did not add in time.
3. Change your email address. This stops all the spam, and real senders get your new address. If you guard the new address carefully, you will hopefully not be hit again.

Please contact our support team if you think your account is the target of a spam attack. If yours may be compromised or is unusable because of the spam, use another email address to contact us.

One-off spam messages in Webmail

Besides keeping your email address off websites, you can adjust your own spam filtering for single messages. Right-click any message and choose to mark it as spam and block the sender.

For stubborn spam, contact us via email and include all of this:

1. Which address is receiving the spam message?
2. What is the sending address of the spammer (what does it appear to be)?
3. When was the most recent instance of this spam (day, time)?
4. What is the message subject?
5. Do not forward the spam to us. We will not open it.
6. Do not delete or open the spam message. Flag it and move it to your Junk E-Mail folder instead. We can possibly look at the message code and header information to help you find and block its source.