You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Bram Mertens <br...@linux.be> on 2004/04/10 17:12:15 UTC
Re: rule to catch fake bounce messages (need regex help)
On Mon, 2004-03-29 at 20:46, Kevin Peuhkurinen wrote:
> Hmmm.... try
>
> body __M8RAM_FAKE_BOUNCE /From\:\s".*"\s*<bram-mertens\@linux\.be>/i
> body __M8RAM_FAKE_BOUNCE1
> /From\:\s"(?:bram\smertens|mertens,{0,1}\s{0,1}bram)"\s*<bram-mertens\@linux\.be>/i
> meta M8RAM_FAKE_BOUNCE2 (__M8RAM_FAKE_BOUNCE && !__M8RAM_FAKE_BOUNCE1)
> describe M8RAM_FAKE_BOUNCE2 Spoofed bounce to me
> score M8RAM_FAKE_BOUNCE2 0.01
Thanks for the help, I finally finished and tested the rule, here it is:
body __M8RAM_FAKE_BOUNCE_SUB1 /From\:\s.{0,30}\s*<my_email_address>/i
body __M8RAM_FAKE_BOUNCE_SUB2 /from\:\s(?!(?:Bram\sMertens\s)|(?:Mertens\sBram\s)<my_email_address>)/i
meta M8RAM_FAKE_BOUNCE (__M8RAM_FAKE_BOUNCE_SUB1 && __M8RAM_FAKE_BOUNCE_SUB2)
score M8RAM_FAKE_BOUNCE 10.0
describe M8RAM_FAKE_BOUNCE Attached bounce contains my address but I never sent this!
__M8RAM_FAKE_BOUNCE_SUB1 looks for a combination of "From:" and my
e-mail address, like Kevin suggested, I only made sure it won't check
the entire body.
I need this part because __M8RAM_FAKE_BOUNCE_SUB2 looks for "From:" and
my e-mail address not preceded by my name.
However this means it also triggers on "From:" followed by anything that
doesn't contain my e-mail address.
The score is probably a bit high, but I needed to counter some negative
scores some of these spoofed messages got.
HTH
Bram
--
# Mertens Bram "M8ram" <br...@linux.be> Linux User #349737 #
# SuSE Linux 8.2 (i586) kernel 2.4.20-4GB i686 256MB RAM #
# 4:55pm up 19 days 20:32, 10 users, load average: 0.12, 0.09, 0.09 #
RE: rule to catch fake bounce messages (need regex help)
Posted by Bram Mertens <br...@linux.be>.
On Sun, 2004-04-11 at 12:12, Ilan Aisic wrote:
> These rule will also be triggered by legit bounce.
> How can you be sure that you've never sent it unless you only use one mail
> client, keep a copy of everything you send and check against it?
Unless I'm mistaken all legit bounces should contain the From-header my
mail client adds to all outgoing messages, right?
My (only) mail client adds the following From header:
From: Bram Mertens <my_email_address>
SUB2 checks for this header and a variation I used a long time ago,
actually I could remove that part because any bounces I would receive
containing that header are most likely spoofed as well. (The last time
I sent a message with a From header containing "Mertens Bram
<my_email_address> was sent on 14 Feb 2003.
So unless some mailer daemons edit the headers of messages they bounce I
shouldn't get FP's right?
Thanks
Bram
[...]
> > -----Original Message-----
> > From: Bram Mertens [mailto:bram-mertens@linux.be]
> [...]
> > Thanks for the help, I finally finished and tested the rule,
> > here it is:
> >
> > body __M8RAM_FAKE_BOUNCE_SUB1
> > /From\:\s.{0,30}\s*<my_email_address>/i
> > body __M8RAM_FAKE_BOUNCE_SUB2
> > /from\:\s(?!(?:Bram\sMertens\s)|(?:Mertens\sBram\s)<my_email_a
> > ddress>)/i
> > meta M8RAM_FAKE_BOUNCE (__M8RAM_FAKE_BOUNCE_SUB1 &&
> > __M8RAM_FAKE_BOUNCE_SUB2)
> > score M8RAM_FAKE_BOUNCE 10.0
> > describe M8RAM_FAKE_BOUNCE Attached bounce contains my
> > address but I never sent this!
> >
> >
> > __M8RAM_FAKE_BOUNCE_SUB1 looks for a combination of "From:"
> > and my e-mail address, like Kevin suggested, I only made sure
> > it won't check the entire body. I need this part because
> > __M8RAM_FAKE_BOUNCE_SUB2 looks for "From:" and my e-mail
> > address not preceded by my name. However this means it also
> > triggers on "From:" followed by anything that doesn't contain
> > my e-mail address.
[...]
--
# Mertens Bram "M8ram" <br...@linux.be> Linux User #349737 #
# SuSE Linux 8.2 (i586) kernel 2.4.20-4GB i686 256MB RAM #
# 9:46am up 21 days 13:23, 10 users, load average: 0.43, 0.25, 0.11 #
RE: rule to catch fake bounce messages (need regex help)
Posted by Ilan Aisic <il...@pointer.co.il>.
These rule will also be triggered by legit bounce.
How can you be sure that you've never sent it unless you only use one mail
client, keep a copy of everything you send and check against it?
--
Ilan Aisic
> -----Original Message-----
> From: Bram Mertens [mailto:bram-mertens@linux.be]
> Sent: Saturday, April 10, 2004 5:12 PM
> To: spamassassin
> Subject: Re: rule to catch fake bounce messages (need regex help)
>
>
> On Mon, 2004-03-29 at 20:46, Kevin Peuhkurinen wrote:
> > Hmmm.... try
> >
> > body __M8RAM_FAKE_BOUNCE
> /From\:\s".*"\s*<bram-mertens\@linux\.be>/i
> > body __M8RAM_FAKE_BOUNCE1
> >
> /From\:\s"(?:bram\smertens|mertens,{0,1}\s{0,1}bram)"\s*<bram-
> mertens\@linux\.be>/i
> > meta M8RAM_FAKE_BOUNCE2 (__M8RAM_FAKE_BOUNCE &&
> !__M8RAM_FAKE_BOUNCE1)
> > describe M8RAM_FAKE_BOUNCE2 Spoofed bounce to me
> > score M8RAM_FAKE_BOUNCE2 0.01
>
> Thanks for the help, I finally finished and tested the rule,
> here it is:
>
> body __M8RAM_FAKE_BOUNCE_SUB1
> /From\:\s.{0,30}\s*<my_email_address>/i
> body __M8RAM_FAKE_BOUNCE_SUB2
> /from\:\s(?!(?:Bram\sMertens\s)|(?:Mertens\sBram\s)<my_email_a
> ddress>)/i
> meta M8RAM_FAKE_BOUNCE (__M8RAM_FAKE_BOUNCE_SUB1 &&
> __M8RAM_FAKE_BOUNCE_SUB2)
> score M8RAM_FAKE_BOUNCE 10.0
> describe M8RAM_FAKE_BOUNCE Attached bounce contains my
> address but I never sent this!
>
>
> __M8RAM_FAKE_BOUNCE_SUB1 looks for a combination of "From:"
> and my e-mail address, like Kevin suggested, I only made sure
> it won't check the entire body. I need this part because
> __M8RAM_FAKE_BOUNCE_SUB2 looks for "From:" and my e-mail
> address not preceded by my name. However this means it also
> triggers on "From:" followed by anything that doesn't contain
> my e-mail address.
>
> The score is probably a bit high, but I needed to counter
> some negative scores some of these spoofed messages got.
>
> HTH
>
> Bram
> --
> # Mertens Bram "M8ram" <br...@linux.be> Linux User
> #349737 #
> # SuSE Linux 8.2 (i586) kernel 2.4.20-4GB i686
> 256MB RAM #
> # 4:55pm up 19 days 20:32, 10 users, load average: 0.12,
> 0.09, 0.09 #
>
>