| HN Mirror

Message ID <9UOejz_TlFksgoyXm9GI5Q@notifications.google.com> Created at: Fri, Jan 20, 2023 at 9:14 AM (Delivered after 0 seconds) From: "Girl Shows Girl cast a lookSTART JOIN Muriel (Classroom)" <no-reply@classroom.google.com> To: XXXXXXXXX Subject: Class invitation: "Check Join now View gambling Babe amidcustity" SPF: PASS with IP 209.85.220.69 Learn more DKIM: 'PASS' with domain google.com Learn more DMARC: 'PASS' Learn more Message ID <DM6PR18MB3569050DD20FD0372DA98C9DCEC59@DM6PR18MB3569.namprd18.prod.outlook.com> Created at: Fri, Jan 20, 2023 at 4:50 AM (Delivered after 3 seconds) From: hoven patroo <hovenpatrool@hotmail.com> To: XXXXXXXXXX Subject: 名梦 t94396350 SPF: PASS with IP 40.92.18.30 Learn more DKIM: 'PASS' with domain hotmail.com Learn more DMARC: 'PASS' Learn more

The first one is generated by apparent user actions from paid organizations. Although it's clearly spam, you can see how this is difficult for a provider to tackle, because all of the superficial signals are good: authenticated user, paid account, using official APIs. Obviously they need to step up their defenses against abuses like sharing from docs, calendar, etc to stop bad actors from laundering their spam through Google's highest-reputation internal senders.

When I worked in this area of gmail we called this the "russian urologist" problem. How do you correctly classify traffic like this when hypothetically some of your customers want to send and receive messages about viagra in russian? Casual observers will say that is spam but not to the russian urologist.