You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Simon Byrnand <si...@igrin.co.nz> on 2004/06/10 04:14:17 UTC
Flooded by spam in German
Anyone else suddenly (last couple of days) getting flooded with spam in
German ?
So far I've been unable to get SpamAssassin to block it, despite manual
Bayes training. One of the spams had a link going to this page:
http://www.deutschland-bewegung.de/weiter/zuwanderung.html
Which when translated looks like some kind of "political" movement of some
sort... :/
Unfortunately 99% of the spams are just plain text with no URL's and little
or no dodgy headers, so extremely hard to block.
Anyone else having better luck ?
Regards,
Simon
Re: Flooded by spam in German
Posted by Tim Wesemann <ti...@voicenet.com>.
> Anyone else suddenly (last couple of days) getting flooded with spam in
> German ?
I got about 10 similar emails tonight (several with the same exact link,
others with the subject line "Medienzensur")... They originally scored
around 1...
I've been training my bayes db's and the last one scored a 7.9, mainly b/c
of bayes and RAZOR2_CHECK.
--
Tim Wesemann
Re: Flooded by spam in German
Posted by Stephan Paukner <pa...@paukner.cc>.
Hi!
Simon Byrnand wrote:
> Anyone else suddenly (last couple of days) getting flooded with spam in
> German ?
>
> So far I've been unable to get SpamAssassin to block it, despite manual
> Bayes training. One of the spams had a link going to this page:
>
> http://www.deutschland-bewegung.de/weiter/zuwanderung.html
>
> Which when translated looks like some kind of "political" movement of some
> sort... :/
>
> Unfortunately 99% of the spams are just plain text with no URL's and
> little
> or no dodgy headers, so extremely hard to block.
>
> Anyone else having better luck ?
This doesn't seem to be real spam, but a result of the mailworm Sober.G,
which changed behaviour yesterday, as some news sites explained. It
doesn't behave like a worm anymore, but simply sends out plain text
e-mails which contain anti-foreigner texts, referring to Germany only.
Regards
--
Stephan Paukner <pa...@paukner.cc>
GnuPG public key ID: 0xAC6B7700
Jabber ID: paux@cargal.org
Re: Flooded by spam in German
Posted by Dirk Bonengel <di...@bonengel.de>.
Yep, the site belongs to some rightist Movement agitating against the
upcoming german imigration law.
Any Germans round here that received similar mails? According to
http://www.recht-im-internet.de/themen/spam/rechtslage.htm
this should be easy to take legal action against the person responsible.
Dirk Bonengel
John Fawcett wrote:
>From: "Simon Byrnand"
>
>
>>Anyone else suddenly (last couple of days) getting flooded with spam in
>>German ?
>>
>>So far I've been unable to get SpamAssassin to block it, despite manual
>>Bayes training. One of the spams had a link going to this page:
>>
>>http://www.deutschland-bewegung.de/weiter/zuwanderung.html
>>
>>Which when translated looks like some kind of "political" movement of some
>>sort... :/
>>
>>Unfortunately 99% of the spams are just plain text with no URL's and
>>
>>
>little
>
>
>>or no dodgy headers, so extremely hard to block.
>>
>>Anyone else having better luck ?
>>
>>Regards,
>>Simon
>>
>>
>>
>
>Yes, I'm getting hits on things like this:
>NO_REAL_NAME, PRIORITY_NO_NAME, RCVD_IN_CBL, RCVD_IN_SBL
>or RCVD_IN_SORBS
>
>John
>
>
>
Re: Flooded by spam in German
Posted by Matthias Fuhrmann <Ma...@stud.uni-hannover.de>.
On Thu, 10 Jun 2004, Matthias Fuhrmann wrote:
[...]
> in a related forum somone wrote a sa rule, capturing those subject,
> spammers are using - needs some linebreaks, or maybe done as a
> meta rule - bit too long for my taste :)
>
here is my ruleset (based one the article above). its working fine,
german shouldnt set the score too high. so you prevent poisening bayes.
(watch those linebreaks too):
# http://www.heise.de/newsticker/meldung/48135
# political german spam
header X_POLITICAL_SPAM_01 Subject =~ /^Bankrott desGesundheitswesens durch Auslaender/
describe X_POLITICAL_SPAM_01 Subject line contains political ube
header X_POLITICAL_SPAM_02 Subject =~ /^Wer an ein Tabu ruehrt, muss und darf vernichtet werden/
describe X_POLITICAL_SPAM_02 Subject line contains political ube
header X_POLITICAL_SPAM_03 Subject =~ /^EU Beitritt der Tuerkei/
describe X_POLITICAL_SPAM_03 Subject line contains political ube
header X_POLITICAL_SPAM_04 Subject =~ /^Bin ich zu weltfremd? Ich glaube wohl kaum/
describe X_POLITICAL_SPAM_04 Subject line contains political ube
header X_POLITICAL_SPAM_05 Subject =~ /^Die Deform der sozialen Ordnung/
describe X_POLITICAL_SPAM_05 Subject line contains political ube
header X_POLITICAL_SPAM_06 Subject =~ /^Augen auf\! \(So sieht es aus\!\)/
describe X_POLITICAL_SPAM_06 Subject line contains political ube
header X_POLITICAL_SPAM_07 Subject =~ /^Paradies Bundesrepublik - Rente fuer die Welt/
describe X_POLITICAL_SPAM_07 Subject line contains political ube
header X_POLITICAL_SPAM_08 Subject =~ /^Libanesen in Berlin/
describe X_POLITICAL_SPAM_08 Subject line contains political ube
header X_POLITICAL_SPAM_09 Subject =~ /^Garather klagen ueber eskalierende Gewalt im Stadtteil/
describe X_POLITICAL_SPAM_09 Subject line contains political ube
header X_POLITICAL_SPAM_10 Subject =~ /^Auslaender erschleichen sich zunehmend Sozialleistungen/
describe X_POLITICAL_SPAM_10 Subject line contains political ube
header X_POLITICAL_SPAM_11 Subject =~ /^Auslaenderkriminalitaet steigt weiter/
describe X_POLITICAL_SPAM_11 Subject line contains political ube
header X_POLITICAL_SPAM_12 Subject =~ /^Das kann unmoeglich sein -Leserbrief/
describe X_POLITICAL_SPAM_12 Subject line contains political ube
header X_POLITICAL_SPAM_13 Subject =~ /^Nein zum Zuwanderungsgesetz/
describe X_POLITICAL_SPAM_13 Subject line contains political ube
header X_POLITICAL_SPAM_14 Subject =~ /^Skandalurteil in Darmstadt/
describe X_POLITICAL_SPAM_14 Subject line contains political ube
header X_POLITICAL_SPAM_15 Subject =~ /^Auf Kosten der deutschen Beitragszahler und Rentner/
describe X_POLITICAL_SPAM_15 Subject line contains political ube
header X_POLITICAL_SPAM_16 Subject =~ /^Wir haben die Auslaender doch geholt/
describe X_POLITICAL_SPAM_16 Subject line contains political ube
header X_POLITICAL_SPAM_17 Subject =~ /^TUERKEN-TERROR AM HIMMELFAHRTSTAG/
describe X_POLITICAL_SPAM_17 Subject line contains political ube
header X_POLITICAL_SPAM_18 Subject =~ /^MULTI-KULTI-BANDE TYRANNISIERTE MITSCHUELER/
describe X_POLITICAL_SPAM_18 Subject line contains political ube
header X_POLITICAL_SPAM_19 Subject =~ /^ASYLANTEN BEGRABSCHTEN DEUTSCHES MAEDCHEN/
describe X_POLITICAL_SPAM_19 Subject line contains political ube
header X_POLITICAL_SPAM_20 Subject =~ /^Was Deutschland braucht, sind deutsche Kinder/
describe X_POLITICAL_SPAM_20 Subject line contains political ube
header X_POLITICAL_SPAM_21 Subject =~ /^Diplomatische Zensur/
describe X_POLITICAL_SPAM_21 Subject line contains political ube
header X_POLITICAL_SPAM_22 Subject =~ /^EU gibt Erwerbslosen volle Freizuegigkeit/
describe X_POLITICAL_SPAM_22 Subject line contains political ube
header X_POLITICAL_SPAM_23 Subject =~ /^Richter unterstuetzt kriminelle Auslaenderin/
describe X_POLITICAL_SPAM_23 Subject line contains political ube
header X_POLITICAL_SPAM_24 Subject =~ /^Auslaenderanteile in Schweizer Gefaengnissen/
describe X_POLITICAL_SPAM_24 Subject line contains political ube
header X_POLITICAL_SPAM_25 Subject =~ /^Neue Voelkerwanderung droht/
describe X_POLITICAL_SPAM_25 Subject line contains political ube
header X_POLITICAL_SPAM_26 Subject =~ /^Bankrott des Gesundheitswesens durch Auslaender/
describe X_POLITICAL_SPAM_26 Subject line contains political ube
header X_POLITICAL_SPAM_27 Subject =~ /^Das kann unmoeglich sein - Leserbrief/
describe X_POLITICAL_SPAM_27 Subject line contains political ube
meta X_POLITICAL_SPAM_A1 (X_POLITICAL_SPAM_01 || X_POLITICAL_SPAM_02 || X_POLITICAL_SPAM_03 || X_POLITICAL_SPAM_04)
describe X_POLITICAL_SPAM_A1 Subject line contains political ube
score X_POLITICAL_SPAM_A1 3
meta X_POLITICAL_SPAM_A2 (X_POLITICAL_SPAM_05 || X_POLITICAL_SPAM_06 || X_POLITICAL_SPAM_07 || X_POLITICAL_SPAM_08)
describe X_POLITICAL_SPAM_A2 Subject line contains political ube
score X_POLITICAL_SPAM_A2 3
meta X_POLITICAL_SPAM_A3 (X_POLITICAL_SPAM_09 || X_POLITICAL_SPAM_10 || X_POLITICAL_SPAM_11 || X_POLITICAL_SPAM_12)
describe X_POLITICAL_SPAM_A3 Subject line contains political ube
score X_POLITICAL_SPAM_A3 3
meta X_POLITICAL_SPAM_A4 (X_POLITICAL_SPAM_13 || X_POLITICAL_SPAM_14 || X_POLITICAL_SPAM_15 || X_POLITICAL_SPAM_16)
describe X_POLITICAL_SPAM_A4 Subject line contains political ube
score X_POLITICAL_SPAM_A4 3
meta X_POLITICAL_SPAM_A5 (X_POLITICAL_SPAM_17 || X_POLITICAL_SPAM_18 || X_POLITICAL_SPAM_19 || X_POLITICAL_SPAM_20)
describe X_POLITICAL_SPAM_A5 Subject line contains political ube
score X_POLITICAL_SPAM_A5 3
meta X_POLITICAL_SPAM_A6 (X_POLITICAL_SPAM_21 || X_POLITICAL_SPAM_22 || X_POLITICAL_SPAM_23 || X_POLITICAL_SPAM_24)
describe X_POLITICAL_SPAM_A6 Subject line contains political ube
score X_POLITICAL_SPAM_A6 3
meta X_POLITICAL_SPAM_A7 (X_POLITICAL_SPAM_25 || X_POLITICAL_SPAM_26 || X_POLITICAL_SPAM_27)
describe X_POLITICAL_SPAM_A7 Subject line contains political ube
score X_POLITICAL_SPAM_A7 3
regards,
Matthias
Re: Flooded by spam in German
Posted by Matthias Fuhrmann <Ma...@stud.uni-hannover.de>.
On Thu, 10 Jun 2004, John Fawcett wrote:
[...]
> >
> > John
> >
> I spoke too soon, now they're starting to break through. My guess is they're
> coming from
> exploited machines that haven't made it into blocking lists.
a german internet news site has an article about it:
http://www.heise.de/newsticker/meldung/48135
they think those spam is comming from infected win machines (sober.g)
since this morning those infected machines sending out those political
spam.
in a related forum somone wrote a sa rule, capturing those subject,
spammers are using - needs some linebreaks, or maybe done as a
meta rule - bit too long for my taste :)
http://www.heise.de/newsticker/foren/go.shtml?read=1&msg_id=5832449&forum_id=57381
regards,
Matthias
Re: Flooded by spam in German
Posted by John Fawcett <jo...@michaweb.net>.
----- Original Message -----
From: "John Fawcett" <jo...@michaweb.net>
To: <sp...@incubator.apache.org>
Sent: Thursday, June 10, 2004 8:44 AM
Subject: Re: Flooded by spam in German
> From: "Simon Byrnand"
> > Anyone else suddenly (last couple of days) getting flooded with spam in
> > German ?
> >
> > So far I've been unable to get SpamAssassin to block it, despite manual
> > Bayes training. One of the spams had a link going to this page:
> >
> > http://www.deutschland-bewegung.de/weiter/zuwanderung.html
> >
> > Which when translated looks like some kind of "political" movement of
some
> > sort... :/
> >
> > Unfortunately 99% of the spams are just plain text with no URL's and
> little
> > or no dodgy headers, so extremely hard to block.
> >
> > Anyone else having better luck ?
> >
> > Regards,
> > Simon
> >
>
> Yes, I'm getting hits on things like this:
> NO_REAL_NAME, PRIORITY_NO_NAME, RCVD_IN_CBL, RCVD_IN_SBL
> or RCVD_IN_SORBS
>
> John
>
I spoke too soon, now they're starting to break through. My guess is they're
coming from
exploited machines that haven't made it into blocking lists.
John
Re: Flooded by spam in German
Posted by John Fawcett <jo...@michaweb.net>.
From: "Simon Byrnand"
> Anyone else suddenly (last couple of days) getting flooded with spam in
> German ?
>
> So far I've been unable to get SpamAssassin to block it, despite manual
> Bayes training. One of the spams had a link going to this page:
>
> http://www.deutschland-bewegung.de/weiter/zuwanderung.html
>
> Which when translated looks like some kind of "political" movement of some
> sort... :/
>
> Unfortunately 99% of the spams are just plain text with no URL's and
little
> or no dodgy headers, so extremely hard to block.
>
> Anyone else having better luck ?
>
> Regards,
> Simon
>
Yes, I'm getting hits on things like this:
NO_REAL_NAME, PRIORITY_NO_NAME, RCVD_IN_CBL, RCVD_IN_SBL
or RCVD_IN_SORBS
John
Re: Flooded by spam in German
Posted by Ralf Hildebrandt <Ra...@charite.de>.
* Jeff Chan <je...@surbl.org>:
> >> These kinds of things could also be Joe Jobs, i.e. try to get
> >> someone's site shut down by sending spam referring to it.
>
> > Nope, since many differend German sender domains were used. E.g. ours.
>
> But the spammers could simply be using captured zombies there.
Where "there"?
--
Ralf Hildebrandt (Im Auftrag des Referat V a) Ralf.Hildebrandt@charite.de
Charite - Universitätsmedizin Berlin Tel. +49 (0)30-450 570-155
Gemeinsame Einrichtung von FU- und HU-Berlin Fax. +49 (0)30-450 570-916
IT-Zentrum Standort Campus Mitte AIM. ralfpostfix
Re: Flooded by spam in German
Posted by Jeff Chan <je...@surbl.org>.
On Friday, June 11, 2004, 4:29:46 AM, Ralf Hildebrandt wrote:
> * Jeff Chan <je...@surbl.org>:
>> These kinds of things could also be Joe Jobs, i.e. try to get
>> someone's site shut down by sending spam referring to it.
> Nope, since many differend German sender domains were used. E.g. ours.
But the spammers could simply be using captured zombies there.
Jeff C.
Re: Flooded by spam in German
Posted by Ralf Hildebrandt <Ra...@charite.de>.
* Jeff Chan <je...@surbl.org>:
> These kinds of things could also be Joe Jobs, i.e. try to get
> someone's site shut down by sending spam referring to it.
Nope, since many differend German sender domains were used. E.g. ours.
--
Ralf Hildebrandt (Im Auftrag des Referat V a) Ralf.Hildebrandt@charite.de
Charite - Universitätsmedizin Berlin Tel. +49 (0)30-450 570-155
Gemeinsame Einrichtung von FU- und HU-Berlin Fax. +49 (0)30-450 570-916
IT-Zentrum Standort Campus Mitte AIM. ralfpostfix
Re: Flooded by spam in German
Posted by Jeff Chan <je...@surbl.org>.
On Friday, June 11, 2004, 4:09:10 AM, John Hall wrote:
> "Simon Byrnand" <si...@igrin.co.nz> wrote in message
>> Anyone else suddenly (last couple of days) getting flooded with spam in
>> German ?
> It's far right propaganda:
These kinds of things could also be Joe Jobs, i.e. try to
get someone's site shut down by sending spam referring
to it.
Jeff C.
Re: Flooded by spam in German
Posted by Menno van Bennekom <mv...@xs4all.nl>.
Since these spams come from dialup/DSL's they can be blocked at the MTA
with the dynablock/dul lists. Only two times we had to whitelist somebody,
but they volunteered to sent mail through the smtp-server of their
provider so at the moment it works without exceptions.
I think because of that we didn't get that spam here, only the bounces
because our domain was used as reply-to :-((
Menno van Bennekom
ABZ
> * Stefan Hornburg <ra...@linuxia.de>:
>
>> * delivered from dialup/DSL accounts in Germany or Switzerland
>
> yes
>
>> * message-id contains qmail@
>
> yes
>
>> * user agent is Mail-SMTP
>> * missing To:-Header
>
> Never checked these two
>
> --
> Ralf Hildebrandt (Im Auftrag des Referat V a)
> Ralf.Hildebrandt@charite.de
> Charite - Universitätsmedizin Berlin Tel. +49 (0)30-450
> 570-155
> Gemeinsame Einrichtung von FU- und HU-Berlin Fax. +49 (0)30-450
> 570-916
> IT-Zentrum Standort Campus Mitte AIM.
> ralfpostfix
>
Re: Flooded by spam in German
Posted by Ralf Hildebrandt <Ra...@charite.de>.
* Stefan Hornburg <ra...@linuxia.de>:
> * delivered from dialup/DSL accounts in Germany or Switzerland
yes
> * message-id contains qmail@
yes
> * user agent is Mail-SMTP
> * missing To:-Header
Never checked these two
--
Ralf Hildebrandt (Im Auftrag des Referat V a) Ralf.Hildebrandt@charite.de
Charite - Universitätsmedizin Berlin Tel. +49 (0)30-450 570-155
Gemeinsame Einrichtung von FU- und HU-Berlin Fax. +49 (0)30-450 570-916
IT-Zentrum Standort Campus Mitte AIM. ralfpostfix
Re: Flooded by spam in German
Posted by Paolo Cravero as2594 <pc...@as2594.net>.
Stefan Hornburg wrote:
> They appear to have 4 things in common:
>
> * delivered from dialup/DSL accounts in Germany or Switzerland
Spam towards Italian accounts (.it) comes from hijacked modems/routers
in Italy. Weird!
> * message-id contains qmail@
Confirmed.
> * user agent is Mail-SMTP
No all of samples have X-Mailer header
> * missing To:-Header
To: is present in my samples.
What is annoying is... that Bayes doesn't seem to adapt to German
language! Still hitting BAYES_00 after several trainings.
Paolo
--
QRPp-I #707 + www.paolocravero.tk + I QRP #476
Beacon @ 28.3219 MHz + QRPp + QRSS3 + JN35TC
Re: Flooded by spam in German
Posted by Stefan Hornburg <ra...@linuxia.de>.
On Fri, 11 Jun 2004 12:09:10 +0100
"John Hall" <jo...@cambridgetechgroup.com> wrote:
> "Simon Byrnand" <si...@igrin.co.nz> wrote in message
> news:6.0.3.0.1.20040610135932.03a37738@pop3.igrin.co.nz...
>
> > Anyone else suddenly (last couple of days) getting flooded with spam in
> > German ?
>
> It's far right propaganda:
> http://www.theregister.co.uk/2004/06/11/german_hate_mail_virus/
They appear to have 4 things in common:
* delivered from dialup/DSL accounts in Germany or Switzerland
* message-id contains qmail@
* user agent is Mail-SMTP
* missing To:-Header
Bye
Racke
--
Upcoming Talks and Presentations:
Linuxtag 2004, 25. Juni: Courier Mail Server (http://www.linuxtag.org/)
Perlworkshop 2004, 30. Juni: Entwicklung großer Perlanwendungen
am Beispiel von Interchange (http://www.perlworkshop.de/)
Re: Flooded by spam in German
Posted by John Hall <jo...@cambridgetechgroup.com>.
"Simon Byrnand" <si...@igrin.co.nz> wrote in message
news:6.0.3.0.1.20040610135932.03a37738@pop3.igrin.co.nz...
> Anyone else suddenly (last couple of days) getting flooded with spam in
> German ?
It's far right propaganda:
http://www.theregister.co.uk/2004/06/11/german_hate_mail_virus/
John
Re: Blocking all of China
Posted by Nix <ni...@esperi.org.uk>.
On Thu, 10 Jun 2004, jdow@earthlink.net spake:
> Because there is a more time consuming but fun approach to the Chinese
> problem. If the address for a message source or relay point happens to
> fall in China (not Taiwan or Korean) you harvest the address and send
> back to that address an official looking invoice with a thank you for
> your order of 100,000 copies if the Feng Sui Handbook.
>
> I have heard this is remarkably effective.
Not as effective as an email reading, in part,
`Thank you for offering to provide the Falun Gong with financial
assistance...'
;}}}
--
`If you believe in strong AI, then death is no longer a mystery,
but merely a lack of adequate backups.' --- Steven McDougall
Re: Blocking all of China
Posted by jdow <jd...@earthlink.net>.
From: "John Andersen" <js...@pen.homeip.net>
> On Thursday 10 June 2004 07:26, Matt Kettler wrote:
> > It's not like there's one "blackholes.us" query that you use and it just
> > lists every IP. You query "verio.blackholes.us" and it tells you if the
IP
> > belongs to verio.
> >
> > It's hard to understand why this could be confusing to anyone.
>
> After stateing that so well, you ratteled on for another dozen paragraphs
> based on the premis that the OP suggested to use blackholes.us.
>
> He suggested china.blackholes.us.
> It's hard to understand why this could be confusing to anyone.
Because there is a more time consuming but fun approach to the Chinese
problem. If the address for a message source or relay point happens to
fall in China (not Taiwan or Korean) you harvest the address and send
back to that address an official looking invoice with a thank you for
your order of 100,000 copies if the Feng Sui Handbook.
I have heard this is remarkably effective.
{^_-}
Re: Blocking all of China
Posted by Greg Kopp <gk...@gregkopp.com>.
And you sir, were under the impression that I was under the impression
of making the impression ... oh whatever.
Not being the super-detailed person some would like us all to be, I was
merely pointing out that blackholes.us lists ENTIRE IP address ranges
and not ONLY those of known spammers.
I'm certain I wasn't clear and may have strayed too far from what I
meant to impress upon the impressionable people on this very impressive
list. :-)
Greg
Matt Kettler wrote:
> At 03:38 PM 6/10/2004, John Andersen wrote:
>
>> > It's hard to understand why this could be confusing to anyone.
>>
>> After stateing that so well, you ratteled on for another dozen paragraphs
>> based on the premis that the OP suggested to use blackholes.us.
>
>
> No. I rattled on under the premise that Greg Kopp, who is not the OP,
> but the person I replied to, was under the misunderstanding that by
> using blackholes.us, you'd wind up blocking whole ISPs at the whim of
> the blackholes.us maintainer.
>
>
>> He suggested china.blackholes.us.
>> It's hard to understand why this could be confusing to anyone.
>
>
> I'm aware that's what the OP suggested, but that was not the context of
> the message I replied to. I suppose it was confusing to you because you
> didn't read the bits I was quoting from Greg closely enough, such as
> this piece
>
> ">The maintainer has been known to arbitrarily list every single IP
> address belonging to some major ISPs because of past abuses."
>
> Which is the primary point raised by Greg I was responding to.
>
>
>
>
>
>
Re: Blocking all of China
Posted by Matt Kettler <mk...@evi-inc.com>.
At 03:38 PM 6/10/2004, John Andersen wrote:
> > It's hard to understand why this could be confusing to anyone.
>
>After stateing that so well, you ratteled on for another dozen paragraphs
>based on the premis that the OP suggested to use blackholes.us.
No. I rattled on under the premise that Greg Kopp, who is not the OP, but
the person I replied to, was under the misunderstanding that by using
blackholes.us, you'd wind up blocking whole ISPs at the whim of the
blackholes.us maintainer.
>He suggested china.blackholes.us.
>It's hard to understand why this could be confusing to anyone.
I'm aware that's what the OP suggested, but that was not the context of the
message I replied to. I suppose it was confusing to you because you didn't
read the bits I was quoting from Greg closely enough, such as this piece
">The maintainer has been known to arbitrarily list every single IP address
belonging to some major ISPs because of past abuses."
Which is the primary point raised by Greg I was responding to.
Re: Blocking all of China
Posted by John Andersen <js...@pen.homeip.net>.
On Thursday 10 June 2004 07:26, Matt Kettler wrote:
> It's not like there's one "blackholes.us" query that you use and it just
> lists every IP. You query "verio.blackholes.us" and it tells you if the IP
> belongs to verio.
>
> It's hard to understand why this could be confusing to anyone.
After stateing that so well, you ratteled on for another dozen paragraphs
based on the premis that the OP suggested to use blackholes.us.
He suggested china.blackholes.us.
It's hard to understand why this could be confusing to anyone.
--
_____________________________________
John Andersen
Re: Blocking all of China
Posted by Matt Kettler <mk...@comcast.net>.
At 09:23 AM 6/10/04 -0400, Greg Kopp wrote:
>IMHO, I would not use blackholes.us in a business environment. If it's for
>your own use and you don't mind people you know getting rejected mail,
>then fine.
>
>But if it is your intention to actually do business with people, and to
>have them send you e-mail, I would stay away from it.
Hmm, I use it in a business environment every day. However, I use it with
SpamAssassin rules to add small amounts of points. I'm also intelligent
about which of his lists I choose to use.
I tend to agree with you in that arbitrary use of blackholes.us is unwise,
however if you truly understand what it is, and how it works, you can use
it properly.
>The maintainer has been known to arbitrarily list every single IP address
>belonging to some major ISPs because of past abuses.
True, but he also lists them in their own separate blacklists. And it's
also the purpose of those lists to have the IPs of those ISPs in them.
It's not like there's one "blackholes.us" query that you use and it just
lists every IP. You query "verio.blackholes.us" and it tells you if the IP
belongs to verio.
It's hard to understand why this could be confusing to anyone.
Blackholes.us isn't a "abusers" list per se.. It's a factual information
listing. This IP routes to country xxx or to ISP yyy. Yes, most of the ISP
and country lists are created because of spam problems, but the nature of
the list itself is to be a blanket.
>This is not an entirely bad practice. However, personaly experience has
>shown me that small businesses and even some larger businesses are not
>going to switch ISPs because they can't send YOU mail or because thier IP
>address is listed in blackholes.us because 100 years ago a few of those
>IPs were open relays.
True, which is why I wouldn't advise using any of these lists as block
critera.
However, that ISP's tendency to have open relays 100 years ago resulted in
the creation of a list for that ISP, true.
However, the IPs that ISP uses are still the IPs that the ISP uses. That
fact doesn't change (although the exact IP blocks might). And the fact that
the IP belongs to a given ISP is the criteria for why it's in the list.
For example, I don't see why verio hosted IP addresses should be removed
from verio.blackholes.us. To do so would be a contradiction in fact.
However, I will agree that anyone who just arbitrarily grabs all the
blackholes.us lists and uses them as bounce criteria on their MTA is quite
frankly STUPID. Blackoles.us DOES blacklist entire ISPs and countries,
because that's it' purpose, and you definitely need to understand that
before applying their lists to your systems.
My own usage consists of giving 1.0-2.5 points for being listed in the IP
ranges of certain countries my company has no business with and is unlikely
to ever have business with.
This is a relatively sensible judicious use of blackholes.us in a business
environment. I'm not using it as rejection system, nor are any of them
sufficient to cause a message to be tagged as spam, but they are sufficient
for my copy of SA to effectively have a lower spam threshold for emails
coming from those countries.
And I do get some nonspam hits on the blackholes lists I'm using.
Occasionaly someone from one of the countries posts a message to one of the
mailing lists I subscribe to. However, I have yet to have them cause a
false positive. They've contributed to a FP or two on this list, but the
messages always had spam quotes which also contributed more points than any
normal message would have.
However, they've saved me from quite a handful of emails that would have
been FN.
>The maintainer has also been rumored to block major ISPs simply because he
>doesn't like them.
Well, he creates lists because he doesn't like them, or there's a community
outcry towards them. But he continues to list them because time does not
change the fact that ISP X is still ISP X.
Re: Blocking all of China
Posted by Jeff Chan <je...@surbl.org>.
On Thursday, June 10, 2004, 12:34:24 PM, John Andersen wrote:
> On Thursday 10 June 2004 05:23, Greg Kopp wrote:
>> IMHO, I would not use blackholes.us in a business environment. If it's
>> for your own use and you don't mind people you know getting rejected
>> mail, then fine.
>>
>> But if it is your intention to actually do business with people, and to
>> have them send you e-mail, I would stay away from it.
> The suggestion was (and I quote):
> You could use an RBL like china.blackholes.us in SpamAssassin
> or your MTA (Exim)."
To throw some saurkraut on the fire, that suggestion was mine,
not the original poster's...
Jeff C. the attributee... LOL!
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Blocking all of China
Posted by Bob Apthorpe <ap...@cynistar.net>.
Hi,
On Thu, 10 Jun 2004 11:34:24 -0800 John Andersen <js...@pen.homeip.net> wrote:
> On Thursday 10 June 2004 05:23, Greg Kopp wrote:
> > IMHO, I would not use blackholes.us in a business environment. If it's
> > for your own use and you don't mind people you know getting rejected
> > mail, then fine.
> >
> > But if it is your intention to actually do business with people, and to
> > have them send you e-mail, I would stay away from it.
>
> The suggestion was (and I quote):
> You could use an RBL like china.blackholes.us in SpamAssassin
> or your MTA (Exim)."
>
> Presumably the china list does not contain comcast, and vise-versa.
Maybe. You'd have to sort out how blackholes.us determines what's meant
by 'chinese' or 'comcast' (e.g. are the Chinese IP addresses allocated
to CNNIC or are they physically in China? Does the comcast list include
only ARIN allocations to Comcast? Are there addresses allocated by CNNIC
to Comcast?) This can get very confusing fast. The point is, you need to
understand the listing policy before you use them.
> How, then, would sould someone running a Tax Accountancy in East
> Midlands Texax suffer from blocking all of China?
Practically (and this is where people get offended) it might not. If
you're responsible for that mail system, and the users understand and
agree with that policy, it's nobody's business but your own what systems
you accept mail from, provided you accept mail for abuse, postmaster,
etc. per RFC2142 (see http://www.faqs.org/rfcs/rfc2142.html)
> I have most of Korea blocked. I can't read a word of Korean.
Conversely, I've received unsolicited but professionally useful (and
welcome) personal mail from an engineer in Poland based on a paper on
risk assessment I wrote a few years ago. I know about 12 words in
Polish, all of them related to food, courtesy of my grandmother (may she
rest in peace.) Life may surprise you.
As usual, your system, your rules. :)
-- Bob
RE: Blocking all of China
Posted by "Colin A. Bartlett" <sp...@colinabartlett.com>.
David B Funk Sent: Thursday, June 10, 2004 4:09 PM
> Not everything comming out of China/Korea is in Chinese/Korean.
>
> I've seen a fair amount of spam (in English) which had domain names (both
in
> the mail headers and in URLs in the body) that are registered to US
companies
> but are being sent from Chinese ISPs.
Isn't that the point!? Since he has no legitimate business in China, he
could block all Chinese ISPs, thereby cutting back on spam. If the guy wants
to block China I say go for it. He's the only one who will take the heat for
it if some legit mail is dropped.
I would never do that here because we are a service proider and I have no
idea what business dealings my clients have. Actually, to the contrary, I
know that one of my clients does indeed use manufacturers in China.
cheers,
Colin
Colin A. Bartlett
Kinetic Web Solutions
www.kineticweb.biz
Re: Blocking all of China
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Thu, 10 Jun 2004, John Andersen wrote:
> How, then, would sould someone running a Tax Accountancy in East
> Midlands Texax suffer from blocking all of China?
>
> I have most of Korea blocked. I can't read a word of Korean.
Not everything comming out of China/Korea is in Chinese/Korean.
In this globalized economy rife with outsourcing, it's not at all
impossible that the ISP that your Texas Taxman contracts to provide
him website/mailing lists hosting may actually be located in China.
I've seen a fair amount of spam (in English) which had domain names
(both in the mail headers and in URLs in the body) that are registered
to US companies but are being sent from Chinese ISPs.
Bulk hosting is now international business. I've seen Russian spam
being sent from Chinese ISPs, English spam hosted from Russia, etc.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Blocking all of China
Posted by John Andersen <js...@pen.homeip.net>.
On Thursday 10 June 2004 05:23, Greg Kopp wrote:
> IMHO, I would not use blackholes.us in a business environment. If it's
> for your own use and you don't mind people you know getting rejected
> mail, then fine.
>
> But if it is your intention to actually do business with people, and to
> have them send you e-mail, I would stay away from it.
The suggestion was (and I quote):
You could use an RBL like china.blackholes.us in SpamAssassin
or your MTA (Exim)."
Presumably the china list does not contain comcast, and vise-versa.
How, then, would sould someone running a Tax Accountancy in East
Midlands Texax suffer from blocking all of China?
I have most of Korea blocked. I can't read a word of Korean.
--
_____________________________________
John Andersen
Re: Blocking all of China
Posted by Jeff Chan <je...@surbl.org>.
On Thursday, June 10, 2004, 6:23:18 AM, Greg Kopp wrote:
> IMHO, I would not use blackholes.us in a business environment. If it's
> for your own use and you don't mind people you know getting rejected
> mail, then fine.
> But if it is your intention to actually do business with people, and to
> have them send you e-mail, I would stay away from it.
FWIW I feel the same way. blackholes.us may be ok for personal
use, but almost never for business use.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Blocking all of China
Posted by Dimitrios <se...@altered.com>.
On Thu, 10 Jun 2004 11:10:59 -0400 "Greg Kopp" <gk...@gregkopp.com> wrote:
> I'm not saying he is doing anything wrong and to a certain degree
> applaud his efforts. I just wanted the original poster to be aware.
well, this guy definetly has some attitute ;)
i haven't used his lists, but now you've raised my curiosity so i'll take a look.
Re: Blocking all of China
Posted by Greg Kopp <gk...@gregkopp.com>.
Bob,
Very will put. The problem comes with stated policies and the like. Here
is an excerpt:
"If you are listed, you will not be removed from these lists. If your
mail is being rejected, contact your ISP. If you don't understand what
this site is or why you are listed, please contact your ISP before
sending mail to the administrator of this site.
Legal threats will be made public. In fact, no email sent to this domain
is confidential without prior arrangement and may be published as I see fit.
Please delete any "legaleeze" or copyright footers from your mail before
sending it. You may not send any material to blackholes.us for which
there is a copyright claim.
Depending on how much time I have to spare, I may not reply to you."
And
"Blackholes.us does not list spammers, spam supporters or vulnerable
hosts at the present time. These lists are meant to contain all known
networks assigned or allocated to the respective provider or
organizations within the respective country. Lists are created for
research purposes, primarily, and are made public for any use others see
fit."
He does make good on his claim that he will make e-mails sent to him
public. There are several on the site.
My point is, he has no real policies other than - "If you're listed, too
bad, call your ISP." And if you read between the lines: "Change ISPs." I
am assuming he does this on his own and there is no "organization"
behind it. Services like MAPS and SpamCop at least go through a
procedure BEFORE listing someone and have stated procedures to be
removed. I personally don't agree with throwing the baby out with the
bathwater, so to speak. If it wasn;t for the fact that we have a couple
clients that do business in China, I would be using china.blackholes.us. :-)
I'm not saying he is doing anything wrong and to a certain degree
applaud his efforts. I just wanted the original poster to be aware.
Bob Apthorpe wrote:
> Hi,
>
> On Thu, 10 Jun 2004 09:23:18 -0400 Greg Kopp <gk...@gregkopp.com> wrote:
>
>
>>IMHO, I would not use blackholes.us in a business environment. If it's
>>for your own use and you don't mind people you know getting rejected
>>mail, then fine.
>
>
> The .blackholes.us zones list large swaths of network space which is
> what you'd expect of a zone that listed all of, say, China.
>
>
>>But if it is your intention to actually do business with people, and to
>>have them send you e-mail, I would stay away from it.
>
>
> At least know what you're getting into. One might be able to whitelist
> specific contacts and blackhole the rest, depending on who one intends
> to correspond with.
>
>
>>The maintainer has been known to arbitrarily list every single IP
>>address belonging to some major ISPs because of past abuses.
>
>
> I don't believe it's arbitrary and it may have nothing to do with abuse.
> If the intent is to list all known network space of Comcast or Cogentco
> for example, it makes perfect sense. Now, why he chooses to create a
> zonefile for Comcast vs XS4ALL or Chello may be due to abuse; I don't
> know. What's more important is that the listings are accurate.
>
>
>>This is not an entirely bad practice. However, personaly experience has
>>shown me that small businesses and even some larger businesses are not
>>going to switch ISPs because they can't send YOU mail or because thier
>>IP address is listed in blackholes.us because 100 years ago a few of
>>those IPs were open relays.
>
>
> If you're trying to change people's behavior, using a DNSBL is probably
> not the way to do it. However, if enough people reject traffic such that
> a particular organization (country, ISP, etc.) finds itself isolated
> into a virtual intranet, there's a possibility they'll change, if the
> value of connecting to those that block them exceeds the cost of
> change. From a network operator's viewpoint, one has to determine if the
> benefit of accepting traffic from Cogentco, Chinanet, or Comcast (for
> example) is worth the cost (in terms of abuse and security incidents,
> etc.) That is, one should block to preserve the limited resources you're
> responsible for providing with no expecatation that anyone's behavior
> will change as a result.
>
>
>>The maintainer has also been rumored to block major ISPs simply because
>>he doesn't like them.
>
>
> What mail he accepts or rejects is his business. Our only concern should
> be the accuracy of the zone files he publishes.
>
> In order to use DNSBLs effectively, you need to clearly understand the
> blacklist operator's listing policy as well as your own policy, and have
> a reasonable belief that the blacklist operator will follow their stated
> policy.
>
> I haven't heard of blackholes.us deviating from their stated policies;
> then again, I don't use their blacklists. If I did, I'd probably use
> them within SA rather than to block at the MTA or firewall level.
>
> Caveat utilitor,
>
> -- Bob
Re: sa-stats.pl and amavisd-new
Posted by Andy <an...@stronzo.d2g.com>.
Hello Matt,
I am using amavis-stats, which gives me some very nice graphs of spam,
non-spam, viruses, blocked etc. mails.
If you want to look:
https://stronzo.d2g.com/amavis-stats
--
Andy
Hi, I am looking for a script that will tell me the number of hams/spams and
their average scores. When I run sa-stats.pl it reports that no messages
have been scanned. It looks like the script is expecting to find "clean
message" or "identified spam" in the the maillog...
Is there a version of sa-stats.pl that works with the maillog generated by
amavisd-new/postfix?
Thanks,
-- Matt
Re: Blocking all of China
Posted by Bob Apthorpe <ap...@cynistar.net>.
Hi,
On Thu, 10 Jun 2004 09:23:18 -0400 Greg Kopp <gk...@gregkopp.com> wrote:
> IMHO, I would not use blackholes.us in a business environment. If it's
> for your own use and you don't mind people you know getting rejected
> mail, then fine.
The .blackholes.us zones list large swaths of network space which is
what you'd expect of a zone that listed all of, say, China.
> But if it is your intention to actually do business with people, and to
> have them send you e-mail, I would stay away from it.
At least know what you're getting into. One might be able to whitelist
specific contacts and blackhole the rest, depending on who one intends
to correspond with.
> The maintainer has been known to arbitrarily list every single IP
> address belonging to some major ISPs because of past abuses.
I don't believe it's arbitrary and it may have nothing to do with abuse.
If the intent is to list all known network space of Comcast or Cogentco
for example, it makes perfect sense. Now, why he chooses to create a
zonefile for Comcast vs XS4ALL or Chello may be due to abuse; I don't
know. What's more important is that the listings are accurate.
> This is not an entirely bad practice. However, personaly experience has
> shown me that small businesses and even some larger businesses are not
> going to switch ISPs because they can't send YOU mail or because thier
> IP address is listed in blackholes.us because 100 years ago a few of
> those IPs were open relays.
If you're trying to change people's behavior, using a DNSBL is probably
not the way to do it. However, if enough people reject traffic such that
a particular organization (country, ISP, etc.) finds itself isolated
into a virtual intranet, there's a possibility they'll change, if the
value of connecting to those that block them exceeds the cost of
change. From a network operator's viewpoint, one has to determine if the
benefit of accepting traffic from Cogentco, Chinanet, or Comcast (for
example) is worth the cost (in terms of abuse and security incidents,
etc.) That is, one should block to preserve the limited resources you're
responsible for providing with no expecatation that anyone's behavior
will change as a result.
> The maintainer has also been rumored to block major ISPs simply because
> he doesn't like them.
What mail he accepts or rejects is his business. Our only concern should
be the accuracy of the zone files he publishes.
In order to use DNSBLs effectively, you need to clearly understand the
blacklist operator's listing policy as well as your own policy, and have
a reasonable belief that the blacklist operator will follow their stated
policy.
I haven't heard of blackholes.us deviating from their stated policies;
then again, I don't use their blacklists. If I did, I'd probably use
them within SA rather than to block at the MTA or firewall level.
Caveat utilitor,
-- Bob
Re: Blocking all of China
Posted by Greg Kopp <gk...@gregkopp.com>.
IMHO, I would not use blackholes.us in a business environment. If it's
for your own use and you don't mind people you know getting rejected
mail, then fine.
But if it is your intention to actually do business with people, and to
have them send you e-mail, I would stay away from it.
The maintainer has been known to arbitrarily list every single IP
address belonging to some major ISPs because of past abuses.
This is not an entirely bad practice. However, personaly experience has
shown me that small businesses and even some larger businesses are not
going to switch ISPs because they can't send YOU mail or because thier
IP address is listed in blackholes.us because 100 years ago a few of
those IPs were open relays.
The maintainer has also been rumored to block major ISPs simply because
he doesn't like them.
Greg
Jeff Chan wrote:
> On Thursday, June 10, 2004, 5:38:25 AM, Hirotaka Fox wrote:
>
>>/Also, apparently 70 percent of spam is sent from China by American spam
>>outfits who in turn have hosting arrangements with Chinese ISPs."/
>
>
>>Does anyone have a SpamAssassin related way to block all of China? I
>>read things like this on SpamHaus and just want to block all of China
>>from sending my company mail. We don't have any business dealings in China.
>
>
> You could use an RBL like china.blackholes.us in SpamAssassin
> or your MTA (Exim).
>
> http://www.blackholes.us/
>
> If you truly want to drop them on the floor and never see them,
> doing it in the MTA is far more efficient than doing it in SA.
> However doing it in SA lets you score it rather than instantly
> discarding which the MTA does.
>
> Jeff C.
Re: Blocking all of China
Posted by Jeff Chan <je...@surbl.org>.
On Thursday, June 10, 2004, 5:38:25 AM, Hirotaka Fox wrote:
> /Also, apparently 70 percent of spam is sent from China by American spam
> outfits who in turn have hosting arrangements with Chinese ISPs."/
> Does anyone have a SpamAssassin related way to block all of China? I
> read things like this on SpamHaus and just want to block all of China
> from sending my company mail. We don't have any business dealings in China.
You could use an RBL like china.blackholes.us in SpamAssassin
or your MTA (Exim).
http://www.blackholes.us/
If you truly want to drop them on the floor and never see them,
doing it in the MTA is far more efficient than doing it in SA.
However doing it in SA lets you score it rather than instantly
discarding which the MTA does.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Blocking all of China
Posted by Hirotaka Fox <hi...@yahoo.com>.
/Also, apparently 70 percent of spam is sent from China by American spam
outfits who in turn have hosting arrangements with Chinese ISPs."/
Does anyone have a SpamAssassin related way to block all of China? I
read things like this on SpamHaus and just want to block all of China
from sending my company mail. We don't have any business dealings in China.
Hirotaka
RE: Flooded by spam in German
Posted by David Hooton <dj...@platformhosting.com>.
> -----Original Message-----
> From: Simon Byrnand [mailto:simon@igrin.co.nz]
> Sent: Thursday, 10 June 2004 12:14 PM
> To: spamassassin-users@incubator.apache.org
> Subject: Flooded by spam in German
>
> Anyone else suddenly (last couple of days) getting flooded with spam in
> German ?
We're marking most of it as spam now by adding the following ruleset (may
wrap):
header __GERMAN_SPAM_O_RAMA_01 X-Priority =~ /3 \(Normal\)/
header __GERMAN_SPAM_O_RAMA_02 Importance =~ /Normal/
header __GERMAN_SPAM_O_RAMA_03 MIME-Version =~ /1\.0/
header __GERMAN_SPAM_O_RAMA_04 Content-Transfer-Encoding =~ /7bit/
header __GERMAN_SPAM_O_RAMA_05 Content-Type =~ /text\/plain\;
charset\=\"us\-ascii\"/
meta GERMAN_SPAM_O_RAMA_01 (__GERMAN_SPAM_O_RAMA_01 &&
__GERMAN_SPAM_O_RAMA_02 && __GERMAN_SPAM_O_RAMA_03 &&
__GERMAN_SPAM_O_RAMA_04 && __GERMAN_SPAM_O_RAMA_05 )
describe GERMAN_SPAM_O_RAMA_01 German Political Spam
I have scored this moderately so that we can watch for any possible false
positives which I'm sure there may well be, but combining our bayes training
and this ruleset we're hitting them pretty well.
Once again - this has not been tested against any corpus etc so use at your
own risk..
Regards,
Dave
========================================================================
Pain free spam & virus protection by: www.mailsecurity.net.au
Forward undetected SPAM to: spam@mailsecurity.net.au
========================================================================