Someone is using Jira to send Spam emails

[Klice]

Hi everyone,

I just received an SPAM email from Cloud Jira service:

I verified and it indeed came from Jira.
Someone created a new project and started tagging people in tickets to send them emails.

Not sure how widespread this is, but I personally see it for the first time.

Maybe Atlassian should implement some guide rails to prevent users from abusing the service this way.

[Nic Brough -Adaptavist-]

It's not so much the abuse of service that's the problem here, but that Atlassian make it easy to create Atlassian accounts.  You need to have an Atlassian account before you can create an Atlassian Cloud site (and then go on to abuse it).  Atlassian Cloud systems are not the only place that have this problem - the Community here gets several spam accounts posting junk every day (and sock-puppet accounts, and external spam, and....)

In other words, it's too easy to create a fake Atlassian account.

It's not an easy line to walk - Atlassian want people to find it easy to create an account and go on to sign up for Cloud services, but when it's too easy, it's open to abuse.

Anyway, the Community can't help with this directly, we have no control over other people's Cloud sites.

But when this was a bigger problem, Atlassian ended up setting up a dedicated abuse reporting email for exactly what you're getting.

There are other conversations about these which have a load of detail, but the TLDR version is that Atlassian have asked us to forward spam from these dubious sites to abuse@atlassian.com (just forward the email with full headers, no more information or explanation needed)

[Deleted user]

Gotta bump this, because I got 3 different spam notification in a day from jira. I'm assuming this is gonna be a huge problem?

[Nic Brough -Adaptavist-]

See the answer I gave a year ago, there's not a lot more we can tell you.

[Deleted user]

Same here:

It's only a part, about a dozen is already deleted

[Nic Brough -Adaptavist-]

Welcome to the Atlassian Community!

Please read the previous answer I gave July 14 last year.  At least the last paragraph.

[eonyanov2014]

Same issue. How to stop it?

[Nic Brough -Adaptavist-]

Welcome to the Atlassian Community!

Have a read of (at least) the last paragraph of the first comment.

[eonyanov2014]

I am not satisfied with your answer.
You can add management of global (account) notification settings for existing users. And for the new one, leave it as it is now.

[Nic Brough -Adaptavist-]

I'm sorry you're not "satisfied", but it is the only answer to the question.

[Lashavian Richardson]

I got one this morning,after I was already logged in. Yes I have to admit they dangle large amounts of money in front of people. 

[Nic Brough -Adaptavist-]

Welcome to the Atlassian Community!

Please read the last paragraph in the first comment made (and the rest of the comment if you are interested in the wider problem)

[Lashavian Richardson]

My invite didn't come through spam 

[Nic Brough -Adaptavist-]

I don't understand what you mean.  Do you mean your spam filter did not see it as spam?