[mdk-re] [JT] /. : FTC goes after spammers

[mdk-re] [JT] /. : FTC goes after spammers

[Michael Shigorin]

http://slashdot.org/article.pl?sid=02/02/12/2114231

-- 
 ---- WBR, Michael Shigorin <mike@altlinux.ru>
  ------ http://visa.chem.univ.kiev.ua/~mike/

[mdk-re] Re: [JT] procmail goes after spammers

[Mikhail Zabaluev]

Hello Michael,

On Wed, Feb 13, 2002 at 05:18:23PM +0200, Michael Shigorin wrote:
>
> http://slashdot.org/article.pl?sid=02/02/12/2114231

Ерунда (см. дискуссию там же).

Вот procmail -- это сила. 5 минут назад в очередной раз опустошил папку
spam на сервере, после проверки по логу, какие заманчивые предложения
туда отфильтровались. Штук по 5 в день строго бывает, а у меня в Inbox
-- чистота :) Плюс к тому: автоматическое уведомление провайдеров
особо надоедливых и псевдо-отлупы со смыслом
"адресат по указанному адресу не проживает/выбыл/умер/ушла на базу".

-- 
Stay tuned,
  MhZ                                     JID: mookid@jabber.org
___________
Command, n.:
	Statement presented by a human and accepted by a computer in
	such a manner as to make the human feel as if he is in control.

[mdk-re] Re: [JT] procmail goes after spammers

[Michael Shigorin]

On Thu, Feb 14, 2002 at 01:00:33AM +0300, Mikhail Zabaluev wrote:
> Вот procmail -- это сила. 5 минут назад в очередной раз опустошил папку
[...]
> -- чистота :) Плюс к тому: автоматическое уведомление провайдеров
> особо надоедливых и псевдо-отлупы со смыслом
> "адресат по указанному адресу не проживает/выбыл/умер/ушла на базу".
Тезка, я извиняюсь -- а _это_ счастье опакечивается? ;)

-- 
 ---- WBR, Michael Shigorin <mike@altlinux.ru>
  ------ http://visa.chem.univ.kiev.ua/~mike/

[mdk-re] Re: [JT] procmail goes after spammers

[Mikhail Zabaluev]

[-- Attachment #1: Type: text/plain, Size: 855 bytes --]

Hello Michael,

On Thu, Feb 14, 2002 at 11:10:30AM +0200, Michael Shigorin wrote:
>
> On Thu, Feb 14, 2002 at 01:00:33AM +0300, Mikhail Zabaluev wrote:
> > Вот procmail -- это сила. 5 минут назад в очередной раз опустошил папку
> [...]
> > -- чистота :) Плюс к тому: автоматическое уведомление провайдеров
> > особо надоедливых и псевдо-отлупы со смыслом
> > "адресат по указанному адресу не проживает/выбыл/умер/ушла на базу".
> Тезка, я извиняюсь -- а _это_ счастье опакечивается? ;)

Ну (скромно потупившись), оно вряд ли того стоит, да и настроено на
"моих" спаммеров.
Есть как минимум одно "окончательное решение спаммерского вопроса"
в виде procmail-фильтра, доступное на FM/SF.
Могу лишь приложить свои файлы, если кому пригодится.

-- 
Stay tuned,
  MhZ                                     JID: mookid@jabber.org
___________
Do you have lysdexia?

[-- Attachment #2: .procmailrc --]
[-- Type: text/plain, Size: 2879 bytes --]

MAILDIR=$HOME/Mail/

LOGFILE=$HOME/log/procmail

ME=(mhz@(altlinux\.ru|alt-linux\.org|linux\.ru\.net)|mookid@(mu|sigent)\.ru)

SPAMGUISES=@(aol|hotmail|msn|yahoo)\.com

:0 :
* $^X-Loop: $\LOGNAME@$\HOST
$DEFAULT

# Log all bad deliveries
LOGABSTRACT=all

# Rules that bounce with "bad data"
EXITCODE=65

# Trash all huge messages not addressed to me, that are not mailing list
# digests.
:0
* >65536
* !$^TO_$ME
* !(digest|vital)
/dev/null

# Rules that bounce with "no such user"
EXITCODE=67

# Deal with messages that bear nasty signs of spam
:0
* ^X-RBL-Warning:|\
  ^X-((Bulkmail|CORONNA|CRUNCHERS|IONK|PLATTER):|(EM|SMTPExp)-)|\
  ^X-Mailer:.*(Caretop|diffondi|em5000|EMailing List Pro|\
               GOTO Software Sarbacane|IncrediMail|LK SendIt|Mailtouch|\
               NetPIMS Merge & Group Mailer|SoftForum-WebMail|SuperMail-2)
{
	:0
	* >10000
	/dev/null

	:0 :
	spam
}

# Charsets that mindless Asian spam uses, I have no chance to read them anyway
:0 :
* (charset.+|=\?)(big5|euc-kr|gb2312|iso-2022-jp|ks_c_5601-1987)
spam

# Process my dear frequent posters ;)

:0
* ^From .*seed\.net\.tw
* ^Received:.*\.ethome\.net\.tw
| $HOME/bin/spam-forward -s '[SPAM ALERT] Oops, they did it again' \
	antispam@ethome.net.tw

:0
* ^From big6@mailbox\.as
* ^Received:.*\[64\.245\.234
| $HOME/bin/spam-forward -s '[SPAM ALERT] Oops, they did it again' \
	abuse@digex.net

:0
* ^Received:.*registeredsite.com \(\[64\.224\.9\.
| $HOME/bin/spam-forward -s '[SPAM ALERT] Oops, they did it again' \
	abuse@interland.net

:0
* ^From .*einfodirect\.com
* ^Received:.*iexpect\.com \(\[216\.35
| $HOME/bin/spam-forward -s "[SPAM ALERT] <AUTO> {EAI#289-065}" \
	postmaster@iexpect.com abuse@exodus.net

:0
* ^From .*@a-01.com
* ^Received:.*\[209\.52\.29\.18.
| $HOME/bin/spam-forward -s '[SPAM ALERT] Oops, they did it again' \
	abuse@smartt.com

:0
* ^Received:.*\[61\.1(79|87)
* $^From .*(longfbusiness@sina\.com|$SPAMGUISES)
| $HOME/bin/spam-forward -s '[SPAM ALERT] Oops, they did it again' \
	anti-spam@ns.chinanet.cn.net

:0
* ^From .*jdmgames\.(com|net)
* ^Received:.*\[207\.215\.122
| $HOME/bin/spam-forward -s '[SPAM ALERT] (KMM512879C0KM)' \
	abuse@internetive.net abuse@pacbell.net

:0
* $^From .*(buero\.link-m\.de|$SPAMGUISES)
* ^Received:.*\[211\.114\.53\.3[2-9]
| $HOME/bin/spam-forward -s '[SPAM ALERT] Oops, they did it again' \
	insystem@kornet.net

:0
* ^From banks111111hk@yahoo\.com\.hk
* ^Received:.*\[212\.161\.14
| $HOME/bin/spam-forward -s '[SPAM ALERT] Oops, they did it again' \
	abuse@colt.net

:0
* ^From .*(badajob|genie)\.com
* ^Received:.*\[210\.51
| $HOME/bin/spam-forward -s '[SPAM ALERT] Oops, they did it again' \
	tech-group@china-netcom.com

:0
* ^From .*News@MailSRV\.BidBay\.com
* ^Received:.*\.bidbay\.com
| $HOME/bin/spam-forward -s '[SPAM ALERT] Oops, they did it again' \
	postmaster@primenet.com

# Normal delivery
LOGABSTRACT=no
EXITCODE=0

[-- Attachment #3: spam-forward --]
[-- Type: text/plain, Size: 859 bytes --]

#!/bin/bash
#
# Procmail helper to bounce spam messages.
#

[ "$SENDMAIL" = "" ] && SENDMAIL=/usr/sbin/sendmail
[ "$SENDMAILFLAGS" = "" ] && SENDMAILFLAGS=-oi

subject='[SPAM ALERT]'
while getopts s: opt; do
    subject="$OPTARG"
done

shift $(( $OPTIND - 1 ))

dest="$*"
if [ -z "$dest" ]; then
    echo "Usage: $0 [-s subject] recipient ... <message" >&2
    exit 1
fi

to_line="${*/%/,}"
to_line="${to_line%,}"

(   cat <<EOF
From: $LOGNAME
To: $to_line
Subject: $subject
Precedence: bulk
X-Loop: $LOGNAME@$HOST
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 8bit

Hello,

This is an automatically generated spam alert.
Feel free to contact me if you have any issues related to this.
The (partial) listing of the message that triggered it
is included below.


EOF
    head -c 8k
    cat >/dev/null
) | $SENDMAIL $SENDMAILFLAGS $dest