Great Circle Associates List-Managers
(April 1997)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Mailing Lists Are Under Attack Again
From: Vince Sabio <wavelet @ colossus . arl . mil>
Date: Sun, 13 Apr 1997 14:01:56 -0400
To: "ListMom-Talk Discussion List" <listmom-talk @ skyweyr . com>, List-Abuse <list-abuse @ clio . lyris . net>, List-Managers @ GreatCircle . COM
In-reply-to: <v0310284caf76bf68cf71 @ [207 . 167 . 80 . 70]>

** Sometime around 09:52 -0700 4/13/97, Chuq Von Rospach sent everyone:

>>It is underway again. Attached is a message I received yesterday ...
>
>whooo, baby is it. My filters have trapped about 200K of attempted spam
>since midnight. As far as I can tell,it's the same person/group, using
>the same sources, since none of it seems to be sneaking through my
>filters.

Chuq, if you collate the targeted addresses at some point, could you
please post them? I know I'd like to scrub my list, and I'm sure that
several others would like to, as well.

I wish I had access to the Unix shell on the server; it appears to be
pretty easy to trap the suspect subscriptions with procmail, since they
are using a rather consistent format for the subscribes. Unfortunately,
all I have are Eudora filters, which are not as robust.

However, a *minor* pattern has become evident, and has allowed me to
write an effective filter to catch many of the illicit subs: apparently,
a good portion of these attacks are directed against Italian addresses.
Filtering on the subject of the "Welcome" message (on which I'm CCed)
*and* ".ir\r\r" (i.e., ".ir<cr><cr>") in the body of the message has
enabled me to trap the Italian addresses on ListProc.

I'm considering just extracting the entire subscription archive into a
text file, and processing it in DCL to catch the errant subs ...

- Vince Sabio
  orionsoft @
 telephonet .
 com
--
If you run a mailing list and are tired of manually processing mail bounces,
then you probably need SmartBounce -- currently managing mailing lists in
excess of 150,000 subscribers. For more information, send a blank email to 
<smartbounce @
 bsabio .
 com>.
--
<http://spam.abuse.net/spam/> Because The Only GOOD Spammer is a DEAD Spammer




Follow-Ups:
References:
Indexed By Date Previous: Re: Mailing Lists Are Under Attack Again
From: Chuq Von Rospach <chuqui @ plaidworks . com>
Next: Introduction
From: "Gary K. Foote" <gkfoote @ webbers . com>
Indexed By Thread Previous: Re: Mailing Lists Are Under Attack Again
From: Chuq Von Rospach <chuqui @ plaidworks . com>
Next: Re: Mailing Lists Are Under Attack Again
From: Alexander Verbraeck <A . Verbraeck @ IS . TWI . TUDelft . NL>

Google
 
Search Internet Search www.greatcircle.com