You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Paul Cabot <pa...@topguncomputers.com> on 2011/10/15 23:32:07 UTC
Recieving email from aol or yahoo or hotmail, that is not addressed
to me personally.
I've noticed a trend recently where I'm getting emails sent to me from
either an aol or yahoo or hotmail account. But the email has a "to"
address to some other account that is not mine.
First off I'm paul@topguncomputers.com. I also run the postfix servers.
Usually my spam score is about 1.3-2.0. This actually hit a higher
score. The body of the emails are always scrambled with some url in
the middle.
Is there any way of blocking emails sent to me that are not really
addressed to me. I've looked through the postfix docs, but can't find
anything.
Thanks :)
Return-Path:<le...@aol.com>
Delivered-To: paul@topguncomputers.com
Received: from srv1.topguncomputers.com (srv2.topguncomputers.com [10.181.74.163])
by srv1.topguncomputers.com (Postfix) with ESMTP id 2933D38143
for<pa...@topguncomputers.com>; Sat, 15 Oct 2011 13:47:53 -0700 (PDT)
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
srv2.topguncomputers.com
X-Spam-Level: ****
X-Spam-Status: No, score=4.2 required=5.0 tests=DATE_IN_FUTURE_06_12,
MSGID_FROM_MTA_HEADER,RCVD_IN_DNSWL_NONE,RCVD_IN_SORBS_WEB,RP_MATCHES_RCVD,
SPF_PASS,SUBJ_ALL_CAPS,URIBL_BLACK,URIBL_SBL autolearn=disabled version=3.3.1
X-Spam-Report:
* -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
* trust
* [64.12.207.147 listed in list.dnswl.org]
* 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server
* [64.12.207.147 listed in dnsbl.sorbs.net]
* 1.6 SUBJ_ALL_CAPS Subject is all capitals
* -0.0 SPF_PASS SPF: sender matches SPF record
* 0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
* -0.5 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
* 1.8 URIBL_BLACK Contains an URL listed in the URIBL blacklist
* [URIs: ripway.com]
* 0.6 URIBL_SBL Contains an URL listed in the SBL blocklist
* [URIs: ripway.com]
* 0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay
Received: from ims-m14.mx.aol.com (ims-m14.mx.aol.com [64.12.207.147])
by srv1.topguncomputers.com (Postfix) with ESMTP id 0DC9138137
for<pa...@topguncomputers.com>; Sat, 15 Oct 2011 13:47:49 -0700 (PDT)
Received: from oms-mb04.r1000.mx.aol.com (oms-mb04.r1000.mx.aol.com [64.12.102.140])
by ims-m14.mx.aol.com (8.14.1/8.14.1) with ESMTP id p9FKlX9R010499;
Sat, 15 Oct 2011 16:47:33 -0400
Message-Id:<20...@ims-m14.mx.aol.com>
Received: from mtaout-ma02.r1000.mx.aol.com (mtaout-ma02.r1000.mx.aol.com [172.29.41.2])
by oms-mb04.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id CAC701C000086;
Sat, 15 Oct 2011 16:47:33 -0400 (EDT)
Received: from hmeuksegzz (unknown [85.12.240.121])
by mtaout-ma02.r1000.mx.aol.com (MUA/Third Party Client Interface) with ESMTPA id AC6BCE0000DB;
Sat, 15 Oct 2011 16:47:21 -0400 (EDT)
Subject: T.R *AN ~N %I$E \S " PO)R~N _
To: taylor82old@yahoo.com
From: "Dktlo Atbea"<le...@aol.com>
Date: Sun, 16 Oct 2011 00:01:59 -0400
Mime-Version: 1.0
Content-Type: text/plain; charset="utf-8"
x-aol-global-disposition: S
X-AOL-SCOLL-SCORE: 0:2:108986416:93952408
X-AOL-SCOLL-URL_COUNT: 0
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1d29024e99f1591d75
X-AOL-IP: 85.12.240.121
X-Envelope-From:<le...@aol.com>
oitnae fubwpr nkaw han vioxm gblryhbvgb. http://h1.ripway.com/mhelzky23/index.html ykah lvhxudwd. tsxo, azcw.
Re: Recieving email from aol or yahoo or hotmail, that is not addressed
to me personally.
Posted by Ned Slider <ne...@unixmail.co.uk>.
On 16/10/11 19:28, Martin Gregorie wrote:
> On Sun, 2011-10-16 at 20:02 +0200, Benny Pedersen wrote:
>>> I may never know they sent me an email.
>>> Unless I spend time going over my logs.
>>
>> ah you have logs ? :=)
>>
> A possible way out is to process the logs overnight, possibly as part of
> logwatch, and build a datastore of addresses that mail has been sent to
> via your MTA. You can use this as the basis for an automatic
> whitelisting SA plugin which whitelists people who have received mail
> from your domain. Messages from everybody else have to take their
> chances with the standard SA rules and any locally defined ones.
>
> This works well here: the only difference is that I archive all incoming
> and outgoing mail and use my archive as the sender-whitelisting plugin's
> data source.
>
>
That's pretty much what I've been doing too - hotmail, yahoo and aol
score 6pts by default and legit/known senders get a whitelist scoring to
counterbalance that. Works brilliantly. Catches all new spam runs from
the big freemail providers and, worst case, very occasionally the first
correspondence from a legit sender gets stuck in quarantine for a few hours.
I see more spam that ham out of these big freemail providers so have
long since lost any trust in them. Funny, google manages to keep spam to
a minimum (at least from the flow I see here) so one can only conclude
the other big freemail providers simply don't care.
Re: Recieving email from aol or yahoo or hotmail, that is not
addressed to me personally.
Posted by Martin Gregorie <ma...@gregorie.org>.
On Sun, 2011-10-16 at 20:02 +0200, Benny Pedersen wrote:
> > I may never know they sent me an email.
> > Unless I spend time going over my logs.
>
> ah you have logs ? :=)
>
A possible way out is to process the logs overnight, possibly as part of
logwatch, and build a datastore of addresses that mail has been sent to
via your MTA. You can use this as the basis for an automatic
whitelisting SA plugin which whitelists people who have received mail
from your domain. Messages from everybody else have to take their
chances with the standard SA rules and any locally defined ones.
This works well here: the only difference is that I archive all incoming
and outgoing mail and use my archive as the sender-whitelisting plugin's
data source.
Martin
Re: Recieving email from aol or yahoo or hotmail, that is not
addressed to me personally.
Posted by Benny Pedersen <me...@junc.org>.
On Sun, 16 Oct 2011 05:11:21 -0700, Paul Cabot wrote:
> I'm not really a fan of blacklisting an entire domain.
here this is not a problem since i just get the spam in junk folder
with a sieve rule, so no loose for me
> If it is a
> domain that for sure is 100% spam or close to it then sure.
that rule is hard to weight to, thats why i scan virus in before-queue,
and spam in after-queue state, and spam is here just delived with
tagging to recipients, so thay are free to sort it to dev-null pr
sender/sender domain, i got feed back from my own users this is wanted
:=)
> But for
> domains like yahoo or hotmail or even aol.
to big to be loved here, to much free and rfc-ignorant, no go !
> There are legitimate
> accounts on them.
yes, and spammers use this fact to get bypassed for not use ther domain
as default blacklisted_from and whitelisted non spammers, oh well :)
> So unless someone gives me their email address
> before sending me an email.
this is not needed if spam is just tagged, not rejected in mta stage,
then my suggestion works, but if spamassassin is used as mta milter
where it reject spam then is not what you want, currect
> I may never know they sent me an email.
> Unless I spend time going over my logs.
ah you have logs ? :=)
yes there is a diff being user on a domain, and hostmaster on a domain,
users never know what problem there is to be listed in rfc-ignorant, and
there is also few mail relays that makes money on deliver email for
custommers domains that have no logs, and acccept pdf files with winner
lottos, hmm just print it and you are a winner :-)
> The random chars I sort of realized had something to do with a way of
> trying to mess up a program like spamassassin. Funny thing about
> them is everyone knows that an email with random chars is almost
> certaintly going to be 100% spam. I have downloaded the chickenpox
> rules. But they don't seem to be hitting on the emails I'm getting.
this can be caught with a speelchecker, all that kinds of mails do not
countain any english words, i bet one will say same on some of my mails
also, but its not spam just badly writed from me, reasons its not cought
by chickenpox is mostly its known by spammers that some domains still
use this rule sets, spamassassin is opensource also for spammers
i have installed amavisd-new 2.7.0 now hope it works
Re: Recieving email from aol or yahoo or hotmail, that is not addressed
to me personally.
Posted by Paul Cabot <pa...@topguncomputers.com>.
On 15/10/2011 5:56 PM, Benny Pedersen wrote:
> On Sat, 15 Oct 2011 16:40:48 -0700, Paul Cabot wrote:
>>> blacklist_from *@aol.com
>>> whitelist_from_spf good-users@aol.com
>>> users can then get a new url for free :-)
>>
>> Would that not blacklist everyone from aol.com unless I specifically
>> allowed them with the whitelist_from_spf setting?
>
> currect
>
> if it was url, it would be easy to whitelist non spam urls that does
> not have any other url that is not known, basicly spammers get 100000
> new free domains, and spam you random from aol.com, no ?
>
> thats why i sugest blacklist_from aol.com and whitelist non spammers
> on aol, then the spam urls is not important anymore
>
> good rules comes from strong thinking on how spammers thinks or not
> think at all
>
> bad rule is if spammers just put in one single whitelisted url to get
> it scored as ham msgs, i maked my local url blacklist but got tired of
> mainained it, and changed to fokus on sender domain instad :)
>
> the random chars is to make bayes training it, but if you lower bayes
> ham autolearn threashold level and make more manuel training then
> spammers loose bayes poising
>
> i also update ip2cc db myself now since the current does not contain
> my own ip, if there is intrest to get the geoip license fixed to be
> free included in spamassassin go for it, i stick to ip2cc for now
I'm not really a fan of blacklisting an entire domain. If it is a
domain that for sure is 100% spam or close to it then sure. But for
domains like yahoo or hotmail or even aol. There are legitimate
accounts on them. So unless someone gives me their email address
before sending me an email. I may never know they sent me an email.
Unless I spend time going over my logs.
The random chars I sort of realized had something to do with a way of
trying to mess up a program like spamassassin. Funny thing about them
is everyone knows that an email with random chars is almost certaintly
going to be 100% spam. I have downloaded the chickenpox rules. But
they don't seem to be hitting on the emails I'm getting.
Re: Recieving email from aol or yahoo or hotmail, that is not
addressed to me personally.
Posted by Benny Pedersen <me...@junc.org>.
On Sat, 15 Oct 2011 16:40:48 -0700, Paul Cabot wrote:
>> blacklist_from *@aol.com
>> whitelist_from_spf good-users@aol.com
>> users can then get a new url for free :-)
>
> Would that not blacklist everyone from aol.com unless I specifically
> allowed them with the whitelist_from_spf setting?
currect
if it was url, it would be easy to whitelist non spam urls that does
not have any other url that is not known, basicly spammers get 100000
new free domains, and spam you random from aol.com, no ?
thats why i sugest blacklist_from aol.com and whitelist non spammers on
aol, then the spam urls is not important anymore
good rules comes from strong thinking on how spammers thinks or not
think at all
bad rule is if spammers just put in one single whitelisted url to get
it scored as ham msgs, i maked my local url blacklist but got tired of
mainained it, and changed to fokus on sender domain instad :)
the random chars is to make bayes training it, but if you lower bayes
ham autolearn threashold level and make more manuel training then
spammers loose bayes poising
i also update ip2cc db myself now since the current does not contain my
own ip, if there is intrest to get the geoip license fixed to be free
included in spamassassin go for it, i stick to ip2cc for now
Re: Recieving email from aol or yahoo or hotmail, that is not addressed
to me personally.
Posted by Paul Cabot <pa...@topguncomputers.com>.
On 15/10/2011 3:52 PM, Benny Pedersen wrote:
> On Sat, 15 Oct 2011 14:32:07 -0700, Paul Cabot wrote:
>> I've noticed a trend recently where I'm getting emails sent to me
>> from either an aol or yahoo or hotmail account. But the email has a
>> "to" address to some other account that is not mine.
>
> blacklist_from *@aol.com
> whitelist_from_spf good-users@aol.com
>
> users can then get a new url for free :-)
Would that not blacklist everyone from aol.com unless I specifically
allowed them with the whitelist_from_spf setting?
Re: Recieving email from aol or yahoo or hotmail, that is not
addressed to me personally.
Posted by Benny Pedersen <me...@junc.org>.
On Sat, 15 Oct 2011 14:32:07 -0700, Paul Cabot wrote:
> I've noticed a trend recently where I'm getting emails sent to me
> from either an aol or yahoo or hotmail account. But the email has a
> "to" address to some other account that is not mine.
blacklist_from *@aol.com
whitelist_from_spf good-users@aol.com
users can then get a new url for free :-)
Re: Recieving email from aol or yahoo or hotmail, that is not
addressed to me personally.
Posted by Benny Pedersen <me...@junc.org>.
On Sat, 15 Oct 2011 15:39:24 -0700 (PDT), John Hardin wrote:
> On Sat, 15 Oct 2011, Paul Cabot wrote:
>
>> Is there any way of blocking emails sent to me that are not really
>> addressed to me.
>
> ...you don't ever want to receive legitimate BCCs?
blacklist_to *@aol.com
:-)
eg if header to contains spammy domain
Re: Recieving email from aol or yahoo or hotmail, that is not
addressed to me personally.
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Sat, 2011-10-15 at 16:39 -0700, Paul Cabot wrote:
> On 15/10/2011 3:39 PM, John Hardin wrote:
> > > Is there any way of blocking emails sent to me that are not really
> > > addressed to me.
> >
> > ...you don't ever want to receive legitimate BCCs?
Or these very list posts, addressing the question at hand.
> Didn't think about the fact that it would be because of me being a BCC.
There seems to be a misconception, about what the visible mail headers
like To and Cc actually are. Feel free to slap me, if I'm wrong. :)
The most important thing to understand is, that both the To and Cc
headers are really merely cosmetic. They don't mean anything, as far as
SMTP (transferring mail) is concerned.
Given a regular MUA, the whole bunch of To, Cc and Bcc take addresses
the mail should be sent to. The distinction between To and Cc mostly is
pleasing the human old-school behavior. With email, the Cc is not really
a carbon-copy as in it's original meaning, and unlike a physical letter,
there can be more than one To addresses.
The Bcc header is different, in that it means the MUA and MTA are
supposed to not display and tell them to others, and basically every
software today adheres to that. Most handy for mass-mailing your friends
without leaking the whole list to everyone (and getting floods of
inappropriate Reply-To-All back later).
The other piece of the puzzle is the Envelope From -- the address(es)
actually used in SMTP, denoting the recipient address. From a user's
POV, that's To, Cc and Bcc combined.
>From the SMTP POV, the Envelope From is all that matters, and not
necessarily the same as these headers. In fact, that stage of SMTP is
done entirely before *any* mail header gets transferred. Hence the
"envelope". That stage is early in the SMTP session, way before these To
and Cc headers are being transmitted at all.
To complete this picture: The To and Cc headers are *inside* the
envelope, right on your letter. The actual list of recipients is given
to the postal worker, along with an appropriate number of sealed
envelops...
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Recieving email from aol or yahoo or hotmail, that is not addressed
to me personally.
Posted by Paul Cabot <pa...@topguncomputers.com>.
On 15/10/2011 3:39 PM, John Hardin wrote:
> On Sat, 15 Oct 2011, Paul Cabot wrote:
>
>> Is there any way of blocking emails sent to me that are not really
>> addressed to me.
>
> ...you don't ever want to receive legitimate BCCs?
>
Didn't think about the fact that it would be because of me being a BCC.
Re: Recieving email from aol or yahoo or hotmail, that is not
addressed to me personally.
Posted by John Hardin <jh...@impsec.org>.
On Sat, 15 Oct 2011, Paul Cabot wrote:
> Is there any way of blocking emails sent to me that are not really addressed
> to me.
...you don't ever want to receive legitimate BCCs?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
One death is a tragedy; thirty is a media sensation;
a million is a statistic. -- Joseph Stalin, modernized
-----------------------------------------------------------------------
310 days since the first successful private orbital launch (SpaceX)