You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Kenneth Porter <sh...@sewingwitch.com> on 2009/11/16 17:54:26 UTC
Google feedproxy redirector abuse
I've been seeing pill spam with lots of identical URIs pointing at
feedproxy.google.com over the last week or two. All the URI's seem to be
this (leading http slash slash removed):
feedproxy.google.com/~r/CraigslistHoustonAllForSale/WantedSearchquothealthquot/~3/3yX2enlGlyE/
I've no idea where to report this. Going to the root of Google's site
reveals no abuse report links.
Re: Google feedproxy redirector abuse
Posted by John Hardin <jh...@impsec.org>.
On Fri, 20 Nov 2009, Kenneth Porter wrote:
> --On Monday, November 16, 2009 10:27 AM -0800 John Hardin
> <jh...@impsec.org> wrote:
>
>> meta MANY_GOOG_PROXY __FEEDPROXY > 5
>
> Got one with exactly 5 today. Looks like they're learning.
Dammit. I should have sent that to you offlist. :(
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
When designing software, any time you think to yourself "a user
would never be stupid enough to do *that*", you're wrong.
-----------------------------------------------------------------------
42 days since President Obama won the Nobel "Not George W. Bush" prize
Re: Google feedproxy redirector abuse
Posted by Kenneth Porter <sh...@sewingwitch.com>.
--On Monday, November 16, 2009 10:27 AM -0800 John Hardin
<jh...@impsec.org> wrote:
> meta MANY_GOOG_PROXY __FEEDPROXY > 5
Got one with exactly 5 today. Looks like they're learning.
Re: Google feedproxy redirector abuse
Posted by John Hardin <jh...@impsec.org>.
On Mon, 16 Nov 2009, Kenneth Porter wrote:
> I've been seeing pill spam with lots of identical URIs pointing at
> feedproxy.google.com over the last week or two. All the URI's seem to be
> this (leading http slash slash removed):
>
> feedproxy.google.com/~r/CraigslistHoustonAllForSale/WantedSearchquothealthquot/~3/3yX2enlGlyE/
>
> I've no idea where to report this. Going to the root of Google's site
> reveals no abuse report links.
Can't help with reporting it to goog, but this has been in my sandbox for
a bit. It might help:
rawbody __FEEDPROXY m;http://feedproxy\.google\.com/;
tflags __FEEDPROXY multiple
meta MANY_GOOG_PROXY __FEEDPROXY > 5
describe MANY_GOOG_PROXY Many Google feedproxy URIs
It has to be a rawbody rule because uri rules collapse multiple hits on
the same URI.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
A well educated Electorate, being necessary to the liberty of a
free State, the Right of the People to Keep and Read Books,
shall not be infringed.
-----------------------------------------------------------------------
38 days since President Obama won the Nobel "Not George W. Bush" prize