You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Michelle Konzack <li...@tamay-dogan.net> on 2010/07/11 12:49:34 UTC
How to stop weird "From:" crap?
Hello Experts,
since arround 9 weeks I become bombed on my E-Mails <linux4michelle> and
<michelle.konzack> by crappy From: spams. Here some examples from my
log:
----[ '~/.tdtools-procmail/FLT_weird_From.hits' ]-----------------------
1275237458:DirectBuylW[P^h4TWXMQ_OOQUI W_:XSRSP7^E[@urimpute.com>
1275237639:DirectBuylW[P^h4TWXMQ_OOQUI W_:XSRSP7^E[@urimpute.com>
1275302108:MedicalBillingAndCodinghSWcZdGPSTIM[bKMhEXS[6TONOc3ZXW@bluegreencaliber.net>
1275302370:AvandiaLawsuitInfovaNZh[>, ^JKW[RYYD_SOJi-K]FZAQOe@kitehearts.net
1275323102:CreditScorelW[P^h4TWXMQ_OOQUI W_:XSRSP7^E[@checkinitout.net>
1275323757:PetCareRxu`MYgZ=]IJVZQXXC^RNIhCJ[EY@PNd@rjpcentral.com>
1275325548:PetCareRxbMQ]k^AaMNZGUEGbVRMl0N`HI]DTRh@thegiveup.com
1275326175:<Pe...@youraries.com>
1275335658:AvandiaLawsuitInfocNR^U_BbNO[HV]FHcWSNm1OaIJ^.USi@iliveahealthylife.net
1275375900:DirectBuycNR^U_BbNO[HV]FHcWSNm1OaIJ^.USi@healthdaysfinder.com
1275387771:CreditReportfQUaXbENQR^KY`IKfCVQY4RdLMa1XVU@tansprinter.net
1275403694:DirectBuyr]JVdn:Z]GSWNUU@[ObFe@GYXBV=dKa@carwarrantee.com>
1275410979:HomeWarrantyhSWcZdGPSTIM[bKMhEXS[6TONOc3ZXW@coveragenation.com>
1275417868:VideoGameDevelopmentdOS_V`CcOPIW^GIdATOn2PbJK_/VTj@goodgrilledburgers.com
1275426567:GevaliaaLPj]@`LMYFT[[FaUQLk/M_GH CSQg@checkinitout.net>
1275429487:promo�oes@visa.com.br
1275439307:promo�oes@visa.com.br
1275451027:NewBizOpcNR^U_BbNO[HV]FHcWSNm1OaIJ^.USi@greenarnage.com
1275455097:CreditReportePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@newexistence.net
1275462916:CreditReportiTXd[eHQTUJN LLNiFYT 7UPOPd4[YX@aquamarineedge.net>
1275472439:CreditScoreDirectePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@theextrawarranty.com
1275475128:YourScoreDirectqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@petwant.com
1275476908:TheBarkOfflW[P^h4TWXMQ_OOQUI W_:XSRSP7^E[@whatcouldbe.net>
1275509608:GovernmentQualifysbMQ]k^AaMNZGUEGbVRMl0N`HI]DTRh@cafemeals.com
1275548240:PetMedslW[P^h4TWXMQ_OOQUI W_:XSRSP7^E[@greenyellowescalade.com>
1275572290:StimulusGranthSWcZdGPSTIM[bKMhEXS[6TONOc3ZXW@thewarrantyonline.com>
1275578089:GovernmentGrantePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@soinsuranceonline.com
1275582313:CarWarrantyaLPj]@`LMYFT[[FaUQLk/M_GH CSQg@blueabbreviation.com>
1275585678:AccessibleHealthcareePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@wintersbestdays.com
1275594582:AHSwarrantykVZO]gJSVWLP^NNPTH[V^9WRQRO6][Z@myhealthnation.com>
1275613695:VinylSidingcNR^U_BbNO[HV]FHcWSNm1OaIJ^.USi@mybonusagents.com
1275639172:SpeedDatecNR^U_BbNO[HV]FHcWSNm1OaIJ^.USi@clockschime.net
1275644760:<Gevalias^KWeX;[^HTXOVVA PcGfAHZYCW>, NLb@sumextent.com>
1275647721:CreditReportjUYNfIRUVKO]MMOjGZU]8VQPQN5ZY@pricelesscentral.com
1275650950:TestersNeededePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@allweatherruns.net
1275659550:GevalianY]R`j6VYCOSaQQSWK^BaZUTUR9`G]@creditseed.com
1275694866:DirectBuyqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@newbiznation.com
1275715853:user@mozilla-xp.com/
1275720541:DirectBuyu`MYgZ=]IJVZQXXC^RNIhCJ[EY@PNd@kiddiessite.com>
1275761867:<Proactivs^KWeX;[^HTXOVVA PcGfAHZYCW>, NLb@allfauna.com>
1275783508:TermFinderr]JVdn:Z]GSWNUU@[ObFe@GYXBV=dKa@credittidings.com>
1275787826:StorePerkst_LXfY_IUYPWWB]QMHgBI[ZDX?OMc@allweatherruns.net>
1275789791:CreditCheckiTXd[eHQTUJN LLNiFYT 7UPOPd4[YX@passfitness.com>
1275794906:ProactivvaNZh[>, ^JKW[RYYD_SOJi-K]FZAQOe@sumcoverage.com
1275847591:TermFinderfQUaXbENQR^KY`IKfCVQY4RdLMa1XVU@couplesmove.com
1275849179:PetCareRxkVZO]gJSVWLP^NNPTH[V^9WRQRO6][Z@justutravel.com>
1275850724:<Gevalias^KWeX;[^HTXOVVA PcGfAHZYCW>, NLb@oldbizs.com>
1275850946:LASIKVisionePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@creditsevern.com
1275881546:TaraMediumfQUaXbENQR^KY`IKfCVQY4RdLMa1XVU@throwingtowels.com
1275917165:CreditCheckqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@superperez.com
1275919321:CreditScorekVZO]gJSVWLP^NNPTH[V^9WRQRO6][Z@plaiceup.com>
1275936123:CreditCheckcNR^U_BbNO[HV]FHcWSNm1OaIJ^.USi@juicyus.com
1275952205:HomeWarranty101t_LXfY_IUYPWWB]QMHgBI[ZDX?OMc@oldoccupation.com>
1275981622:HomeRepairsaLPj]@`LMYFT[[FaUQLk/M_GH CSQg@shawlive.com>
1275984211:SeniorLifeInsuranceMessagewbO[i?_KLXESZZE`TPKj.L^]G[BRPf@forestgreentaurus.net>
1275984923:languageaLPj]@`LMYFT[[FaUQLk/M_GH CSQg@maizetraverse.com>
1276008001:HomeRepairlW[P^h4TWXMQ_OOQUI W_:XSRSP7^E[@superperez.com>
1276019557:StimulusGrantfQUaXbENQR^KY`IKfCVQY4RdLMa1XVU@freshpersons.com
1276031387:<AHSs^KWeX;[^HTXOVVA PcGfAHZYCW>, NLb@plaiceup.com>
1276046981:StimulusGrantwbO[i?_KLXESZZE`TPKj.L^]G[BRPf@actualexample.com>
1276051710:LanguageLearningePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@twotimesdrier.com
1276069293:WarrantyOptionshSWcZdGPSTIM[bKMhEXS[6TONOc3ZXW@thehappily.com>
1276074153:CreditReportjUYNfIRUVKO]MMOjGZU]8VQPQN5ZY@newgrouping.com
1276094236:TaraMediumePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@shockingpinksavana.net
1276105783:WarrantyExtensionjUYNfIRUVKO]MMOjGZU]8VQPQN5ZY@novelbiz.com
1276108731:CreditScoreDirectu`MYgZ=]IJVZQXXC^RNIhCJ[EY@PNd@clearwrokn.com>
1276121498:WarrantyOptionsePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@bluesus.com
1276136408:TheBarkOffqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@goldenrodexpedition.net
1276177303:HomeRepairhSWcZdGPSTIM[bKMhEXS[6TONOc3ZXW@aboutjgp.com>
1276180138:SECURITYSYSTEMSt_LXfY_IUYPWWB]QMHgBI[ZDX?OMc@123transaction.com>
1276193359:CreditReportbMQ]k^AaMNZGUEGbVRMl0N`HI]DTRh@lithiumsix.com
1276195791:PetCareRxjUYNfIRUVKO]MMOjGZU]8VQPQN5ZY@fishwrokn.com
1276198686:HomeRepairsnY]R`j6VYCOSaQQSWK^BaZUTUR9`G]@healthdaysfinder.com
1276212805:PhotographySchoolsjUYNfIRUVKO]MMOjGZU]8VQPQN5ZY@oxygenrange.com
1276241839:CoverMyHomeRepairkVZO]gJSVWLP^NNPTH[V^9WRQRO6][Z@parrallellines.com>
1276244903:GevaliaqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@justfriendfinder.com
1276248415:ConfirmationNumberLG5534bMQ]k^AaMNZGUEGbVRMl0N`HI]DTRh@skybluefiesta.net
1276248686:AHSWarrantyqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@waterbreeze.com
1276274827:HOMESECURITYwbO[i?_KLXESZZE`TPKj.L^]G[BRPf@breakingwords.com>
1276276924:GevaliahSWcZdGPSTIM[bKMhEXS[6TONOc3ZXW@lmpcentral.com>
1276281866:LASIKVisionu`MYgZ=]IJVZQXXC^RNIhCJ[EY@PNd@mailadjust.com>
1276289243:HOMESECURITYoZ^Sak7WZDPTbRRTXL_Cb=DVUVS:aH^@lithiumsix.com
1276290837:LASIKVisionnY]R`j6VYCOSaQQSWK^BaZUTUR9`G]@difficultgo.com
1276300458:MedicalTranscriptionTrainingwbO[i?_KLXESZZE`TPKj.L^]G[BRPf@fairytaleangel.com>
1276458266:NoBarkingfQUaXbENQR^KY`IKfCVQY4RdLMa1XVU@measurelocations.com
1276531914:GovernmentGrantApprovalhSWcZdGPSTIM[bKMhEXS[6TONOc3ZXW@copperfocus.net>
1276535687:WarrantyExtensionwbO[i?_KLXESZZE`TPKj.L^]G[BRPf@aboutlulu.com>
1276536060:"none <"@lists.mozilla.org
1276538737:LasikVisionePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@couplesmove.com
1276561188:WarrantyExtensionu`MYgZ=]IJVZQXXC^RNIhCJ[EY@PNd@thecolorlist.com>
1276576956:CreditReportqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@redorangeram.net
1276578453:BestCarInsuranceSite.comvaNZh[>, ^JKW[RYYD_SOJi-K]FZAQOe@carsandhearts.com
1276581777:StimulusGrantu`MYgZ=]IJVZQXXC^RNIhCJ[EY@PNd@perezcentral.com>
1276593949:StimulusGrantcNR^U_BbNO[HV]FHcWSNm1OaIJ^.USi@aboutallpets.com
1276622117:CreditScorejUYNfIRUVKO]MMOjGZU]8VQPQN5ZY@alldeary.com
1276636963:StimulusGrantfQUaXbENQR^KY`IKfCVQY4RdLMa1XVU@lossnation.com
1276682539:<CreditReports^KWeX;[^HTXOVVA PcGfAHZYCW>, NLb@chestnutfusion.net>
1276683817:HOMESECURITYqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@allpetsfinder.com
1276712127:BerkshireOnejUYNfIRUVKO]MMOjGZU]8VQPQN5ZY@risqueus.com
1276718532:BerkshireOner]JVdn:Z]GSWNUU@[ObFe@GYXBV=dKa@allinsurancehome.com>
1276722114:BerkshireOnewbO[i?_KLXESZZE`TPKj.L^]G[BRPf@mytayten.com>
1276741894:StimulusSurveywbO[i?_KLXESZZE`TPKj.L^]G[BRPf@happyshorts.net>
1276777045:DishPromocNR^U_BbNO[HV]FHcWSNm1OaIJ^.USi@freshcrowd.com
1276778214:DishPromojUYNfIRUVKO]MMOjGZU]8VQPQN5ZY@smallclassical.com
1276796843:GlobeLifeoZ^Sak7WZDPTbRRTXL_Cb=DVUVS:aH^@credittidings.com
1276806826:GlobeLifeiTXd[eHQTUJN LLNiFYT 7UPOPd4[YX@petwant.com>
1276828910:<Wa...@burntorangeshelby.net>
1276834099:CostaRicaSalesePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@plumacadia.net
1276848116:DishPromotionsoZ^Sak7WZDPTbRRTXL_Cb=DVUVS:aH^@theautotime.com
1276860344:DishPromotionsqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@lphealth.com
1276862271:DishPromotionsnY]R`j6VYCOSaQQSWK^BaZUTUR9`G]@soinsuranceonline.com
1276883633:AllTimeLowsfQUaXbENQR^KY`IKfCVQY4RdLMa1XVU@bestcelebrate.com
1276891330:BerkshireOnelW[P^h4TWXMQ_OOQUI W_:XSRSP7^E[@freshpersons.com>
1277037742:WarrantyOptionsnY]R`j6VYCOSaQQSWK^BaZUTUR9`G]@passfitness.com
1277038117:<Di...@joinusfinder.com>
1277042994:CreditScoreCenterePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@newpersons.com
1277049081:StimulusGrantjUYNfIRUVKO]MMOjGZU]8VQPQN5ZY@autosguarantee.com
1277096835:<ChooseSeniorLifeInsurances^KWeX;[^HTXOVVA PcGfAHZYCW>, NLb@rawsiennasporttrac.net>
1277118236:MovingQuoteslW[P^h4TWXMQ_OOQUI W_:XSRSP7^E[@delightfulstorms.net>
1277129628:SECURITYSYSTEMSqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@aquariusplus.com
1277138121:GlobeLifedOS_V`CcOPIW^GIdATOn2PbJK_/VTj@utravelcentral.com
1277144007:LASIKVisionu`MYgZ=]IJVZQXXC^RNIhCJ[EY@PNd@juicyus.com>
1277150309:BerkshireOnenY]R`j6VYCOSaQQSWK^BaZUTUR9`G]@miraclestobelieve.com
1277167633:GlobeLifeqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@dressfed.com
1277175706:StimulusGrantApprovalNetworkwbO[i?_KLXESZZE`TPKj.L^]G[BRPf@ridetherain.com>
1277176802:ConfirmationNumberLG5534oneyqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@burntsiennachallenger.net
1277233349:Net2InsuranceoZ^Sak7WZDPTbRRTXL_Cb=DVUVS:aH^@officialocean.com
1277233368:Net2InsurancefQUaXbENQR^KY`IKfCVQY4RdLMa1XVU@stockdealz.com
1277243091:HomeRepairnY]R`j6VYCOSaQQSWK^BaZUTUR9`G]@bestquaker.com
1277257530:GlobeLifenY]R`j6VYCOSaQQSWK^BaZUTUR9`G]@miraclestobelieve.com
1277285422:GovernmentGrantsnY]R`j6VYCOSaQQSWK^BaZUTUR9`G]@pictureshere.net
1277286054:USFinancialnY]R`j6VYCOSaQQSWK^BaZUTUR9`G]@fishwrokn.com
1277286744:TestersNeededaLPj]@`LMYFT[[FaUQLk/M_GH CSQg@instantpops.net>
1277308518:HomeWarrantybMQ]k^AaMNZGUEGbVRMl0N`HI]DTRh@jenbsite.com
1277324229:USFinancialbMQ]k^AaMNZGUEGbVRMl0N`HI]DTRh@upisces.com
1277332695:USFinancialePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@thehappily.com
1277361264:MedicalBillingAndCodingqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@thursdayfrills.com
1277406344:Cash4GoldfQUaXbENQR^KY`IKfCVQY4RdLMa1XVU@alaskabasketball.net
1277434410:<Wa...@mondaymysteries.com>
1277436486:PrizeAlerthSWcZdGPSTIM[bKMhEXS[6TONOc3ZXW@excitedgames.net>
1277466859:HOMESECURITYcNR^U_BbNO[HV]FHcWSNm1OaIJ^.USi@noveljob.com
1277471793:SeniorLifeInsurancekVZO]gJSVWLP^NNPTH[V^9WRQRO6][Z@justutravel.com>
1277472320:SeniorLifeInsurancehSWcZdGPSTIM[bKMhEXS[6TONOc3ZXW@manymovez.com>
1277475390:NewBizOpqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@sundaymusings.com
1277477561:HOMESECURITYkVZO]gJSVWLP^NNPTH[V^9WRQRO6][Z@lovelifesmokefree.com>
1277486892:SeniorLifeInsurancenY]R`j6VYCOSaQQSWK^BaZUTUR9`G]@gainadeel.com
1277692897:SportUtilityVehiclesvaNZh[>, ^JKW[RYYD_SOJi-K]FZAQOe@basketofpuppies.net
1277696993:SeniorLifeInsuranceMessagenY]R`j6VYCOSaQQSWK^BaZUTUR9`G]@youngfriendship.com
1277703541:TimeshareMarketValueePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@californiafootball.net
1277724524:PhotographySchoolsqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@caribbeancarrots.com
1277745566:GevaliaePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@smallclassical.com
1277748263:BestCarInsurancenY]R`j6VYCOSaQQSWK^BaZUTUR9`G]@dietcommandcenter.com
1277750785:<BestCarInsurances^KWeX;[^HTXOVVA PcGfAHZYCW>, NLb@lovespend.com>
1277755369:HomeWarrantyvaNZh[>, ^JKW[RYYD_SOJi-K]FZAQOe@rhappiness.com
1277780581:OnlineDoctorateiTXd[eHQTUJN LLNiFYT 7UPOPd4[YX@ceilingpaintings.net>
1277828072:DISHnetworkdOS_V`CcOPIW^GIdATOn2PbJK_/VTj@allrhealth.com
1277829794:NoMorePhoneBillslW[P^h4TWXMQ_OOQUI W_:XSRSP7^E[@baseballbicycles.com>
1277829903:PetCareRxnY]R`j6VYCOSaQQSWK^BaZUTUR9`G]@yelloworangeimpala.com
1277847921:<Ed...@potassiumrange.com>
1277859042:CreditWatchoZ^Sak7WZDPTbRRTXL_Cb=DVUVS:aH^@bestcelebrate.com
1277877972:ChooseSeniorLifeInsurancecNR^U_BbNO[HV]FHcWSNm1OaIJ^.USi@quietminutes.net
1277895515:<SmartCouponSavers^KWeX;[^HTXOVVA PcGfAHZYCW>, NLb@dearus.com>
1277897669:<Ge...@passauction.com>
1277908090:CouponDeptePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@cottime.com
1277913301:SmartCouponSaveriTXd[eHQTUJN LLNiFYT 7UPOPd4[YX@newgetone.com>
1277929580:MedicalBillingAndCodinglW[P^h4TWXMQ_OOQUI W_:XSRSP7^E[@anjeljeans.com>
1277939227:SmartCouponSaverlW[P^h4TWXMQ_OOQUI W_:XSRSP7^E[@topadeal.com>
1277971636:LanguageLearningoZ^Sak7WZDPTbRRTXL_Cb=DVUVS:aH^@oldinns.net
1277978158:CreditScorecNR^U_BbNO[HV]FHcWSNm1OaIJ^.USi@getunit.com
1277979348:BarkOffhSWcZdGPSTIM[bKMhEXS[6TONOc3ZXW@colorlean.com>
1278000578:BestCarInsurancebMQ]k^AaMNZGUEGbVRMl0N`HI]DTRh@soprettyworld.com
1278006174:CreditReportePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@buyexcelence.com
1278014000:VALoanbMQ]k^AaMNZGUEGbVRMl0N`HI]DTRh@itsacyberworld.com
1278045246:GrantApproval360bMQ]k^AaMNZGUEGbVRMl0N`HI]DTRh@everythingsgoing.net
1278048112:SmartCouponSaverr]JVdn:Z]GSWNUU@[ObFe@GYXBV=dKa@newhampshirekayaking.net>
1278081460:SeniorLifeInsurancenY]R`j6VYCOSaQQSWK^BaZUTUR9`G]@healthieyou.com
1278096620:NewTruckwbO[i?_KLXESZZE`TPKj.L^]G[BRPf@journalsandblogs.com>
1278098906:SeniorLifeInsurancelW[P^h4TWXMQ_OOQUI W_:XSRSP7^E[@yourhealthdays.com>
1278125131:GevaliajUYNfIRUVKO]MMOjGZU]8VQPQN5ZY@garbup.com
1278168136:StimulusGrantu`MYgZ=]IJVZQXXC^RNIhCJ[EY@PNd@stufff4sale.com>
1278169170:HomeRepairoZ^Sak7WZDPTbRRTXL_Cb=DVUVS:aH^@newtamble.com
1278180558:HOMESECURITYiTXd[eHQTUJN LLNiFYT 7UPOPd4[YX@supurbhealth.com>
1278189711:<CreditScores^KWeX;[^HTXOVVA PcGfAHZYCW>, NLb@yourskillz.com>
1278197499:HOMESECURITYt_LXfY_IUYPWWB]QMHgBI[ZDX?OMc@yourutravel.com>
1278319080:RestaurantCardlW[P^h4TWXMQ_OOQUI W_:XSRSP7^E[@pinkchocolates.net>
1278329018:HOMESECURITYdOS_V`CcOPIW^GIdATOn2PbJK_/VTj@thecolorlist.com
1278337565:DeltaPrimeRefinanceePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@thingz2luv.com
1278338907:CreditScorefQUaXbENQR^KY`IKfCVQY4RdLMa1XVU@alllulu.com
1278340502:DeltaPrimeRefinanceoZ^Sak7WZDPTbRRTXL_Cb=DVUVS:aH^@juicyus.com
1278340570:DeltaPrimeRefinancep[_Tbl8X[EQULSSUYM`Dc>, EWVWT; bI_@ursfit.com
1278387696:CreditReportp[_Tbl8X[EQULSSUYM`Dc>, EWVWT; bI_@minnesotaarts.net
1278389922:GlobeLifeu`MYgZ=]IJVZQXXC^RNIhCJ[EY@PNd@prettymood.net>
1278449939:SmartCouponSaverkVZO]gJSVWLP^NNPTH[V^9WRQRO6][Z@luvmygoal.com>
1278468541:SmartCouponSaverqIUcm9YFRVMTTVZNaEd?FXWAUcJ`@expectout.com
1278470962:SmartCouponSaverfQUaXbENQR^KY`IKfCVQY4RdLMa1XVU@loveexample.com
1278481877:CouponDeptePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@myupbeat.com
1278485398:GSNDealOrNoDealkVZO]gJSVWLP^NNPTH[V^9WRQRO6][Z@antsandbees.net>
1278501310:CreditScorejUYNfIRUVKO]MMOjGZU]8VQPQN5ZY@justutravel.com
1278518559:GevaliabMQ]k^AaMNZGUEGbVRMl0N`HI]DTRh@expertdietz.com
1278528003:GevalialW[P^h4TWXMQ_OOQUI W_:XSRSP7^E[@happilyonline.com>
1278532644:TermLifeInsurancekVZO]gJSVWLP^NNPTH[V^9WRQRO6][Z@oldbizs.com>
1278532871:LibertyDirectaLPj]@`LMYFT[[FaUQLk/M_GH CSQg@buydealz.com>
1278564666:NewWashercNR^U_BbNO[HV]FHcWSNm1OaIJ^.USi@frombarcelonawithlove.net
1278565178:HomeImprovementsoZ^Sak7WZDPTbRRTXL_Cb=DVUVS:aH^@daffodilpaper.net
1278575949:Scholarshipsu`MYgZ=]IJVZQXXC^RNIhCJ[EY@PNd@bestshopit.com>
1278624248:<StimulusGrants^KWeX;[^HTXOVVA PcGfAHZYCW>, NLb@topexxchange.com>
1278627505:StimulusGrantiTXd[eHQTUJN LLNiFYT 7UPOPd4[YX@situationit.com>
1278628943:StimulusGrantaLPj]@`LMYFT[[FaUQLk/M_GH CSQg@hatebeauty.com>
1278651475:MedicalBillingAndCodingp[_Tbl8X[EQULSSUYM`Dc>, EWVWT; bI_@earwhispers.net
1278694927:TermLifeInsuranceaLPj]@`LMYFT[[FaUQLk/M_GH CSQg@deeldayz.com>
1278695527:TermLifeInsurancevaNZh[>, ^JKW[RYYD_SOJi-K]FZAQOe@valueztoday.com
1278699825:libertydirectePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@worshipfreesamples.com
1278704049:LoanModificationoZ^Sak7WZDPTbRRTXL_Cb=DVUVS:aH^@baseballbicycles.com
1278706580:JobAlertsUSAcNR^U_BbNO[HV]FHcWSNm1OaIJ^.USi@moderncrowd.com
1278707691:JobAlertsUSAwbO[i?_KLXESZZE`TPKj.L^]G[BRPf@voyagecontrol.com>
1278764743:ScholarshipsForYouhSWcZdGPSTIM[bKMhEXS[6TONOc3ZXW@allinsurancehome.com>
1278787117:SmartCouponSaveraLPj]@`LMYFT[[FaUQLk/M_GH CSQg@passauction.com>
1278787367:SmartCouponSaveru`MYgZ=]IJVZQXXC^RNIhCJ[EY@PNd@dressfed.com>
1278802937:BarkOffePT`WaDMPQ]JX_HJeBUPo3QcKL`0WUT@prohug.com
1278804907:BarkOffhSWcZdGPSTIM[bKMhEXS[6TONOc3ZXW@thehappily.com>
------------------------------------------------------------------------
and nothing can stop this crap. OK, now I have improvised a filter with:
----[ '/usr/share/tdtools-procmail/FLT_weird_from' ]---------
:0
* ! ^X-TDTools-Procmail: WHITELISTED=true
* ! ? test -f ${USEWLIST} ; if [ $? -eq 0 ] ; then grep --ignore-case --regexp="${MSG_FROM}" ${USEWLIST} ; else exit 1 ; fi
{
TMPVAR1=`formail -t -r -czx To: ; :`
TMPVAR2=`echo -n "${TMPVAR1}" |sed -e 's|[-<>_.+@a-zA-Z0-9]||g' |tr -d ' ' ; :`
COUNT=`echo -n "${TMPVAR2}" |wc --chars ; :`
:0
* ? test -n "${TMPVAR2}"
{
DUMMY_EXEC=`echo "${DATE_NOW_SER}:${TMPVAR1}" >>${USEHLIST} ; :`
INCLUDERC=${TDTP_INC}/INC_mailheader_add
:0
* ? test "${TDTP_USE_TAG_N_DROP}" != "true"
${TDTP_SPAM_PREFIX}${TDTP_DATE_PREFIX}${SPAMTAG}.${TDTP_FILTER}${TDTP_LISTDIR}/
}
}
------------------------------------------------------------------------
but I want to do the scanning in spamassassin.
Any suggestions and ideas?
Thanks, Greetings and nice Day/Evening
Michelle Konzack
--
##################### Debian GNU/Linux Consultant ######################
Development of Intranet and Embedded Systems with Debian GNU/Linux
itsystems@tdnet France EURL itsystems@tdnet UG (limited liability)
Owner Michelle Konzack Owner Michelle Konzack
Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France 77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +33-9-52705884 fix
<http://www.itsystems.tamay-dogan.net/> <http://www.flexray4linux.org/>
<http://www.debian.tamay-dogan.net/> <http://www.can4linux.org/>
Jabber linux4michelle@jabber.ccc.de
ICQ #328449886
Linux-User #280138 with the Linux Counter, http://counter.li.org/
Re: How to stop weird "From:" crap?
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Sun, 2010-07-11 at 23:59 +0200, Michelle Konzack wrote:
> > On Sun, 11 Jul 2010, Karsten Bräckelmann wrote:
> > > What about providing some raw From: headers then?
> Cut the serialnumber at the beginning up to the first : and you have it.
> The From: E-Mails are exactly as shown.
Nope.
They are missing the left angle bracket, while the trailing right one is
shown. Moreover, they don't show any real-name part, if any. Thus we
cannot be sure how From, and in particular From:addr, parses these.
Hence me asking for RAW samples.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: How to stop weird "From:" crap?
Posted by Michelle Konzack <li...@tamay-dogan.net>.
Hello John Hardin,
Am 2010-07-11 08:57:39, hacktest Du folgendes herunter:
> On Sun, 11 Jul 2010, Karsten Br�ckelmann wrote:
> >What about providing some raw From: headers then?
> +1 We need to see the headers.
Cut the serialnumber at the beginning up to the first : and you have it.
The From: E-Mails are exactly as shown.
Thanks, Greetings and nice Day/Evening
Michelle Konzack
--
##################### Debian GNU/Linux Consultant ######################
Development of Intranet and Embedded Systems with Debian GNU/Linux
itsystems@tdnet France EURL itsystems@tdnet UG (limited liability)
Owner Michelle Konzack Owner Michelle Konzack
Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France 77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +33-9-52705884 fix
<http://www.itsystems.tamay-dogan.net/> <http://www.flexray4linux.org/>
<http://www.debian.tamay-dogan.net/> <http://www.can4linux.org/>
Jabber linux4michelle@jabber.ccc.de
ICQ #328449886
Linux-User #280138 with the Linux Counter, http://counter.li.org/
Re: How to stop weird "From:" crap?
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Sun, 2010-07-11 at 18:22 -0500, Dave Funk wrote:
> Rough first pass SA rule:
>
> header T_FROM_CRAP1 From:addr =~ /[`\^:\]\[,?/"]/
^ ^ ^
Breaks. You either need to backslash escape the slash inside the RE, or
use alternative match-operator delimiters like m~pattern~. :)
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: How to stop weird "From:" crap?
Posted by Dave Funk <db...@engineering.uiowa.edu>.
On Mon, 12 Jul 2010, Michelle Konzack wrote:
> ----[ STDIN ]-----------------------------------------------------------
> From CouponDept@perezcentral.com Sun Jul 11 17:21:41 2010
> Return-Path: <Co...@perezcentral.com>
> Delivered-To: linux4michelle@tamay-dogan.net
> Received: from erona.perezcentral.com (erona.perezcentral.com [::ffff:72.34.111.198])
> by mail.tamay-dogan.net with esmtp; Sun, 11 Jul 2010 17:21:14 +0200
> id 0002BDA9.4C39E16B.00001A98
> To: linux4michelle@tamay-dogan.net
> Date: Sun, 11 Jul 2010 08:20:47 -0700
> From: "Coupon Dept." <CouponDeptdOS_V`CcOP IW^GIdATOn2PbJK_/VTj@perezcentral.com>
> Subject: Your Complimentary Coupons
> Mime-Version: 1.0
> Content-Type: text/html; charset=iso-8859-1
> Content-Transfer-Encoding: 7bit
> Message-ID: <Pi...@mail.perezcentral.com>
> X-TDTools-Procmail: FILTER=FLT_weird_from, TLIST=FLT_weird_from, WLIST=FLT_weird_from, COUNT=3
> <snip>
> ------------------------------------------------------------------------
>
Rough first pass SA rule:
header T_FROM_CRAP1 From:addr =~ /[`\^:\]\[,?/"]/
describe T_FROM_CRAP1 characters we should not see in real from address
score T_FROM_CRAP1 0.1
header T_FROM_CRAP2 From:addr =~ /[^\@]*\@[^\@]*\@/
describe T_FROM_CRAP2 Real from address should not contain more than one @
score T_FROM_CRAP2 0.1
Untested. Warning could cause false positives. Some of those characters
-could- be used in legit addresses (EG X400 uses '/') but that's rare.
Test and adjust according to your mail environment.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: How to stop weird "From:" crap?
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Mon, 2010-07-12 at 01:37 +0200, Michelle Konzack wrote:
> > For me, that would be caught by dbl.spamhaus.org as a blacklisted
> > sender domain during the smtp connection.
>
> Is this not included in <zen>?
ZEN lists the handing-over IP (XBL, PBL) or any Received IP for deep-
parsing (SBL). This is not the same as an RHSBL, neither applies at all
to any domain part.
What you snipped was the reference link to DBL, given by Ned. Which
coincidentally should explain DBL, a recent Spamhaus addition...
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: How to stop weird "From:" crap?
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Mon, 2010-07-12 at 00:52 +0100, Ned Slider wrote:
> On 12/07/10 00:37, Michelle Konzack wrote:
> > > For me, that would be caught by dbl.spamhaus.org as a blacklisted
> > > sender domain during the smtp connection.
> >
> > Is this not included in<zen>?
>
> No, it's a separate list purely for domains, not IPs. SpamAssassin 3.3.1
> does add support to query dbl.spamhaus.org, but I think it only queries
> it for URIs.
Indeed. And the latter is exactly the reason, why adding support for
Spamhaus DBL was a heavy-weight change for a micro release.
> I'm see hits against sender domains in dbl.spamhaus.org for IP addresses
> that aren't yet listed on zen so querying at the smtp level in addition
> to zen is beneficial.
Just to clarify -- while this is not incorrect, even though the "yet"
might be debatable [1], it easily can be confusing. The "sender domain"
and "IP address" in the previous sentence are not related. Other than
referring to the same spam message. DBL does not list IPs.
Do NOT query DBL for IPs. Never. You will get false positives.
guenther
[1] PBL is highly unlikely to expand due to spam outbreaks. XBL might,
if the machine is malware infected. SBL of course might, but they
list IPs of pure evil only, suitable for deep-parsing.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: How to stop weird "From:" crap?
Posted by Ned Slider <ne...@unixmail.co.uk>.
On 12/07/10 00:37, Michelle Konzack wrote:
> Hello Ned Slider,
>
> Am 2010-07-11 23:38:50, hacktest Du folgendes herunter:
>> For me, that would be caught by dbl.spamhaus.org as a blacklisted
>> sender domain during the smtp connection.
>
> Is this not included in<zen>?
>
No, it's a separate list purely for domains, not IPs. SpamAssassin 3.3.1
does add support to query dbl.spamhaus.org, but I think it only queries
it for URIs.
To quote Spamhaus:
"The DBL is both a domain URI Blocklist and RHSBL. It is intended
primarily for message body URI checks but it can additionally be used
for connection checks at the SMTP level and header domain checks (HELO,
connecting IP rDNS domain, From & Reply-To domains, Message-ID domain)
and other checks involving domains."
I'm see hits against sender domains in dbl.spamhaus.org for IP addresses
that aren't yet listed on zen so querying at the smtp level in addition
to zen is beneficial.
But as we know, defence in depth, so not to detract from the rules
Karsten and others are assisting with elsewhere in this thread :-)
Re: How to stop weird "From:" crap?
Posted by Michelle Konzack <li...@tamay-dogan.net>.
Hello Ned Slider,
Am 2010-07-11 23:38:50, hacktest Du folgendes herunter:
> For me, that would be caught by dbl.spamhaus.org as a blacklisted
> sender domain during the smtp connection.
Is this not included in <zen>?
> $ nslookup perezcentral.com.dbl.spamhaus.org
>
> Non-authoritative answer:
> Name: perezcentral.com.dbl.spamhaus.org
> Address: 127.0.1.2
>
>
> For example, in postfix add to smptd_*_restrictions:
>
> reject_rhsbl_sender dbl.spamhaus.org
>
> You can also check the helo and client against dbl.spamhaus.org
>
> reject_rhsbl_helo dbl.spamhaus.org
> reject_rhsbl_client dbl.spamhaus.org
OK added, I will wait for the next crap coming in...
Thanks, Greetings and nice Day/Evening
Michelle Konzack
--
##################### Debian GNU/Linux Consultant ######################
Development of Intranet and Embedded Systems with Debian GNU/Linux
itsystems@tdnet France EURL itsystems@tdnet UG (limited liability)
Owner Michelle Konzack Owner Michelle Konzack
Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France 77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +33-9-52705884 fix
<http://www.itsystems.tamay-dogan.net/> <http://www.flexray4linux.org/>
<http://www.debian.tamay-dogan.net/> <http://www.can4linux.org/>
Jabber linux4michelle@jabber.ccc.de
ICQ #328449886
Linux-User #280138 with the Linux Counter, http://counter.li.org/
Re: How to stop weird "From:" crap?
Posted by Ned Slider <ne...@unixmail.co.uk>.
On 11/07/10 23:06, Michelle Konzack wrote:
> Hello John Hardin,
>
> Am 2010-07-11 08:57:39, hacktest Du folgendes herunter:
>> On Sun, 11 Jul 2010, Karsten Br�ckelmann wrote:
>>> What about providing some raw From: headers then?
>> +1 We need to see the headers.
>
> ----[ STDIN ]-----------------------------------------------------------
> From CouponDept@perezcentral.com Sun Jul 11 17:21:41 2010
> Return-Path:<Co...@perezcentral.com>
> Delivered-To: linux4michelle@tamay-dogan.net
> Received: from erona.perezcentral.com (erona.perezcentral.com [::ffff:72.34.111.198])
> by mail.tamay-dogan.net with esmtp; Sun, 11 Jul 2010 17:21:14 +0200
> id 0002BDA9.4C39E16B.00001A98
> To: linux4michelle@tamay-dogan.net
> Date: Sun, 11 Jul 2010 08:20:47 -0700
> From: "Coupon Dept."<CouponDeptdOS_V`CcOP IW^GIdATOn2PbJK_/VTj@perezcentral.com>
> Subject: Your Complimentary Coupons
> Mime-Version: 1.0
> Content-Type: text/html; charset=iso-8859-1
> Content-Transfer-Encoding: 7bit
> Message-ID:<Pi...@mail.perezcentral.com>
> X-TDTools-Procmail: FILTER=FLT_weird_from, TLIST=FLT_weird_from, WLIST=FLT_weird_from, COUNT=3
> <snip>
> ------------------------------------------------------------------------
>
> Thanks, Greetings and nice Day/Evening
> Michelle Konzack
>
For me, that would be caught by dbl.spamhaus.org as a blacklisted sender
domain during the smtp connection.
$ nslookup perezcentral.com.dbl.spamhaus.org
Non-authoritative answer:
Name: perezcentral.com.dbl.spamhaus.org
Address: 127.0.1.2
For example, in postfix add to smptd_*_restrictions:
reject_rhsbl_sender dbl.spamhaus.org
You can also check the helo and client against dbl.spamhaus.org
reject_rhsbl_helo dbl.spamhaus.org
reject_rhsbl_client dbl.spamhaus.org
Ref: http://www.spamhaus.org/dbl/
Re: How to stop weird "From:" crap?
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Mon, 2010-07-12 at 00:06 +0200, Michelle Konzack wrote:
> > On Sun, 11 Jul 2010, Karsten Bräckelmann wrote:
> > > What about providing some raw From: headers then?
> From CouponDept@perezcentral.com Sun Jul 11 17:21:41 2010
> Return-Path: <Co...@perezcentral.com>
Err, didn't you say you don't have the Envelope From, and your MTA shows
the same as the mangled From: headers?
> From: "Coupon Dept." <CouponDeptdOS_V`CcOP IW^GIdATOn2PbJK_/VTj@perezcentral.com>
header FOO From:addr =~ m~[/ ]~
Works for me. Just a minimal example rule, in particular leaving out the
pesky backtick, confusing bash parsing the ad-hoc test rule. ;)
spamassassin -D --cf="header FOO From:addr =~ m~.+~"
shows, that From:addr contains the entire string contained in the angle
brackets. I wonder, where your problems where writing the rule.
Debugging and ad-hoc rule development hint: See the --cf option as used
above. Together with -D, SA will report the matching substring. Then,
just craft a bare-minimum "mail message", containing the stuff you want
to trigger on. Generally, looks like this. Optionally use --cf to
disable AWL and Bayes respectively.
echo "From: ...\n\n" | spamassassin -D
Hmm, writing this post took much longer than writing the rule... ;)
guenther
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: [sa] Re: How to stop weird "From:" crap?
Posted by Charles Gregory <cg...@hwcn.org>.
On Mon, 12 Jul 2010, Karsten Bräckelmann wrote:
>> header LOC_WEIRD_FROM From =~ /<[^\@\>]*[\^\`\ ][^\@\>]*@/
>> # note: the '[^\@\>]*' confines the match to within a local address part
> Using From:addr instead is better and more accurate.
Provided the spammer doesn't use more than one address on the From
header..... :)
> That RE is more complicate than it needs to, yet might even match the
> real name. From is not From:raw.
From:raw, acording to docs, only prevents decoding of quoted printable
and base 64 strings, and preserves whitespace. So the RE, as given, looks
for the angel bracket at the beginning of ALL possible addresses, and
scans for the undesirable characters. I don't see any unnecessary
complexity in the RE (except that yes, you could use From:addr and
eliminate the sections that pin-down address, but I've already explained I
prefer an RE that captures ALL addresses, not just the first).
As a footnote to OP, these characters ARE 'legal' even though rarely used.
That's why you can't score too high...
> But I posted that solution yesterday already. Coming late to the show,
> eh? ;)
1) Syadmins New Year's Resolution: I will read all posts before
responding.
2) Sorry, I got used to seeing so much *discussion* trying to dissect what
was, to me, an obvious problem that I got fed up with it, and figured no
one else was posting a rule, so I would....
Great minds, and all that? :)
- C
Re: How to stop weird "From:" crap?
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
> header LOC_WEIRD_FROM From =~ /<[^\@\>]*[\^\`\ ][^\@\>]*@/
> # note: the '[^\@\>]*' confines the match to within a local address part
Using From:addr instead is better and more accurate. That RE is more
complicate than it needs to, yet might even match the real name. From is
not From:raw.
But I posted that solution yesterday already. Coming late to the show,
eh? ;)
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: How to stop weird "From:" crap?
Posted by Charles Gregory <cg...@hwcn.org>.
On Mon, 12 Jul 2010, Michelle Konzack wrote:
> From: "Coupon Dept." <CouponDeptdOS_V`CcOP IW^GIdATOn2PbJK_/VTj@perezcentral.com>
I realize that the spammers will soon recognize that you are filtering
them, but for the moment, why not score heavily on the 'unusual'
characters inside these coded addresses?
header LOC_WEIRD_FROM From =~ /<[^\@\>]*[\^\`\ ][^\@\>]*@/
score LOC_WEIRD_FROM 2
# not too high a score, just enough to tip them over...
# note: the '[^\@\>]*' confines the match to within a local address part
- C
Re: How to stop weird "From:" crap?
Posted by Michelle Konzack <li...@tamay-dogan.net>.
Hello John Hardin,
Am 2010-07-11 08:57:39, hacktest Du folgendes herunter:
> On Sun, 11 Jul 2010, Karsten Br�ckelmann wrote:
> >What about providing some raw From: headers then?
> +1 We need to see the headers.
----[ STDIN ]-----------------------------------------------------------
From CouponDept@perezcentral.com Sun Jul 11 17:21:41 2010
Return-Path: <Co...@perezcentral.com>
Delivered-To: linux4michelle@tamay-dogan.net
Received: from erona.perezcentral.com (erona.perezcentral.com [::ffff:72.34.111.198])
by mail.tamay-dogan.net with esmtp; Sun, 11 Jul 2010 17:21:14 +0200
id 0002BDA9.4C39E16B.00001A98
To: linux4michelle@tamay-dogan.net
Date: Sun, 11 Jul 2010 08:20:47 -0700
From: "Coupon Dept." <CouponDeptdOS_V`CcOP IW^GIdATOn2PbJK_/VTj@perezcentral.com>
Subject: Your Complimentary Coupons
Mime-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
Message-ID: <Pi...@mail.perezcentral.com>
X-TDTools-Procmail: FILTER=FLT_weird_from, TLIST=FLT_weird_from, WLIST=FLT_weird_from, COUNT=3
<snip>
------------------------------------------------------------------------
Thanks, Greetings and nice Day/Evening
Michelle Konzack
--
##################### Debian GNU/Linux Consultant ######################
Development of Intranet and Embedded Systems with Debian GNU/Linux
itsystems@tdnet France EURL itsystems@tdnet UG (limited liability)
Owner Michelle Konzack Owner Michelle Konzack
Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France 77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +33-9-52705884 fix
<http://www.itsystems.tamay-dogan.net/> <http://www.flexray4linux.org/>
<http://www.debian.tamay-dogan.net/> <http://www.can4linux.org/>
Jabber linux4michelle@jabber.ccc.de
ICQ #328449886
Linux-User #280138 with the Linux Counter, http://counter.li.org/
Re: How to stop weird "From:" crap?
Posted by John Hardin <jh...@impsec.org>.
On Sun, 11 Jul 2010, Karsten Br�ckelmann wrote:
> On Sun, 2010-07-11 at 17:35 +0200, Michelle Konzack wrote:
>>> Didn't have sufficient caffeine yet, and I am too lazy to go through
>>> that procmail logic in detail -- but looking at the samples, you want to
>>> identify junk chars in the From: header?
>>
>> Yes
>>
>>> Well, what about a header From rule, maybe even limited to From:addr?
>>> Or some raw headers, like From:raw or even the hammer ALL pseudo
>>> header.
>>
>> I have tried to write one but failed...
>
> What about providing some raw From: headers then?
+1 We need to see the headers.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Gun Control laws aren't enacted to control guns, they are enacted
to control people: catholics (1500s), japanese peasants (1600s),
blacks (1860s), italian immigrants (1911), the irish (1920s),
jews (1930s), blacks (1960s), the poor (always)
-----------------------------------------------------------------------
5 days until the 65th anniversary of the dawn of the Atomic Age
Re: How to stop weird "From:" crap?
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Sun, 2010-07-11 at 17:35 +0200, Michelle Konzack wrote:
> > Didn't have sufficient caffeine yet, and I am too lazy to go through
> > that procmail logic in detail -- but looking at the samples, you want to
> > identify junk chars in the From: header?
>
> Yes
>
> > Well, what about a header From rule, maybe even limited to From:addr? Or
> > some raw headers, like From:raw or even the hammer ALL pseudo header.
>
> I have tried to write one but failed...
What about providing some raw From: headers then?
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: How to stop weird "From:" crap?
Posted by Michelle Konzack <li...@tamay-dogan.net>.
Hello Karsten Bräckelmann,
Am 2010-07-11 16:21:49, hacktest Du folgendes herunter:
> Didn't have sufficient caffeine yet, and I am too lazy to go through
> that procmail logic in detail -- but looking at the samples, you want to
> identify junk chars in the From: header?
Yes
> Well, what about a header From rule, maybe even limited to From:addr? Or
> some raw headers, like From:raw or even the hammer ALL pseudo header.
I have tried to write one but failed...
> I assume the Envelope From doesn't look the same, does it? Otherwise,
> you could already have your MX reject them outright.
I do not know WHO has send it, because there are no other header like
"Sender:" or "Envelope-From:" in the messages and the courier logs show
the same.
Currently I run the check on USER level, but I like to do this check on
SMTP level using amavis and spamassassin.
Thanks, Greetings and nice Day/Evening
Michelle Konzack
--
##################### Debian GNU/Linux Consultant ######################
Development of Intranet and Embedded Systems with Debian GNU/Linux
itsystems@tdnet France EURL itsystems@tdnet UG (limited liability)
Owner Michelle Konzack Owner Michelle Konzack
Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France 77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +33-9-52705884 fix
<http://www.itsystems.tamay-dogan.net/> <http://www.flexray4linux.org/>
<http://www.debian.tamay-dogan.net/> <http://www.can4linux.org/>
Jabber linux4michelle@jabber.ccc.de
ICQ #328449886
Linux-User #280138 with the Linux Counter, http://counter.li.org/
Re: How to stop weird "From:" crap?
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Sun, 2010-07-11 at 12:49 +0200, Michelle Konzack wrote:
> Hello Experts,
>
> since arround 9 weeks I become bombed on my E-Mails <linux4michelle> and
> <michelle.konzack> by crappy From: spams. Here some examples from my
> log:
[garbled address samples snipped]
> but I want to do the scanning in spamassassin.
>
> Any suggestions and ideas?
Didn't have sufficient caffeine yet, and I am too lazy to go through
that procmail logic in detail -- but looking at the samples, you want to
identify junk chars in the From: header?
Well, what about a header From rule, maybe even limited to From:addr? Or
some raw headers, like From:raw or even the hammer ALL pseudo header.
I assume the Envelope From doesn't look the same, does it? Otherwise,
you could already have your MX reject them outright.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}