You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Johnson, S" <sj...@edina.k12.mn.us> on 2009/08/13 21:56:13 UTC
giftcardsurveys.us.com
I've done really good with blocking spam up until this one...
It looks like a "legitimate" e-mailer from both the system perspective
and the system perspective.
When I look at my logs, the servers are reporting their domains
correctly so their mailserver looks ok when attacking to my server.
Each email seems to be coming from numerous different servers so I can't
block on server address...
They say don't do "spamming" but the area in the email that contains the
link to remove yourself/unsubscribe is an image so you can't click on
it, instead you have to type it in by hand. I normally don't proceed
down that path but I decided to try it anyway. When I put in the email
address of the user that was being sent these survey offers for gift
cards I got a message stating please allow 10 days for removal which
makes me think they are not legit.
The question is... Since everything is configured on their servers ok
and the messages don't contain words I can really create a rule on..
It's not just home depot, it's KFC, Macy's and numerous other retailers.
Anyone have any ideas on how to block these? The poor user is getting
about 10 / day.
Thanks,
Scott
From: Home Improvement Survey Center
[mailto:dgribble@stockfundetfscreener.com]
Sent: Thursday, August 13, 2009 9:17 AM
To: Lastname, FirstName
Subject: Home Depot Customer Survey for usersaddress@domain.com
<http://stockfundetfscreener.com/k/1585442/4pzuutrmz:fzomvvuvqTCKbpuwvyx
1zUCKhvpstUCKZw3wSCKdsqsuzz5>
<http://stockfundetfscreener.com/k/1585442/4pzuutrmz:fzomvvuvqTCKbpuwvyx
1zUCKhvpstUCKZw3wSCKdsqsuzz5>
<http://stockfundetfscreener.com/k/1585442/4pzuutrmz:fzomvvuvqTCKbpuwvyx
1zUCKhvpstUCKZw3wSCKdsqsuzz5>
<http://stockfundetfscreener.com/k/1585442/4pzuutrmz:fzomvvuvqTCKbpuwvyx
1zUCKhvpstUCKZw3wSCKdsqsuzz5>
<http://stockfundetfscreener.com/k/1585442/4pzuutrmz:fzomvvuvqTCKbpuwvyx
1zUCKhvpstUCKZw3wSCKdsqsuzz5>
Thanks for responding !
Re: Home Depot gift card for user@domain.com
<ma...@domain.com>
________________________________
This week you've been chosen to participate in our short Home Depot
Retail Survey
<http://stockfundetfscreener.com/k/1585442/4pzuutrmz:fzomvvuvqTCKbpuwvyx
1zUCKhvpstUCKZw3wSCKdsqsuzz5>
for $50 to spend at any Home Depot store. (Participation required. See
below for details.)
We just need a few minutes of your time.
Simply 1) choose which Home Depot department is your favorite
<http://stockfundetfscreener.com/k/1585442/4pzuutrmz:fzomvvuvqTCKbpuwvyx
1zUCKhvpstUCKZw3wSCKdsqsuzz5> ; and
2) verify your email address
<http://stockfundetfscreener.com/k/1585442/4pzuutrmz:fzomvvuvqTCKbpuwvyx
1zUCKhvpstUCKZw3wSCKdsqsuzz5> ; then 3) follow our simple website
instructions
<http://stockfundetfscreener.com/k/1585442/4pzuutrmz:fzomvvuvqTCKbpuwvyx
1zUCKhvpstUCKZw3wSCKdsqsuzz5> .
Your participation is greatly appreciated!
Sincerely,
GiftCardSurveys
Re: giftcardsurveys.us.com
Posted by Kris Deugau <kd...@vianet.ca>.
Johnson, S wrote:
> The question is… Since everything is configured on their servers ok and
> the messages don’t contain words I can really create a rule on..
This is one of the few cases where I might well create a local rule for
something short:
body BAD_SURVEYS /\bGiftCardSurveys\b/
I've yet to see anything like this in any legitimate email ("Complete a
survey and Win A Gift Card!"), but I've seen plenty of "Complete a
survey and win a <something>!" in spam.
-kgd
Re: giftcardsurveys.us.com
Posted by Brian Godette <bg...@idcomm.com>.
Johnson, S wrote:
> I’ve done really good with blocking spam up until this one…
>
> It looks like a “legitimate” e-mailer from both the system perspective
> and the system perspective.
>
> When I look at my logs, the servers are reporting their domains
> correctly so their mailserver looks ok when attacking to my server.
> Each email seems to be coming from numerous different servers so I can’t
> block on server address…
>
> They say don’t do “spamming” but the area in the email that contains the
> link to remove yourself/unsubscribe is an image so you can’t click on
> it, instead you have to type it in by hand. I normally don’t proceed
> down that path but I decided to try it anyway. When I put in the email
> address of the user that was being sent these survey offers for gift
> cards I got a message stating please allow 10 days for removal which
> makes me think they are not legit.
>
> The question is… Since everything is configured on their servers ok and
> the messages don’t contain words I can really create a rule on.. It’s
> not just home depot, it’s KFC, Macy’s and numerous other retailers.
> Anyone have any ideas on how to block these? The poor user is getting
> about 10 / day.
>
> Thanks,
>
> Scott
Welcome to snowshoe spam.
The only effective defense I've seen against this is to have a greylist
with more than an hour temp fail time so each new spam run has time to
hopefully show up in DCC and possibly RAZOR/Pyzor/Spamcop/URIBL.
The content really can't be matched against since the URIs are old
enough to not be in something like DOB, haven't been used before so
aren't in the URIBLs, and look like real rebate/coupon mail so
BAYES/phrase matching is useless unless you want to nuke or manually
whitelist the legit stuff. The websites are of course a CC scam/PI phish.
You can block the servers, a class C or whois allocation at a time, if
you're willing to deal with the occasional "why am I not getting mail
from ABC who's decided to host with sleazy hosting XYZ" if the space
ever gets reassigned.
Re: giftcardsurveys.us.com
Posted by Kris Deugau <kd...@vianet.ca>.
Johnson, S wrote:
> It looks like a “legitimate” e-mailer from both the system perspective
> and the system perspective.
Er..? Think you meant something other than "system perspective"
somewhere there. <g>
> When I look at my logs, the servers are reporting their domains
> correctly so their mailserver looks ok when attacking to my server.
> Each email seems to be coming from numerous different servers so I can’t
> block on server address…
Not one at a time, no, but collect enough and you'll start seeing hits
in the same netblocks over and over. The DNS entries may be coherent
and correctly matched to themselves... but they usually point to a
domain that looks spammy. URI rules should tag quite a few of this
class of spam - often the From:, envelope-from, and URLs in the message
are very similar but don't actually match.
> They say don’t do “spamming” but the area in the email that contains the
> link to remove yourself/unsubscribe is an image so you can’t click on
> it, instead you have to type it in by hand.
Hmm. Most of the ones I've seen have a clickable image.
> I normally don’t proceed
> down that path but I decided to try it anyway. When I put in the email
> address of the user that was being sent these survey offers for gift
> cards I got a message stating please allow 10 days for removal which
> makes me think they are not legit.
Mmm. IMO anything taking more than a few hours is bad practice at the
very *best*, but this was brought up in another thread recently and
there *were* legitimate reasons brought up why it might well take a few
days to process an electronic unsubscribe. :/
> The question is… Since everything is configured on their servers ok and
> the messages don’t contain words I can really create a rule on.. It’s
> not just home depot, it’s KFC, Macy’s and numerous other retailers.
> Anyone have any ideas on how to block these? The poor user is getting
> about 10 / day.
Recently I've been collecting relay IPs and dropping them in a local
blacklist (scored in SA, not at the MTA level).
Over time, as I get more spam reports, more than n IPs in a /m-sized
block gets another bit flipped for *all* IPs in that block (I have
specific rules for that threshold that depend on the size of the block),
and an additional score in SA. Some blocks' WHOIS data matches closely
enough with the physical address in the image that I've set yet another
bit on all blocks associated with that owner, for more score in SA.
If you look at the clickable URLs in the message, you'll see they point
somewhere that usually looks pretty spammy just based on the domain
name; I've been collecting those, too.
When compared with another SA install that I don't have these local URI
and relay-IP blacklisting rules on (my own personal server), it's
keeping the overall SA effectiveness somewhere over 90% for most customers.
If you can post a more complete example on Pastebin we can all try
passing it through our own SA setups; inline messages can only show us
so much.
-kgd
Re: giftcardsurveys.us.com
Posted by Ted Mittelstaedt <te...@ipinc.net>.
John Hardin wrote:
> On Thu, 13 Aug 2009, Johnson, S wrote:
>
>> When I put in the email address of the user that was being sent these
>> survey offers for gift cards I got a message stating please allow 10
>> days for removal which makes me think they are not legit.
>
> That's not necessarily the case. One legitimate reason for claiming a
> delay like that is if a marketing promotion is already underway
> materials may already be in the pipeline.
>
> Granted, that's more true of physical mail than email, but the
> procedures in place for electronic marketing may have the same latency.
> It doesn't automatically mean they're lying about unsubscribing you as
> quickly as they practically can.
>
> However, I agree it's annoying.
>
But it's so easy to check if they are lying. Just setup a fake
e-mail address that feeds right into your Bays filter for spam,
then after keying in the user's e-mail address that you want to
unsubscribe, submit your feeder address for "unsubscribing"
If they are a bona-fied spammer when they see the virgin
(to their database) feeder address punched into their unsubscribe
link, they will immediately start spamming it.
Ted
Re: giftcardsurveys.us.com
Posted by John Hardin <jh...@impsec.org>.
On Thu, 13 Aug 2009, Johnson, S wrote:
> When I put in the email address of the user that was being sent these
> survey offers for gift cards I got a message stating please allow 10
> days for removal which makes me think they are not legit.
That's not necessarily the case. One legitimate reason for claiming a
delay like that is if a marketing promotion is already underway materials
may already be in the pipeline.
Granted, that's more true of physical mail than email, but the procedures
in place for electronic marketing may have the same latency. It doesn't
automatically mean they're lying about unsubscribing you as quickly as
they practically can.
However, I agree it's annoying.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Your mouse has moved. Your Windows Operating System must be
relicensed due to this hardware change. Please contact Microsoft
to obtain a new activation key. If this hardware change results in
added functionality you may be subject to additional license fees.
Your system will now shut down. Thank you for choosing Microsoft.
-----------------------------------------------------------------------
Tomorrow: the 64th anniversary of the end of World War II