You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Mynabbler <my...@live.com> on 2009/08/29 15:41:00 UTC
Porn-portal spammers
I am getting rather tired from messages spamming porn-portals. They typically
originate from hotmail.com, and advertise a porn-portal based on
google.com/groups, google.com/reader, groups.yahoo.com, pipes.yahoo.com,
spaces.live.com, docs.google.com, sites.google.com and livejournal.com.
Up until now the vermin could be stopped decently by checking the subject
(with obvious porn related terms or farm/animal related subjects) and the
existence of a URL pointing to one of these portalproviders. But the vermin
has (as always) adapted. They now toss gibberish in the subject line,
creating subjects like "f,arm ani,mals get the taste of real har,dc,ore". If
made an example available here:
http://pastebin.com/m5c18ffdd
The combo 'Portal link found' and subject could still be used, provided I
have a rule that is able to count the number of comma's in a subject. Is
there a way to do such a thing?
--
View this message in context: http://www.nabble.com/Porn-portal-spammers-tp25203019p25203019.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
RE: Porn-portal spammers
Posted by Benny Pedersen <me...@junc.org>.
On tir 01 sep 2009 16:55:06 CEST, R-Elists wrote
> at what stage are you dealing with SPF here?
http://www.openspf.org/Software
> mta? or mta and SA?
postfix stage
> can you give example config so we can see some clarity on what you
> are doing in regards to them?
pypolicyd-spf have commented example config that is easy to follow, in
sa i just monitor spf that are not spf pass, if there is some domains
add them to pypolicyd-spf (Reject_Not_Pass_Domains)
and last whitelist in pypolicyd known forwarders !
--
xpoint
RE: Porn-portal spammers
Posted by R-Elists <li...@abbacomm.net>.
> if spf_pass yes :-)
>
> reject neotral and softfail for hotmail.com reduce it nicely
> here without reject valid mail from hotmail, oh yes there is
> still spam sent from hotmail that gets pass, but then its
> surely more easy to complain it was not me
>
benny,
at what stage are you dealing with SPF here?
mta? or mta and SA?
can you give example config so we can see some clarity on what you are doing
in regards to them?
- rh
Re: Porn-portal spammers
Posted by Benny Pedersen <me...@junc.org>.
On tir 01 sep 2009 01:10:06 CEST, LuKreme wrote
> I used to score mail from hotmail at 3.0... might be time to do
> that again.
if spf_pass yes :-)
reject neotral and softfail for hotmail.com reduce it nicely here
without reject valid mail from hotmail, oh yes there is still spam
sent from hotmail that gets pass, but then its surely more easy to
complain it was not me
--
xpoint
Re: Porn-portal spammers
Posted by LuKreme <kr...@kreme.com>.
On 31-Aug-2009, at 07:11, Mynabbler wrote:
> Comment by the hotmail abuse desk on a previous attempt to close the
> gate
> upstream: we are not responsable for the content on yahoo groups and
> our
> users communicating about it. Pfff. k-thank-you-bye-bye. :( At the
> moment
> the source is primarily hotmail, although other addresses have been
> used
> during the last two months
I used to score mail from hotmail at 3.0... might be time to do that
again.
--
I want a refund, I want a light, I want a reason for all this night
after night after night after night
Re: Porn-portal spammers
Posted by Mynabbler <my...@live.com>.
LuKreme wrote:
>
> On 29-Aug-2009, at 07:41, Mynabbler wrote:
>> They typically originate from hotmail.com,
>
> Er, do they really originate from hotmail servers, or are they simply
> spoofing a hotmail return address? Are you using zen?
>
Ow yes. Zen is not an option.
Aug 31 14:52:04 mail filter[22000]: n7VCpx0l031457: Spamassassin found from
<pr...@hotmail.com> at snt0-omc2-s10.snt0.hotmail.com [65.55.90.85]
HELO snt0-omc2-s10.snt0.hotmail.com to <victim> hits: 9.52, names:
FREEMAIL_FROM,PORTAL_ABUSE
Subject: amanda righetti showing her nice big tits
This one had a yahoo groups portal link... Genuine hotmail originated crap.
Aug 31 14:57:19 mail filter[23165]: n7VCvEnb030505: Spamassassin found from
<ch...@hotmail.com> at blu0-omc3-s32.blu0.hotmail.com [65.55.116.107]
HELO blu0-omc3-s32.blu0.hotmail.com to <anothervictim> hits: 12.206, names:
FREEMAIL_FROM,PORTAL_ABUSE,TRACKER_ID
Subject: GorgeousCelebrityShowsHerNicePussyAndPerfectBoobs
and that one has a livejournal link, brought to us by the same fine company.
Comment by the hotmail abuse desk on a previous attempt to close the gate
upstream: we are not responsable for the content on yahoo groups and our
users communicating about it. Pfff. k-thank-you-bye-bye. :( At the moment
the source is primarily hotmail, although other addresses have been used
during the last two months.
So, PORTAL_ABUSE is a meta consisting of the existence of a link to a portal
provider in the message, and a slew of trics to be found in the subject,
regardless of the source being either hotmail or some poor sod giving his
credentials to a spammer.
--
View this message in context: http://www.nabble.com/Porn-portal-spammers-tp25203019p25223292.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Porn-portal spammers
Posted by LuKreme <kr...@kreme.com>.
On 29-Aug-2009, at 07:41, Mynabbler wrote:
> I am getting rather tired from messages spamming porn-portals. They
> typically
> originate from hotmail.com,
Er, do they really originate from hotmail servers, or are they simply
spoofing a hotmail return address? Are you using zen?
--
A: You're wrong
Q: I've never found that to be true
A: Because it make following messages more difficult
Q: Why is top-posting evil?
Re: Porn-portal spammers
Posted by Mynabbler <my...@live.com>.
Karsten Bräckelmann-2 wrote:
>
> Yes, it is indeed likely prone to FPs on its own, unless very strictly
> meta'ed for some special cases, and it actually also is likely bound to
> expire soon. Obfuscation techniques like this usually are subject to
> change, quite rapidly, and I'd bet you'll soon find yourself playing
> whack-a-mole.
>
You are correct about FPs on its own, that is why I meta'ed the ruleset with
the existence of a URL to these portal providers. And you are correct about
obfuscation techniques: the amount of changes is fairly high, but slow
enough to be helpful in fighting it. And to prevent the whack-a-mole battle
I lined up rulesets for a fair amount of expectable crap. Here's a recent
change:
Aug 29 21:46:24 mail filter[22469]: n7TJkJ03026851: Spamassassin found from
<ho...@hotmail.com> at blu0-omc3-s14.blu0.hotmail.com
[65.55.116.89] HELO blu0-omc3-s14.blu0.hotmail.com to <victim> hits: 10.168,
names: FREEMAIL_FROM,PORTAL_ABUSE,HTML_MESSAGE
Subject: Seeixy brunette fu-icks and suuicks on camera
--
View this message in context: http://www.nabble.com/Porn-portal-spammers-tp25203019p25205909.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Porn-portal spammers
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Sat, 2009-08-29 at 10:15 -0700, an anonymous Nabble user wrote:
> Karsten Bräckelmann wrote:
> > tflags __COMMA multiple
> > meta __COMMA_4 __COMMA >= 4
>
> Works wonders. I chose three, and was almost inclined to score on just this
> rule, if it wasn't for people discussing Dave Dee, Dozy, Beaky, Mick & Tich
> :) It scores however on non-intended fudder like "Purify, Clense, Look
> Better, Feel Better" and a Google Reader hit.
That was an example, demonstrating the tflags multiple option with your
very request for "a rule that is able to count the number of comma's in
a subject".
I probably should have added that I didn't even look at your sample, but
merely explained how to do exactly what you asked for. :)
Yes, it is indeed likely prone to FPs on its own, unless very strictly
meta'ed for some special cases, and it actually also is likely bound to
expire soon. Obfuscation techniques like this usually are subject to
change, quite rapidly, and I'd bet you'll soon find yourself playing
whack-a-mole.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Porn-portal spammers
Posted by RW <rw...@googlemail.com>.
On Sat, 29 Aug 2009 10:15:56 -0700 (PDT)
Mynabbler <my...@live.com> wrote:
>
>
> Karsten Bräckelmann-2 wrote:
> >
> > header __COMMA Subject =~ /,/
> > tflags __COMMA multiple
> > meta __COMMA_4 __COMMA >= 4
> >
>
> Works wonders. I chose three, and was almost inclined to score on
> just this rule, if it wasn't for people discussing Dave Dee, Dozy,
> Beaky, Mick & Tich :) It scores however on non-intended fudder like
> "Purify, Clense, Look Better, Feel Better" and a Google Reader hit.
IMO it would be better to only count commas that are followed by
non-whitespace.
Re: Porn-portal spammers
Posted by John Hardin <jh...@impsec.org>.
On Sat, 29 Aug 2009, Mynabbler wrote:
> Karsten Bräckelmann-2 wrote:
>
>> header __COMMA Subject =~ /,/
>> tflags __COMMA multiple
>> meta __COMMA_4 __COMMA >= 4
>
> Works wonders. I chose three, and was almost inclined to score on just this
> rule, if it wasn't for people discussing Dave Dee, Dozy, Beaky, Mick & Tich
hence my suggestion...
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Why do liberals reject fascism but embrace communism?
-----------------------------------------------------------------------
49 days since a sunspot last seen - EPA blames CO2 emissions
Re: Porn-portal spammers
Posted by Mynabbler <my...@live.com>.
Karsten Bräckelmann-2 wrote:
>
> header __COMMA Subject =~ /,/
> tflags __COMMA multiple
> meta __COMMA_4 __COMMA >= 4
>
Works wonders. I chose three, and was almost inclined to score on just this
rule, if it wasn't for people discussing Dave Dee, Dozy, Beaky, Mick & Tich
:) It scores however on non-intended fudder like "Purify, Clense, Look
Better, Feel Better" and a Google Reader hit.
As for the suggestion to run an RFC-ignorant check on hotmail.com... Another
solution in that category would be starting a blacklist giving a hit on ipv4
range 0.0.0.0 to 255.255.255.255...
--
View this message in context: http://www.nabble.com/Porn-portal-spammers-tp25203019p25204657.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Porn-portal spammers
Posted by John Hardin <jh...@impsec.org>.
On Sat, 29 Aug 2009, Karsten Br�ckelmann wrote:
> On Sat, 2009-08-29 at 06:41 -0700, an anonymous Nabble user wrote:
>> The combo 'Portal link found' and subject could still be used, provided
>> I have a rule that is able to count the number of comma's in a subject.
>> Is there a way to do such a thing?
>
> header __COMMA Subject =~ /,/
> tflags __COMMA multiple
>
> meta __COMMA_4 __COMMA >= 4
It would be less FP-prone to do this:
header __COMMA Subject =~ /\w,\w/
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
49 days since a sunspot last seen - EPA blames CO2 emissions
Re: Porn-portal spammers
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Sat, 2009-08-29 at 06:41 -0700, an anonymous Nabble user wrote:
> The combo 'Portal link found' and subject could still be used, provided I
> have a rule that is able to count the number of comma's in a subject. Is
> there a way to do such a thing?
header __COMMA Subject =~ /,/
tflags __COMMA multiple
meta __COMMA_4 __COMMA >= 4
The tflags multiple makes the rule count the number of matches, in this
simple case the number of commas in the Subject. The second non-scoring
sub-rule is true, if there are at least 4 of them, and can be used for
your desired meta.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Porn-portal spammers
Posted by Benny Pedersen <me...@junc.org>.
On Sat 29 Aug 2009 03:41:00 PM CEST, Mynabbler wrote
> http://pastebin.com/m5c18ffdd
>
> The combo 'Portal link found' and subject could still be used, provided I
> have a rule that is able to count the number of comma's in a subject. Is
> there a way to do such a thing?
http://rfc-ignorant.org/tools/lookup.php?domain=live.com
make more meta on this, abuse postmaster is subtests, combine when
both abuse postmaster hits with your rule
else make a subject regexp, but it will change as you say, my way is
better since it will not change :)
--
xpoint
Re: Porn-portal spammers
Posted by MySQL Student <my...@gmail.com>.
Hi,
> I am getting rather tired from messages spamming porn-portals. They typically
> originate from hotmail.com, and advertise a porn-portal based on
> google.com/groups, google.com/reader, groups.yahoo.com, pipes.yahoo.com,
> spaces.live.com, docs.google.com, sites.google.com and livejournal.com.
This was posted by Martin a week or so ago in response to a similar
question by me:
This should catch your set and more:
uri LOC_YAHOO /^http:.{1,40}\.yahoo[.,]com/i
score LOC_YAHOO 0 1.5 0 1.5
describe LOC_YAHOO Contains *.yahoo.com uri
Or, if you want to be more specific, try this:
uri LOC_YAHOO /^http:\/\/(groups|profile|personals)\.yahoo[.,]com/i
score LOC_YAHOO 0 1.5 0 1.5
describe LOC_YAHOO Contains yahoo.com groups/profile/personals uri
Does this help?
Best regards,
Alex