You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by AJ Weber <aw...@comcast.net> on 2024/11/21 12:57:45 UTC
Paypal phishing?
I saw a "conversation" a few weeks ago regarding paypal phishing emails
that were not being caught.
I can't recall if anyone found a reasonable solution (or new rules).
I just received one and it seems very well crafted. Is anyone still
collecting samples and wants this one too?
Thanks for any recap anyone can provide.
-AJ
Re: [External] Paypal phishing?
Posted by "Kevin A. McGrail" <km...@apache.org>.
Hi AJ, thanks for the kind words. The KAM ruleset is NOT included with
the main rules update. See https://mcgrail.com/template/kam.cf_channel
As for why, the rulset doesn't go through the same ASF voting process or
the Apache SpamAssassin QA process. This is because it been difficult
to figure out how to meet my main goal (super fast updates), and still
meet the Apache Software Foundation release standards. So it's under
the McGrail Foundation which makes it easier to do it well but differently.
<donation request>For the McGrail Foundation, Linode donates the servers
for the RBL, and PCCC donates all the labor to maintain the list.
Otherwise we are very thrifty with volunteers-only! We just celebrated
20 years of the KAM ruleset in May of this Year. If you can help, we
are looking for donors for our 2025 planned expenses. If your company
uses our ruleset, we'd love to discuss a sponsorship opportunity and any
donations are appreciated. https://mcgrail.com/template/donate
</donation request>
Regards,
KAM
On 11/21/2024 10:45 AM, AJ Weber wrote:
> Thanks Kevin,
>
> Have trusted KAM rules for a long time. I assume they're still now in
> the main rules updates? I'll double-check my logs to make sure I'm
> fetching the latest.
>
> -AJ
>
>
> On 11/21/2024 8:11 AM, Kevin A. McGrail wrote:
>> I can't provide a recap but I can tell you that the KAM Ruleset has
>> been consistently looking at these, blocking phone numbers, looking
>> at their techniques, adding rules, etc. It's very frustrating though
>> because they seem to be abusing PayPal's systems to send them.
>>
>> The key pattern that I've noticed is that they all contain a phone
>> number to call.
>>
>> Side note: Any one got a good contact at the FCC? I've been wanting
>> to talk to them so they can figure out what provider(s) are
>> facilitating this.
>>
>> Regards,
>>
>> KAM
>>
>> On 11/21/2024 7:57 AM, AJ Weber wrote:
>>> I saw a "conversation" a few weeks ago regarding paypal phishing
>>> emails that were not being caught.
>>>
>>> I can't recall if anyone found a reasonable solution (or new rules).
>>>
>>> I just received one and it seems very well crafted. Is anyone still
>>> collecting samples and wants this one too?
>>>
>>> Thanks for any recap anyone can provide.
>>
--
Kevin A. McGrail
KMcGrail@Apache.org
Member, Apache Software Foundation
Chair Emeritus Apache SpamAssassin Project
https://www.linkedin.com/in/kmcgrail - 703.798.0171
Re: Paypal phishing - ADDL NOTES
Posted by AJ Weber <aw...@comcast.net>.
I coincidentally have a legit PP email/notification from just a day
ago. Some things to note:
LEGIT:
X-Spam-DCC:www.nova53.net: app3 1207; Body=1 Fuz1=1 Fuz2=1
From:"service@paypal.com" <se...@paypal.com>
To: AW <xxxxx.yyy.com>
Subject: You authorized a payment to
((To is actually my email address))
FAKES:
X-Spam-DCC:www.nova53.net: app3 1207; Body=55 Fuz1=98 Fuz2=many
X-OriginatorOrg: smkelopuramy.onmicrosoft.com
From:"service@paypal.com" <se...@paypal.com>
To:Billingdepartments1@smkelopuramy.onmicrosoft.com
Subject: This money request has been updated
X-Spam-DCC:www.nova53.net: app3 1207; Body=3 Fuz1=1 Fuz2=many
X-OriginatorOrg: serenashop.store
From:"service@paypal.com" <se...@paypal.com>
To:"Invoice-update8@serenashop. store" <In...@serenashop.store>
Subject: Invoice from Michelle Miller (0073)
** No X-OriginatorOrg header in legit email.
** Legit has all "US" relays, and much shorter (4). Fakes have one "**" relay (I guess undetermined) and much longer. But don't know how much that would help.
Re: [External] Paypal phishing?
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 2024-11-21 at 11:26:35 UTC-0500 (Thu, 21 Nov 2024 11:26:35 -0500)
AJ Weber <aw...@comcast.net>
is rumored to have said:
> Thanks Bill,
>
> I just went back to check and IDK when it started, but I have a perl
> issue:
>
> spamassassin --lint
> Subroutine File::Spec::Unix::canonpath redefined at
> /usr/share/perl5/XSLoader.pm line 111.
> Subroutine File::Spec::Unix::catdir redefined at
> /usr/share/perl5/XSLoader.pm line 111.
> Subroutine File::Spec::Unix::catfile redefined at
> /usr/share/perl5/XSLoader.pm line 111.
>
> (I do have the KAM channel separately on my sa-update.)
>
> I only see a response to this issue from 2016...anyone have a tidy way
> for me to "fix" this perl issue???
I think those are just warnings, but it *may* indicate that you need to
reinstall File::Spec::Unix, which is part of the PathTools distribution.
>
> Thanks again
>
>
> On 11/21/2024 11:23 AM, Bill Cole wrote:
>> On 2024-11-21 at 10:45:58 UTC-0500 (Thu, 21 Nov 2024 10:45:58 -0500)
>> AJ Weber <aw...@comcast.net>
>> is rumored to have said:
>>
>>> Thanks Kevin,
>>>
>>> Have trusted KAM rules for a long time. I assume they're still now
>>> in the main rules updates?
>> The KAM rules are an independent rules channel that you must
>> explicitly set up.
>>
>> Unlike the rules maintained by the SpamAssassin Project, the KAM
>> rules are not subjected to the RuleQA process which re-scores the
>> default rules nightly and automatically avoids widespread FPs.
>>
>>> I'll double-check my logs to make sure I'm fetching the latest.
>> It is simple to set up the KAM rules channel alongside the default
>> rules channel to assure that you get updates regularly.
>>
>>> -AJ
>>>
>>>
>>> On 11/21/2024 8:11 AM, Kevin A. McGrail wrote:
>>>> I can't provide a recap but I can tell you that the KAM Ruleset has
>>>> been consistently looking at these, blocking phone numbers, looking
>>>> at their techniques, adding rules, etc. It's very frustrating
>>>> though because they seem to be abusing PayPal's systems to send
>>>> them.
>>>>
>>>> The key pattern that I've noticed is that they all contain a phone
>>>> number to call.
>>>>
>>>> Side note: Any one got a good contact at the FCC? I've been wanting
>>>> to talk to them so they can figure out what provider(s) are
>>>> facilitating this.
>>>>
>>>> Regards,
>>>>
>>>> KAM
>>>>
>>>> On 11/21/2024 7:57 AM, AJ Weber wrote:
>>>>> I saw a "conversation" a few weeks ago regarding paypal phishing
>>>>> emails that were not being caught.
>>>>>
>>>>> I can't recall if anyone found a reasonable solution (or new
>>>>> rules).
>>>>>
>>>>> I just received one and it seems very well crafted. Is anyone
>>>>> still collecting samples and wants this one too?
>>>>>
>>>>> Thanks for any recap anyone can provide.
>>
--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo@toad.social and many *@billmail.scconsult.com
addresses)
Not Currently Available For Hire
Re: [External] Paypal phishing?
Posted by AJ Weber <aw...@comcast.net>.
Thanks Bill,
I just went back to check and IDK when it started, but I have a perl issue:
spamassassin --lint
Subroutine File::Spec::Unix::canonpath redefined at
/usr/share/perl5/XSLoader.pm line 111.
Subroutine File::Spec::Unix::catdir redefined at
/usr/share/perl5/XSLoader.pm line 111.
Subroutine File::Spec::Unix::catfile redefined at
/usr/share/perl5/XSLoader.pm line 111.
(I do have the KAM channel separately on my sa-update.)
I only see a response to this issue from 2016...anyone have a tidy way
for me to "fix" this perl issue???
Thanks again
On 11/21/2024 11:23 AM, Bill Cole wrote:
> On 2024-11-21 at 10:45:58 UTC-0500 (Thu, 21 Nov 2024 10:45:58 -0500)
> AJ Weber <aw...@comcast.net>
> is rumored to have said:
>
>> Thanks Kevin,
>>
>> Have trusted KAM rules for a long time. I assume they're still now in the main rules updates?
> The KAM rules are an independent rules channel that you must explicitly set up.
>
> Unlike the rules maintained by the SpamAssassin Project, the KAM rules are not subjected to the RuleQA process which re-scores the default rules nightly and automatically avoids widespread FPs.
>
>> I'll double-check my logs to make sure I'm fetching the latest.
> It is simple to set up the KAM rules channel alongside the default rules channel to assure that you get updates regularly.
>
>> -AJ
>>
>>
>> On 11/21/2024 8:11 AM, Kevin A. McGrail wrote:
>>> I can't provide a recap but I can tell you that the KAM Ruleset has been consistently looking at these, blocking phone numbers, looking at their techniques, adding rules, etc. It's very frustrating though because they seem to be abusing PayPal's systems to send them.
>>>
>>> The key pattern that I've noticed is that they all contain a phone number to call.
>>>
>>> Side note: Any one got a good contact at the FCC? I've been wanting to talk to them so they can figure out what provider(s) are facilitating this.
>>>
>>> Regards,
>>>
>>> KAM
>>>
>>> On 11/21/2024 7:57 AM, AJ Weber wrote:
>>>> I saw a "conversation" a few weeks ago regarding paypal phishing emails that were not being caught.
>>>>
>>>> I can't recall if anyone found a reasonable solution (or new rules).
>>>>
>>>> I just received one and it seems very well crafted. Is anyone still collecting samples and wants this one too?
>>>>
>>>> Thanks for any recap anyone can provide.
>
Re: [External] Paypal phishing?
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 2024-11-21 at 10:45:58 UTC-0500 (Thu, 21 Nov 2024 10:45:58 -0500)
AJ Weber <aw...@comcast.net>
is rumored to have said:
> Thanks Kevin,
>
> Have trusted KAM rules for a long time. I assume they're still now in the main rules updates?
The KAM rules are an independent rules channel that you must explicitly set up.
Unlike the rules maintained by the SpamAssassin Project, the KAM rules are not subjected to the RuleQA process which re-scores the default rules nightly and automatically avoids widespread FPs.
> I'll double-check my logs to make sure I'm fetching the latest.
It is simple to set up the KAM rules channel alongside the default rules channel to assure that you get updates regularly.
>
> -AJ
>
>
> On 11/21/2024 8:11 AM, Kevin A. McGrail wrote:
>> I can't provide a recap but I can tell you that the KAM Ruleset has been consistently looking at these, blocking phone numbers, looking at their techniques, adding rules, etc. It's very frustrating though because they seem to be abusing PayPal's systems to send them.
>>
>> The key pattern that I've noticed is that they all contain a phone number to call.
>>
>> Side note: Any one got a good contact at the FCC? I've been wanting to talk to them so they can figure out what provider(s) are facilitating this.
>>
>> Regards,
>>
>> KAM
>>
>> On 11/21/2024 7:57 AM, AJ Weber wrote:
>>> I saw a "conversation" a few weeks ago regarding paypal phishing emails that were not being caught.
>>>
>>> I can't recall if anyone found a reasonable solution (or new rules).
>>>
>>> I just received one and it seems very well crafted. Is anyone still collecting samples and wants this one too?
>>>
>>> Thanks for any recap anyone can provide.
>>
--
Bill Cole
Re: [External] Paypal phishing?
Posted by AJ Weber <aw...@comcast.net>.
Thanks Kevin,
Have trusted KAM rules for a long time. I assume they're still now in
the main rules updates? I'll double-check my logs to make sure I'm
fetching the latest.
-AJ
On 11/21/2024 8:11 AM, Kevin A. McGrail wrote:
> I can't provide a recap but I can tell you that the KAM Ruleset has
> been consistently looking at these, blocking phone numbers, looking at
> their techniques, adding rules, etc. It's very frustrating though
> because they seem to be abusing PayPal's systems to send them.
>
> The key pattern that I've noticed is that they all contain a phone
> number to call.
>
> Side note: Any one got a good contact at the FCC? I've been wanting to
> talk to them so they can figure out what provider(s) are facilitating
> this.
>
> Regards,
>
> KAM
>
> On 11/21/2024 7:57 AM, AJ Weber wrote:
>> I saw a "conversation" a few weeks ago regarding paypal phishing
>> emails that were not being caught.
>>
>> I can't recall if anyone found a reasonable solution (or new rules).
>>
>> I just received one and it seems very well crafted. Is anyone still
>> collecting samples and wants this one too?
>>
>> Thanks for any recap anyone can provide.
>
Re: [External] Paypal phishing?
Posted by "Kevin A. McGrail" <km...@apache.org>.
I can't provide a recap but I can tell you that the KAM Ruleset has been
consistently looking at these, blocking phone numbers, looking at their
techniques, adding rules, etc. It's very frustrating though because
they seem to be abusing PayPal's systems to send them.
The key pattern that I've noticed is that they all contain a phone
number to call.
Side note: Any one got a good contact at the FCC? I've been wanting to
talk to them so they can figure out what provider(s) are facilitating this.
Regards,
KAM
On 11/21/2024 7:57 AM, AJ Weber wrote:
> I saw a "conversation" a few weeks ago regarding paypal phishing
> emails that were not being caught.
>
> I can't recall if anyone found a reasonable solution (or new rules).
>
> I just received one and it seems very well crafted. Is anyone still
> collecting samples and wants this one too?
>
> Thanks for any recap anyone can provide.
--
Kevin A. McGrail
KMcGrail@Apache.org
Member, Apache Software Foundation
Chair Emeritus Apache SpamAssassin Project
https://www.linkedin.com/in/kmcgrail - 703.798.0171
Re: Paypal phishing?
Posted by Benny Pedersen <me...@junc.eu>.
AJ Weber skrev den 2024-11-21 13:57:
> I saw a "conversation" a few weeks ago regarding paypal phishing emails
> that were not being caught.
>
> I can't recall if anyone found a reasonable solution (or new rules).
>
> I just received one and it seems very well crafted. Is anyone still
> collecting samples and wants this one too?
https://github.com/fastmail/mail-dkim/issues/35
imho paypal dont care if message-id is not dkim signed
is you phish same ?
Re: Paypal phishing?
Posted by Jared Hall via users <us...@spamassassin.apache.org>.
On 11/21/2024 7:57 AM, AJ Weber wrote:
> I saw a "conversation" a few weeks ago regarding paypal phishing
> emails that were not being caught.
>
> I can't recall if anyone found a reasonable solution (or new rules).
>
BOLO for my email.
That is the complete PayPal stanza from Jared Rulez PHISH rules corpus.
Rules 3 and 4 are
commented out as you won't have the regexes behind them. I doubt you
need them for your issue.
Scores are set at 15 to offset SA's default DKIM Welcomelist score.
Happy Trails,
-- Jared Hall
jared@jaredsec.com
Available for hire.
Re: Paypal phishing?
Posted by AJ Weber <aw...@comcast.net>.
These look useful, and I'll likely put them on my server, but the one I
just received is an "Invoice Request". It doesn't have the traditional,
"we've detected unusual activity" kind of language.
I started scanning through the plain text (not wanting to trigger any of
the http links) and the requestor is from a "store" that just registered
their domain last month via cheapdomains and country-code for the
registration (which is "private") is Iceland.
Most of the relays are through outlook.com. Here's some of the
somewhat-relevant header info:
Authentication-Results: spf=pass (sender IP is 66.211.170.93)
smtp.mailfrom=paypal.com; dkim=pass (signature was verified)
header.d=paypal.com;dmarc=pass action=none header.from=paypal.com;
Received-SPF: Pass (protection.outlook.com: domain of paypal.com designates
66.211.170.93 as permitted sender) receiver=protection.outlook.com;
client-ip=66.211.170.93; helo=mx9.phx.paypal.com; pr=C
Received: from mx9.phx.paypal.com (66.211.170.93) by
SN1PEPF0002636A.mail.protection.outlook.com (10.167.241.135) with
Microsoft
SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.8182.16 via Frontend Transport; Wed, 20 Nov 2024 16:46:55 +0000
DKIM-Signature: v=1; a=rsa-sha256; d=paypal.com; s=pp-dkim1;
c=relaxed/relaxed;
q=dns/txt; i=@paypal.com; t=1732121214;
h=From:From:Subject:Date:To:MIME-Version:Content-Type;
bh=sjZqBd/pJ48V/boeNBoBSYq6r8uaGQRwW9DNRqL+x8w=;
b=Wazi7D82oQ/jdMmMasCKUIGWazMGAqIDHH0P0Sz4OcZ6DBxffiBKMKykCHyQkbrd
vUK8lPk2FLoxpf/D4dGW1zzjkC1VgOQNCegjRpamCjW4bcdmF4C42IYxBM78didc
dHnqWDJEJeguPJOwd3IyVIGODs2poFMLti5Ubiki9QYBrqCss742iRmJ7ImGhfmC
/h1aO1ZHWszXnopEtLEPy6wnLe2wprHCUabIF/gmNPzWDx+PtZLwcfFfPBHkB7xy
PtMhBfdumOsVDzhnKKfBZEilwm3Rgox04Tys+wBc4N7XGo5iDcCV/6y4U0qE/k/5
xo+c0pFwGXU6dPNAyPiAuQ==;
I also double-checked my PP account and there are no actual invoices in
there waiting for me.
Nuts.
On 11/21/2024 10:30 AM, Jared Hall wrote:
>
> #
> ##############
> ### PAYPAL ###
> ##############
> header __JR_PHISH_PPAL1A From:name =~ /(^(PayPal\s?|.*\@paypal\.com)|Via\sPayPal)/i
> header __JR_PHISH_PPAL1B From:addr !~ /.*\@(.*\.)?(paypal|paypal\-communication)\.com$/i
> header __JR_PHISH_PPAL1C Reply-To:addr !~ /.*\@(.*\.)?(paypal)\.com$/i
> header __JR_PHISH_PPAL1G From:addr =~ /.*\@(.*\.)?(paypal|paypal\-communication)\.com$/i
> meta JR_PHISH_PPAL1 (__JR_PHISH_PPAL1A && __JR_PHISH_PPAL1B)
> describe JR_PHISH_PPAL1 Name Spoof/Phish Detected
> score JR_PHISH_PPAL1 15.0
>
> meta JR_PHISH_PPAL2 (__JR_HDR_SUBJ__PPAL1 && (__JR_PHISH_PPAL1B || (__JR_PHISH_REPLY && __JR_PHISH_PPAL1C)))
> describe JR_PHISH_PPAL2 Name Spoof/Phish Detected
> score JR_PHISH_PPAL2 15.0
>
> body __JR_PHISH_PPAL3A /(go\sto\sthe\sPayPal\swebsite|We\snoticed\sunusual\sactivity\sin\syour\sPayPal\saccount\.|you\'ve\sto\scheck\syour\sinformation|PayPal\.\sAll\srights\sreserved\.|You\sreceived\sthis\se\-mail\sas\sa\smember\sof\spaypal\.|PayPal\sSupport\sAll\srights\sare\sreserved|Copyright\s1999\-2019\sPayPal|This\sis\sthe\sLast\sreminder\sto\slog\sin\sto\sPayPal|PayPal\ssecure|We\'ve\salso\simposed\stemporary\slimits\son\scertain\sfeatures\son\syour\sPayPal\saccount|Copyright\s\xC2\xA9\s1999\-2021\sPayPal\.\sCopyright\sis\sprotected\sby\slaw\.)/m
> tflags __JR_PHISH_PPAL3A nosubject
> header __JR_PHISH_PPAL3B Subject =~ /(Your\saccount\sPayPal\swill\sbe\slimited|Unusual\sActivity\sOn\sYour\sPaypal\sAccount|K\xC3\xBCrzlich\shaben\swir\sIhr\sKonto\svor\xC3\xBCbergehend\seingeschr\xC3\xA4nkt)/i
>
> # meta JR_PHISH_PPAL3 ((__JR_PHISH_PPAL3A || __JR_PHISH_PPAL3B) && (JR_PUBLIC_SHORTURL || JR_BODY_GREETINGS || JR_BODY_ADV_SCAM_META))
> # describe JR_PHISH_PPAL3 Name Spoof/Phish Detected
> # score JR_PHISH_PPAL3 15.0
>
> # meta JR_PHISH_PPAL4 ((__JR_PHISH_PPAL1A || __JR_PHISH_PPAL1G) && (JR_PUBLIC_SHORTURL || JR_PHISH_DOC))
> # describe JR_PHISH_PPAL4 Name Spoof/Phish Detected
> # score JR_PHISH_PPAL4 15.0
>
> header __JR_PHISH_PPAL5A ALL:raw !~ /Received:\sfrom\s(.*\.)?(paypal\.com|epsl1\.com)\s/m
> meta JR_PHISH_PPAL5 ((__JR_PHISH_PPAL1A || __JR_PHISH_PPAL1G) && __JR_PHISH_PPAL5A)
> describe JR_PHISH_PPAL5 Name Spoof/Phish Detected
> score JR_PHISH_PPAL5 15.0
>
> meta JR_PHISH_PPAL6 ((__JR_PHISH_PPAL3A || __JR_PHISH_PPAL3B) && __JR_PHISH_PPAL1B)
> describe JR_PHISH_PPAL5 Name Spoof/Phish Detected
> score JR_PHISH_PPAL5 2.5
>
> Let me know how this works for you.
>
> -- Jared Hall
> jared@jaredsec.com
> Available for hire.
> On 11/21/2024 7:57 AM, AJ Weber wrote:
>> I saw a "conversation" a few weeks ago regarding paypal phishing
>> emails that were not being caught.
>>
>> I can't recall if anyone found a reasonable solution (or new rules).
>>
>> I just received one and it seems very well crafted. Is anyone still
>> collecting samples and wants this one too?
>>
>> Thanks for any recap anyone can provide.
>>
>> -AJ
>>
>