Google groups spam

[JC Putter <jc...@centreweb.co.za>]

i am getting spam from google groups

my only is is 0.5 FREEMAIL_FROM

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1238042388; bh=qIS1L4iJc6kS4EAxGGA7apkYn+LwwewDsELAo62Dcak=; h=Message-ID:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=coeLPEfdbLl2Ig4TFp32RXGnt7XFXN6jCjnKMOuT5alLSf95saEPX7QpRXPwRM9szfyGhexZDpNeAdedQl9R8O5NzCItwPH1MiBNahzDiHSFlMAQ2Op4AfMFWyDAvTCIdNAIUZ/ZCNdNweCk+m18OvC7+aPtXqNu1FlzUkmDW5U=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.com;
  h=Message-ID:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;
  b=omde1HhUPO/Yv4E0WxLDIZM3Tm/kWcpzlI+JZuU5WS7W5E6fNxmpce78CJtMsUMktITBL17QLO7aB37/lSvnvSH/pHha+oHE/BChq44wF/fMXBgicPIfOockc1saRFomTQ1svt5pmfTDzpaap5PP4fRaHSeT0TKlTi2ci/+qdX8=;
Message-ID: <32...@web43503.mail.sp1.yahoo.com>
Received: from [200.92.27.171] by web43503.mail.sp1.yahoo.com via HTTP; Wed, 25 Mar 2009 21:39:48 PDT
X-Mailer: YahooMailClassic/5.1.20 YahooMailWebService/0.7.289.1
Date: Wed, 25 Mar 2009 21:39:48 -0700 (PDT)
From: Jeff Roland <te...@yahoo.com>
Subject: Amateur sluts in juicy action with beasts
To: damdelouise3@yahoo.com, jcputter@centreweb.co.za,
  antiganboy17@hotmail.com, db_hypnotiq@hotmail.com, chrisrobison1@mac.com
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-centreweb_co_za-MailScanner-Information: Please contact the ISP for more information
X-centreweb_co_za-MailScanner-ID: 53A6037EF19.5E10D
X-centreweb_co_za-MailScanner: Found to be clean
X-centreweb_co_za-MailScanner-From: telexedyplutons@yahoo.com
X-Spam-Status: No
Old-X-EsetId: 4B64842AE47139695462847DE92575
X-EsetId: 4B64842AE47139695462847DE92575
X-EsetScannerBuild: 4669

# google group URL contains ..
uri      NN_GOOGLE_GROUP_DD  m'www\.google\.com/.*\.\..*/group/'i
describe NN_GOOGLE_GROUP_DD  Link to a Google group contains '..'
score    NN_GOOGLE_GROUP_DD  4

# google group url contains question mark
uri      NN_GOOGLE_GROUP_QM  m'google\.com/.*group/[^?]{6,}\?[^?]{6}'i
describe NN_GOOGLE_GROUP_QM  Highly suspect link to a google group
score    NN_GOOGLE_GROUP_QM  4

uri      __GOOGLEGROUPS_15  m'http://[^.]{15}\.googlegroups\.com'i
uri      __GOOGLEGROUPS_NUM m'http://[^.]*[0-9][^.]*\.googlegroups\.com'i
meta     NN_GOOGLEGROUPS_15 __GOOGLEGROUPS_15 && __GOOGLEGROUPS_NUM
describe NN_GOOGLEGROUPS_15  Contains a suspicious googlegroups URI.
score    NN_GOOGLEGROUPS_15 2



__________ Information from ESET NOD32 Antivirus, version of virus signature database 3963 (20090325) __________

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Re: Google groups spam

[Yet Another Ninja <sa...@alexb.ch>]

On 3/26/2009 9:44 AM, JC Putter wrote:
> i am getting spam from google groups
> 
> my only is is 0.5 FREEMAIL_FROM

http://www.rulesemporium.com/rules/90_2tld.cf

helps quite a bit

afaik, sa-update will keep it updated via Daryl's channel.

Re: Google groups spam

[Benny Pedersen <me...@junc.org>]

On Thu, March 26, 2009 09:44, JC Putter wrote:
> i am getting spam from google groups
> my only is is 0.5 FREEMAIL_FROM
> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com;
> s=s1024; t=1238042388;

dont abuse google, its dkim signed at yahoo.com :)

-- 
http://localhost/ 100% uptime and 100% mirrored :)

Re: Google groups spam

[Karsten Bräckelmann <gu...@rudersport.de>]

On Thu, 2009-03-26 at 10:44 +0200, JC Putter wrote:
> i am getting spam from google groups

Oh, come on -- feel free to actually talk to us, mention details, and
maybe even ask a real question... ;)


[snipp headers]

Please do NOT paste raw messages, snippets or full headers here. Please
DO use a pastebin or your web server to upload the full, raw message,
including headers *and* body, and provide a link.

[snipp uri rules]

Useless, since you didn't provide the raw body, but headers only.


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}