You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Blason rock <bl...@gmail.com> on 2013/04/29 04:16:19 UTC
Filter against newsletters
Hey fellas,
Recently I observed that users started receiving those newsletters kinda
mail. May be sombody internally subscribing it and that is why they do
receive. However as a general concept would like to know if such mails can
be stopped or is there any ready to use signature available to alter the
score.
Re: Filter against newsletters
Posted by Martin Gregorie <ma...@gregorie.org>.
On Mon, 2013-04-29 at 13:06 +0200, Matus UHLAR - fantomas wrote:
> What if it's a "semi-legit" newsletter thatuserhas not subscribed into?
> I have seen receiving this kind of e-mails from some "world saviours"
> repeatedly to many addressess that did not subscribe...
>
So have I, though not from 'world saviours'. Speaking of which, I notice
that mail from Avaaz is conveniently self-classifying itself as spam
without any additional action needed from me.
I give this sort of 'semi-legit' newsletter the full spam treatment on
the grounds that they may well be using a their 'unsubscribe' mechanism
as a way of collecting validated e-mail addresses for sale to other
spammers.
Martin
Re: Filter against newsletters
Posted by Martin Gregorie <ma...@gregorie.org>.
On Mon, 2013-04-29 at 12:46 -0400, Alex wrote:
> First, asking the users to look in the headers (or body) to find an
> unsubscribe link, and telling them to make sure it's "confirmed" just
> doesn't happen. They just want it blocked.
>
Did they subscribe to the list? Then tell 'em to get a clue and
unsubscribe.
> One of the things I'm finding is things like newsletters marketed for
> Citrix products, for example, sent by some unknown marketer, yet
> contain legitimate unsubscribe links in the body for citrix.com.
>
A rule that fires on mail where the 'unsubscribe' URL's domain doesn't
match the List-id or sender should work but may need a a custom plugin.
> So far I have about twenty domains (vresp.com, ccmail.com, etc) but
> haven't done anything further yet.
>
A rule matching those should also work, but you may end up playing
wack-a-mole to keep it updated.
> Does anyone think this is potentially a good idea? Perhaps there are
> some characteristics with these bulk messages that would be good to
> use in forming a few meta rules?
>
I've found that a relatively high scoring meta-rule that fires when two
or more very low scoring subrules can be surprisingly good at
distinguishing spam from ham. The subrules contain lists of related
terms, e.g. if you're after sales spam the subrules would recognise
'sales phrases' and 'product names'.
However, I can't say how this approach compares with better Bayes
training.
Martin
Re: Filter against newsletters
Posted by John Hardin <jh...@impsec.org>.
On Mon, 29 Apr 2013, Alex wrote:
>>> What if it's a "semi-legit" newsletter that user has not subscribed into?
>>
>> A newsletter that does unconfirmed subscriptions is not even *semi*-legit.
>>
>> Treat them as spam. Write a rule for any identifying headers, and report
>> them to URIBL.
>
> I asked about this issue on the list some time ago, and there wasn't
> much feedback at the time.
>
> First, asking the users to look in the headers (or body) to find an
> unsubscribe link, and telling them to make sure it's "confirmed" just
> doesn't happen. They just want it blocked.
I apologize if I was unclear. What I meant by "confirmed" is that the
newsletter sends an email to the user's email address saying "A
subscription to this newsletter was requested, please reply/click this
link to confirm the subscription. If you do nothing, you will not receive
the newsletter" - what spammers call "double opt-in" in an attempt to make
this seem somehow an onerous burden rather than the minimum acceptable
behavior.
If a newsletter starts dropping into your mailbox without your explicitly
confirming they have permission to send it to you, your subscription has
*not* been confirmed and the newsletter should be treated as spam,
regardless of whether they give you a way to unsubscribe.
If the user *did* subscribe and confirm their subscription to the
newsletter, and later starts complaining that they are being spammed
rather than going through the unsubscribe process, *that's* the time to
get out the cluebat.
> These bulk emailers may have been opt-in,
Beware using that term. What spammers (and many bulk emailers) mean by
"opt in" is that *somebody* requested a given email address be added to
the mailing list. Whether or not that somebody is actually the *owner* of
that email address matters little to them.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The yardstick you should use when considering whether to support a
given piece of legislation is "what if my worst enemy is chosen to
administer this law?"
-----------------------------------------------------------------------
9 days until the 68th anniversary of VE day
Re: Filter against newsletters
Posted by Alex <my...@gmail.com>.
Hi,
>> What if it's a "semi-legit" newsletter that user has not subscribed into?
>
> A newsletter that does unconfirmed subscriptions is not even *semi*-legit.
>
> Treat them as spam. Write a rule for any identifying headers, and report
> them to URIBL.
I asked about this issue on the list some time ago, and there wasn't
much feedback at the time.
First, asking the users to look in the headers (or body) to find an
unsubscribe link, and telling them to make sure it's "confirmed" just
doesn't happen. They just want it blocked.
I've recently thought of an idea where I'd like to collect a list of
as many of the bulk emailers and combine them into a set of rules to
just automatically raise their score.
These bulk emailers may have been opt-in, but the newsletters
proliferate like rats, and even the best bulk emailers send
newsletters that are just marketing junk that no one wants, or
intentionally would choose to receive.
I'm training them with bayes, and it's working to an extent, and I
don't want to just outright block constantcontact or verticalresponse,
but there is an increasingly large amount of marketing junk my user's
are complaining about, and I don't know what to do.
One of the things I'm finding is things like newsletters marketed for
Citrix products, for example, sent by some unknown marketer, yet
contain legitimate unsubscribe links in the body for citrix.com.
So far I have about twenty domains (vresp.com, ccmail.com, etc) but
haven't done anything further yet.
Does anyone think this is potentially a good idea? Perhaps there are
some characteristics with these bulk messages that would be good to
use in forming a few meta rules?
Thanks,
Alex
Re: Filter against newsletters
Posted by John Hardin <jh...@impsec.org>.
On Mon, 29 Apr 2013, Matus UHLAR - fantomas wrote:
> What if it's a "semi-legit" newsletter that user has not subscribed
> into?
A newsletter that does unconfirmed subscriptions is not even *semi*-legit.
Treat them as spam. Write a rule for any identifying headers, and report
them to URIBL.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
From the Liberty perspective, it doesn't matter if it's a
jackboot or a Birkenstock smashing your face. -- Robb Allen
-----------------------------------------------------------------------
9 days until the 68th anniversary of VE day
Re: Filter against newsletters
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>On Mon, 2013-04-29 at 07:46 +0530, Blason rock wrote:
>> Recently I observed that users started receiving those newsletters
>> kinda mail. May be sombody internally subscribing it and that is why
>> they do receive. However as a general concept would like to know if
>> such mails can be stopped or is there any ready to use signature
>> available to alter the score.
On 29.04.13 11:58, Martin Gregorie wrote:
>If its a (semi)legit newsletter and the complaining recipient *hasn't*
>followed the 'unsubscribe' instructions (in the message body or
>headers), borrow the BOFH's clue-bat and apply vigorously, especially if
>they're a lazy git who got bored with the list and thinks reporting it
>as spam is easier than unsubscribing.
>
>If the newsletter doesn't act on the unsubscribe, report them to the
>ICO, or the CAN-SPAM Complaint Wizard (good luck with the latter doing
>anything) and/or add its URL (from the List-id, Sender or Reply-To
>header) to your black list. This should be a last resort in case any of
>your other users are subscribers.
>
>If all these fail and/or it is only spam pretending to be a newsletter,
>treat as normal spam: report it to a URIBL, train BAYES on it as spam or
>extend/add a custom rule to trap it.
What if it's a "semi-legit" newsletter thatuserhas not subscribed into?
I have seen receiving this kind of e-mails from some "world saviours"
repeatedly to many addressess that did not subscribe...
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
We are but packets in the Internet of life (userfriendly.org)
Re: Filter against newsletters
Posted by Martin Gregorie <ma...@gregorie.org>.
On Mon, 2013-04-29 at 07:46 +0530, Blason rock wrote:
> Hey fellas,
>
> Recently I observed that users started receiving those newsletters
> kinda mail. May be sombody internally subscribing it and that is why
> they do receive. However as a general concept would like to know if
> such mails can be stopped or is there any ready to use signature
> available to alter the score.
>
If its a (semi)legit newsletter and the complaining recipient *hasn't*
followed the 'unsubscribe' instructions (in the message body or
headers), borrow the BOFH's clue-bat and apply vigorously, especially if
they're a lazy git who got bored with the list and thinks reporting it
as spam is easier than unsubscribing.
If the newsletter doesn't act on the unsubscribe, report them to the
ICO, or the CAN-SPAM Complaint Wizard (good luck with the latter doing
anything) and/or add its URL (from the List-id, Sender or Reply-To
header) to your black list. This should be a last resort in case any of
your other users are subscribers.
If all these fail and/or it is only spam pretending to be a newsletter,
treat as normal spam: report it to a URIBL, train BAYES on it as spam or
extend/add a custom rule to trap it.
Martin