** Sometime around 09:52 -0700 4/13/97, Chuq Von Rospach sent everyone:
>>It is underway again. Attached is a message I received yesterday ...
>
>whooo, baby is it. My filters have trapped about 200K of attempted spam
>since midnight. As far as I can tell,it's the same person/group, using
>the same sources, since none of it seems to be sneaking through my
>filters.
Chuq, if you collate the targeted addresses at some point, could you
please post them? I know I'd like to scrub my list, and I'm sure that
several others would like to, as well.
I wish I had access to the Unix shell on the server; it appears to be
pretty easy to trap the suspect subscriptions with procmail, since they
are using a rather consistent format for the subscribes. Unfortunately,
all I have are Eudora filters, which are not as robust.
However, a *minor* pattern has become evident, and has allowed me to
write an effective filter to catch many of the illicit subs: apparently,
a good portion of these attacks are directed against Italian addresses.
Filtering on the subject of the "Welcome" message (on which I'm CCed)
*and* ".ir\r\r" (i.e., ".ir<cr><cr>") in the body of the message has
enabled me to trap the Italian addresses on ListProc.
I'm considering just extracting the entire subscription archive into a
text file, and processing it in DCL to catch the errant subs ...
- Vince Sabio
orionsoft@telephonet.com
--
If you run a mailing list and are tired of manually processing mail bounces,
then you probably need SmartBounce -- currently managing mailing lists in
excess of 150,000 subscribers. For more information, send a blank email to
<smartbounce@bsabio.com>.
--
<http://spam.abuse.net/spam/> Because The Only GOOD Spammer is a DEAD Spammer
Follow-Ups:
References:
|
|
