RE: *****SPAM***** another domain for bigevil

[Chris Santerre <cs...@MerchantsOverseas.com>]

> -----Original Message-----
> From: tswentworth@hushmail.com [mailto:tswentworth@hushmail.com]
> Sent: Saturday, February 07, 2004 3:36 AM
> To: csanterre@merchantsoverseas.com
> Subject: *****SPAM***** another domain for bigevil
> 
> 
> No need to reply - I know you must be swamped with these.  I 
> get BigEvil
> hits on about 20-30% of the spam I receive, which means it's 
> really doing
> its job :)
> 
> Thanks for your hard work,
> 
> Tom
> 
> (Spam below)
> 
> This is a multi-part message in MIME format.
> 
> ------=_NextPart_000_0EA4_8C419C97.D5F6ECA1
> Content-Type: text/plain;
> 	charset="us-ascii"
> Content-Transfer-Encoding: 8bit
> 
> 
> 
> 
> ------=_NextPart_000_0EA4_8C419C97.D5F6ECA1
> Content-Type: text/html;
> 	charset="us-ascii"
> Content-Transfer-Encoding: 8bit
> 
> <html><body>
> <center><!--srC2Y3Frz9ll--><a 
> href="http://www.heelpdr.com"><img 
> src="http://www.ccbbporfg.com/v9.gif"
> border=0></a></center>
> <body></html>
> 
> 
> ------=_NextPart_000_0EA4_8C419C97.D5F6ECA1--
> 
LOL, yup I get a ton of submissions :) However why an I replying to this one
and cc'ing the list? I won't add these domains to Bigevil!

"What?! Why?!" you ask. :) 

They change too often. This particular spammer changes 4 domains every week.
It was crazy to list them. So I wrote a rule just to catch him. I posted the
update today for MRWIGGLY. It will tag this particular spam. 

rawbody __VDRUG1 /^\<html\>\<body\>/
rawbody __VDRUG2 /^\<center\>\<\!\-\-.{10,25}\-\-\>\<a href\=\"http\:\/\//
rawbody __VDRUG3 /[a-zA-Z]\d\.gif\" border\=0\>\<\/a\>\<\/center\>/
rawbody __VDRUG4 /^\<\/?body\>\<\/html\>/
meta MRWIGGLY (__VDRUG1 && __VDRUG2 && __VDRUG3 && __VDRUG4)
describe MRWIGGLY Mr. Wiggly enhance drug spam.
score MRWIGGLY 2.0

Should be 7 lines without wrap. So if anyone else has a spam slipping thru
like the one below, use this rule, but don't submit to Bigevil. This spammer
changes them too often, and they expire all the time. 

But keep other submissions coming!!! :)

--Chris

RE: *****SPAM***** another domain for bigevil

[Jon <jo...@tgpsolutions.com>]

On Mon, 2004-02-09 at 07:08, Chris Santerre wrote:
> They change too often. This particular spammer changes 4 domains every week.
> It was crazy to list them. So I wrote a rule just to catch him. I posted the
> update today for MRWIGGLY. It will tag this particular spam. 
> 
> rawbody __VDRUG1 /^\<html\>\<body\>/
> rawbody __VDRUG2 /^\<center\>\<\!\-\-.{10,25}\-\-\>\<a href\=\"http\:\/\//
> rawbody __VDRUG3 /[a-zA-Z]\d\.gif\" border\=0\>\<\/a\>\<\/center\>/
> rawbody __VDRUG4 /^\<\/?body\>\<\/html\>/
> meta MRWIGGLY (__VDRUG1 && __VDRUG2 && __VDRUG3 && __VDRUG4)
> describe MRWIGGLY Mr. Wiggly enhance drug spam.
> score MRWIGGLY 2.0
> 
> Should be 7 lines without wrap. So if anyone else has a spam slipping thru
> like the one below, use this rule, but don't submit to Bigevil. This spammer
> changes them too often, and they expire all the time. 
> 

Is there a downloadable .cf file in a stable location for MRWIGGLY?  Or
is it just released informally over this list?  

- Jon

-- 
jon@tgpsolutions.com

Administrator, tgpsolutions
http://www.tgpsolutions.com

RE: *****SPAM***** another domain for bigevil

[David B Funk <db...@engineering.uiowa.edu>]

On Mon, 9 Feb 2004, Chris Santerre wrote:

>
> LOL, yup I get a ton of submissions :) However why an I replying to this one
> and cc'ing the list? I won't add these domains to Bigevil!
>
> "What?! Why?!" you ask. :)
>
> They change too often. This particular spammer changes 4 domains every week.
> It was crazy to list them. So I wrote a rule just to catch him. I posted the
> update today for MRWIGGLY. It will tag this particular spam.

Maybe we need some kind of 'whois' lookup eval. Anything regstered
out of "paycenter.com.cn" (or with DNS NS service from NICSIMPLE.COM)
should be hit. ;)

Just as we have RBLs listing spamhaus nets, and lists of spamhaus
hosting services, why not a list of spamhaus registrars?
The registrars are making money off the spamming operations and
so would be legit targets for blacklisting too.


-- 
Dave Funk                                  University of Iowa
<dbfunk (at) engineering.uiowa.edu>        College of Engineering
319/335-5751   FAX: 319/384-0549           1256 Seamans Center
Sys_admin/Postmaster/cell_admin            Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{