Well, that’s my assumption with a subject line like “Maassive coocks into a virrrgin you.” Either that, or really drunk spammers….
Well, that’s my assumption with a subject line like “Maassive coocks into a virrrgin you.”
Either that, or really drunk spammers.
I seem to have an actual working solution with spam here on my account. I get about 100+ pieces a day coming in, but I have to intervene with it…
I seem to have an actual working solution with spam here on my account. I get about 100+ pieces a day coming in, but I have to intervene with it very little. For the sake of sharing the wealth …
Step 1: Host-side protection
These are protection steps I’m able to take through my web host, Hosting Matters. Most hosts offer similar sorts of tools.
I have the Low threshold (maybe spam) set at 5, the default, and all of that gets still delivered to me. The high threshold is set at 17, slightly lower than default (20); after doing some testing, nothing that was 17 was anywhere near being innocent, so I’m not worried about false positives. This stuff gets auto-deleted. Note that all e-mail gets a score from 0 to whatever, based on how it passes various tests. I’ve also set up a small number of whiltelisted domains — commmercial companies whose posts were
actually getting false low threshold positives. I don’t do this much, because it’s a PitA to go through cpanel and do it.
Note that these settings apply to all accounts I host — so this hits Mary, the Ks, my folks, and BD. Anyone wants something different, let me know.
What it does allow me to do is create one-off or phantom accounts by just putting in an e-mail address (e.g., setting up “psi-clone@hill-kleerup.org” on a forum account to make the character seem more real, or filling in a form asking for an e-address with something I can follow up to see if the list has been sold, e.g., “dave-xyzmagazine@hill-kleerup.org”). To me, that’s a valuable convenience. It also protects against legitimate typos — someone sending something to “marjie@hill-kleerup.org.”
This is true, presently, with almost all domains under my account — they all route through to me. That includes our domain, my folks, Mary, and BD. The Ks, interestingly enough, I set up to route through to them (largely because folks kept sending legitimate stuff to the wrong addresses and I would have to forward it on). There is a finite chance that this could lead to a breach of privacy (which you can, of course, trust me about), so if you’re one of those folks I’m hosting and would like me to either black
hole this stuff or forward it on to you, please let me know.
Step 2: Client-side protection
This is protection I use on my client side (i.e., on my PC, where my mail gets downloaded to). It centers around my mail client, Thunderbird, a free e0mail client I heartily recommend to any and all Windows users.
I have a message filter set up in Thunderbird as well that looks at all messages as they come in. If a message has in its header in the field “X-HMDNSGroup-MailScanner-SpamScore” a string of “sssss,” the message get flagged as Junk and put in a “MAYBE SPAM” folder. This field gets an “s” for each point of the spam score (recall that the low threshold is 5 at the moment for “maybe spam”). So this lets me fine-tune the filter. In this case, anything 5 or more (“sssss”) may well be spam, and should be reviewed.
As i said, this is working very well for me right now. I could look at a better Bayesian filter (e.g., the external spam proxy I used to run), or I could also bump up the abilities of Thunderbird with something like Spamato. But it’s working for the nonce.
My biggest beef at the moment with my mail is not the spam, remarkably enough, but the web access to it. Mail2web is better than nothing, but still annoyingly crude. The web front ends that come with the account are either non-functional or, again, annoying. What I’d love would be the GMail front-end to access my personal mail, but short of taking on the “Google masters your domain,” I’m not sure how to do that.
Posting here for my own reference … Avo pinged me last night that he was unable to post a comment to my blog, getting a 403 error (Forbidden). Hrm. Weird….
Posting here for my own reference …
Avo pinged me last night that he was unable to post a comment to my blog, getting a 403 error (Forbidden). Hrm. Weird. He could read the page, but not click the post or preview buttons.
Was having the same problem this morning. And he couldn’t see the little editing button graphics, either.
Hmmmm. That sounds like something’s blocking access to the MT executable directory (the editing button graphics are put out there via JavaScript, and the buttons obviously execute .cgi scripts).
Hrmmmm.
I knew I had some banning bits in my .htaccess file. I’d glanced at it last night, but hadn’t seen the IP address (via the 403 error) that Avo mentioned in there. I looked again this morning and … bingo. It was in there, put in by MT AutoBan.
MT AutoBan is a plug-in I use to ban IP addresses from junk commenters and junk trackbackers. It’s pretty spiffy, as it keeps spam attacks from executing the the MT code after more than (configurable) 1 junk comment/trackback is put in. That reduces the server burden substantially (even if MT would still block it, it avoids the MT code from having to be executed again). The ban holds true for (configurable)
48 hours.
Went to the MT AutoBan configuration to confirm those settings, then seeing that it was driven by Junk settings, I went to Junk comments (being certain that Avo wasn’t sending in Trackbacks). And there it was — a comment he’d put in for the Humor Test over on BD’s blog. And since I host BD, it went against my Movable Type configuration.
It was showing as Junk because he’d copied in the whole results from the Humor Test, which has a very large number of internal links in it — enough links that MT’s SpamLookup system flagged it as junk (comments, generally, only have a few link in them at most — the Humor Test has several).
(And the lesson here, for my readers, is watch the number of links in what you put into a single comment; on these sorts of things. I see this most likely in doing responses to these sorts of memes/personality tests.)
Solving the problem at that point was trivial. I told MT the comment wasn’t junk, and MT AutoBan rescinded the ban, automagically. I also tweaked the settings a little bit to lend more weight (hopefully) to “trusted” and previously approved commenters.
The system actually worked the way it was supposed to — I wasn’t just quite clear where the glitch was initially, nor was Avo (he had seen the problem occur after the comment gave him a message about moderation — but that was on a different blog than mine, where he was seeing the problem, so ).
Filed for future reference …
I am getting godawfully tired of spam on my home account. I’m spending 10-15 minutes every day just filtering out the crap. I need to look at a solution beyond…
I am getting godawfully tired of spam on my home account. I’m spending 10-15 minutes every day just filtering out the crap.
I need to look at a solution beyond Thunderbird’s native abilities and the SpamAssassin stuff that my host maintains. I wonder if I should go back to POPfile, or has this stuff gotten beyond Bayesian filters?
I’m going to ratchet down the mail scanner on the host side, and see if that helps.
Les is trying out an extension to Expression Engine that lets him use the Bad Behavior program for fighting comment/trackback spam. Whilst digging around, I found something which indicates it…
Les is trying out an extension to Expression Engine that lets him use the Bad Behavior program for fighting comment/trackback spam. Whilst digging around, I found something which indicates it can be used (after a fashion) on
Movable Type as well.
So this is a reminder to self to try it here and see what happens.
The blog ping system I go to — Ping-o-Matic — supposedly passes along the ping it receives to (among others) Blogrolling.com (which a lot of folks use to create a…
The blog ping system I go to — Ping-o-Matic — supposedly passes along the ping it receives to (among others) Blogrolling.com (which a lot of folks use to create a blogroll on their sidebar), but it’s not been working right for a couple of months. So I’ve finally broken down and done an explicit ping to blogrolling.com, too, for DDtB, BoH, and BD’s blog. BD says it’s working for him, but I haven’t seen results yet for my own blogs.
As a side note, I find it amusing and disturbing that a huge proportion of the “most recent pings” showing up at Blogrolling.com are, clearly, spam.
That does remind me, I do need to update my own blogroll …
No, really. I’m willing to show a degree of mercy and tolerance (unparolable life in prison at hard labor, let’s say, somewhere in the Nevada desert) for murderers, rapists, molesters,…
No, really. I’m willing to show a degree of mercy and tolerance (unparolable life in prison at hard labor, let’s say, somewhere in the Nevada desert) for murderers, rapists, molesters, and terrorists. But spammers are just … evil. They should just be summarily shot. Or stepped on, like the cockroaches they are.
So our voice mail system has a fax capability — if someone calls my direct line on a fax machine, the system will save the message as a voice mail that can then be routed (when I go into the system) to the fax machine of my choice. I’ve never used the feature, since I have an electronic fax number (which sends it, much more conveniently, to my e-mail), but I’ve been aware of it.
So, now, evidently, are some fax spammers, who have taken to sending me fax spam (a/k/a “junk faxes”). Since dealing with them is a pain (I have to go in to the voice mail system, I have to listen to the prompts, I have to tell it a fax machine to route to, I have to go to the fax machine and pick up the … offer to CUT YOUR HOUSE PAYMENT IN HALF!!), and since there is “spam filter” for these sorts of things … grrrrr.
Thus, I shall be contacting my local phone IT guru, and ask (a) what’s the best protocol (presumably calling the convenient 877 number at the bottom of the fax is useless), and/or (b) can the fax service on my extension be disabled. Probably the latter, since, as noted, I never use it, and now it’s using me.
Grrr.
See a message from Jackie in my inbox, with a subject, “spending time with you.” Always wanting to reach out to one of our dear friends, I open it ……
See a message from Jackie in my inbox, with a subject, “spending time with you.” Always wanting to reach out to one of our dear friends, I open it …
Hi,
Hope I am not writiang to wrong address.b I am nice, pretty lookinbg girl. I bam planning on visiting your town this month. Can we meet each other in person? Message me back at [strange-looking address that doesn’t match whence the message came].
Must be spam. Our Jackie spells much better.
When it’s a solicited feedback from a contract bidder that gets blocked by a spam filter and causes the contract to not go to the lowest bidder. Which is the…
When it’s a solicited feedback from a contract bidder that gets blocked by a spam filter and causes the contract to not go to the lowest bidder.
Which is the position Cobb Schools in Georgia is facing, in awarding a phone system bidder that was $250K/year higher than another competitor, when that competitor’s e-mail got filtered out.
There it was in the e-mail spam filter, along with offers to invigorate both your bank account and your sex life: an offer to save the Cobb County schools $250,000. But this message was for real.
School officials are blaming an overeager junk-mail filter for capturing and killing a Kennesaw businessman’s bid to provide telephone services to the system. It seems the part of the filter that watches for pornographic material was offended by the use of terms such as “long distance.”
Not able to check for the missing e-mail, school officials figured the businessman never responded, so he was disqualified. BellSouth won the contract, worth about $670,000 a year, in late February.
Mike Russell, president of Elite Telecom Services, appealed the process through the school system, but on May 1, Superintendent Fred Sanderson denied the appeal and declared the matter closed.
The school district says it’s the bidder’s responsibility, that either they should have followed up or that they should have somehow known a message would be blocked.
The bidder, on the other hand, notes that this was the only message that didn’t get through, and that the school district had explicitly requested e-mail responses after the first hardcopy bid package. He’s declined to sue (a small miracle right there), but isn’t very happy about the situation.
Lessons learned (by me, at least, if not by the school district or vendor):
(via Techdirt)
Don’t recognize a mysterious system file on your PC? Visit WhatIsThatFile? and find out what it’s for (or if you should try and get rid of it). (via GeekPress)…
Don’t recognize a mysterious system file on your PC? Visit WhatIsThatFile? and find out what it’s for (or if you should try and get rid of it).
(via GeekPress)
A spam e-mail I received at the office. FROM: Rosemary (xyz@yahoo.co.in) TO: Fletcher, Fred; Hill, Dave Because, of course, all official e-mail for anything comes from an Indian Yahoo! address….
A spam e-mail I received at the office.
FROM: Rosemary (xyz@yahoo.co.in)
TO: Fletcher, Fred; Hill, Dave
Because, of course, all official e-mail for anything comes from an Indian Yahoo! address. And is sent “accidentally” to two different people.
Good Day, james oaks
Health Pack for james oaks is ready.
Well, heck, I’m convinced already.
Please re-confirm zip.
http://geocities.com/XxxxxxxNnnnn
There was no ZIP file attached, so either it got stripped, left off, or this means that I’m “james oaks” is supposed to re-confirm things zippy-fast.
And, of course, all official “Health Packs” come via geocities.com accounts (which have personal names on them that have no relation to the sender, recipient, or anything that sounds like a “Health Pack”).
The Buyer as per our records: james oaks
Oh, boy! I can take advantage of your faulty non-capitalized records!
your info if wrong order please help us to correct it
Just visit our site above to make sure.Regards,
Rosemarie
Oh, boy! I can take advantage of your bad English, too! Must be a great deal for me, right?
There are two types of e-mail scams — there’s the, “Boy, this is fiendishly clever — I sure hope folks exercise their paranoia and don’t fall for it” type, and there’s the “Boy, this is incredibly stupid — too bad the scammers can’t steal the ability of their victims to breed, because it would sure improve the gene pool if anyone who fell for this was removed from it” type.
This is definitely one of the latter.
The Feds and States are beginning to take an interest in Caller ID spoofing. On Friday, [Florida] state Attorney General Charlie Crist issued subpoenas targeting five different spoofing sites. For…
The Feds and States are beginning to take an interest in Caller ID spoofing.
On Friday, [Florida] state Attorney General Charlie Crist issued subpoenas targeting five different spoofing sites. For four of them, the subpoenas are directed at the registrars handling the services’ anonymous domain name registrations, and are aimed at unmasking the owners of the sites. A fifth went directly to one of the spoofing sites, Tricktel.com, demanding business records and the identities of any Florida customers.
“People use Caller ID to protect themselves from unwanted calls and contact from those who would do them harm,” Crist said in a press release. “It is wrong for individuals or businesses to deceive our citizens, and this cannot be allowed to continue unchecked.”
[…] The probe comes on the heels of a broad federal investigation that began late last month, when the FCC issued letters to at least three Caller ID spoofing sites demanding detailed information on the structure of the businesses, as well as the names of every customer that has used the services, the dates they used them and the number of phone calls they made.
The concern is whether the spoofing is being done to perpetrate fraud or bypass Federal law on telemarketing.
SpoofTel, which is based in Canada, says it’s outside of the Florida attorney general’s jurisdiction, but that the company doesn’t tolerate unlawful use of its service. “I would like to remind your readers that SpoofTel’s services are to be used for entertainment purposes only,” SpoofTel said in a statement.
Yeah. A million laughs, that Caller ID spoofing. And that rings as true as those disclaimers on fortune tellers that their services are “for entertainment purposes only.”
[C]riminals have reportedly used the sites while making pretext phone calls to wheedle private information like bank account and Social Security numbers out of consumers and companies. Experts say the services have also been used to target businesses that rely on Caller ID for authentication — Western Union’s money-transfer service has been particularly vulnerable, as are T-Mobile voicemail boxes in their default configuration.
“Primarily, we think that it’s a way for telemarketers to hide their identity, and consumers or citizens will be more likely to answer the phone if they don’t think it’s somebody trying to sell them something,” says Joanna Carrin, a spokeswoman for the Florida attorney general’s office. “We are using our deceptive and unfair business practices law to look into what these companies are doing.”
That’s entertainment!
Now, there are potentially some legit uses for the services.
Despite the obvious deception involved, Del Bianco says spoofing services are primarily used for lawful aims. “We’re talking about private investigators, skip tracers, law enforcement agencies, attorneys, others who are legitimately trying to locate people to enforce their rights or in many cases the rights of the public,” he says. “There are lots of legitimate uses of this.”
[…] Chris Hoofnagle, an attorney with the Electronic Privacy Information Center, says he thinks Caller ID spoofing has legitimate uses, and would rather see fraudsters prosecuted for their crimes than have spoofing sites categorized as burglar tools. “I think the thing to do here is to prosecute the underlying fraud,” says Hoofnagle. “It seems to me it could be a privacy-enhancing technology that has useful purposes. For instance to call a police tip line or a newspaper perhaps.”
Frankly, I mistrust “legitimate” activities that rely on deceit, except in limited cases, though I agree that the underlying crimes are what should be punished. But the latter comment by Hoofnagle is silly; Caller ID blocking is quite different than Caller ID spoofing. One protects privacy, the other is essentially lying. I don’t see any reason to protect that, even if it’s potentially usable “for entertainment purposes.”
So Margie got an automated call purporting to be from Chase regarding possible credit card fraud on my Chase Mastercard. She passed it on to me. I Googled the phone…
So Margie got an automated call purporting to be from Chase regarding possible credit card fraud on my Chase Mastercard. She passed it on to me. I Googled the phone number, just for yoks, and came up with this, which didn’t fill me with confidence. So (and I would have done this anyway), I called the Official Customer Service Number on the back of card.
Eventually I get through to a guy who asks if I’d ordered something from Amazon.com for $769.94.
What?
I wracked my brains. Not likely. Couldn’t think of anything. I mean, I order a lot of stuff at Amazon, but I think I’d recall something that pricy. Went to Amazon.com to look at my orders this year. Nope. Went to my e-mail to see if any notices had shown up recently for Amazon stuff in that amount. Nope.
Fraud.
So dude has flagged it as a fraudulent transaction, and will be sending out a replacement card (which is a huge PitA, since that card is used for various purposes that I’ll have to now override). He went through the past several transactions showing up with the card, and they were all legit, so at least we nipped it in the bud.
I double-checked with Margie, and she knew nothing about it (and her Chase card has a different number, so it’s not like she’d be using mine).
Weird. And irksome. And a bit disturbing. I mean, if whomever it was had used the card in smaller amounts (below some magical fraud flag threshold), they would have gotten away with it, until at least the next billing period. And who could have gotten the number?
Annoying. Weird. And, as I said, disturbing.
Rrg. More trackback spam, which is causing both server problems and problems using the trackback system to begin with. Have started playing, again, with renaming the trackback CGI file. Also…
Rrg. More trackback spam, which is causing both server problems and problems using the trackback system to begin with.
Have started playing, again, with renaming the trackback CGI file. Also have implemented the AutoBan plugin, which grabs IP addresses from junk trackbacks and puts them into .htaccess to keep them accessing MT files in the first place.
We’ll see how well (or how long) that works.
Had the first successful trackback spam here in quite some time today. Not entirely certain what they did to spoof past all the various filters and the like (and loosening…
Had the first successful trackback spam here in quite some time today. Not entirely certain what they did to spoof past all the various filters and the like (and loosening up the throttling probably helped them), but I cleaned it out nice and quick, and have further tweaked things to moderate all trackback that gets through the filters (which means if you trackback something here there will be a delay before it’s published, sorry).
For the record, I show 12,303 junked trackbacks since I installed MT3 (I have over 500 accepted and legit trackbacks for this blog). Almost enough to make me want to turn off the trackback system, but I don’t want to let the bastards get away with it.
It’s become trivial to spoof Caller ID, at least for those who want to go to the effort of doing so. In the last few years, Caller ID spoofing has…
It’s become trivial to spoof Caller ID, at least for those who want to go to the effort of doing so.
In the last few years, Caller ID spoofing has become much easier. Millions of people have Internet telephone equipment that can be set to make any number appear on a Caller ID system. And several websites have sprung up to provide Caller ID spoofing services, eliminating the need for any special hardware.
For instance, Spoofcard.com sells a virtual “calling card” for $10 that provides 60 minutes of talk time. The user dials a toll-free number, then keys in the destination number and the Caller ID number to display. The service also provides optional voice scrambling, to make the caller sound like someone of the opposite sex.
On the other hand, for most people, this is not going to be an issue. At worst, it means don’t trust what Caller ID is telling you about who’s calling up asking for your credit card number — but, then, you shouldn’t be trusting that anyway. It’s no different, in that way, from the long-established fact that e-mail headers can be spoofed, and you shouldn’t trust something that comes through looking like it’s from Chase Bank — whether on the phone or by e-mail — actually is.
But for spotting that you’re getting a call from a family, friend, acquaintance, etc., you don’t want to chat with right now, Caller ID will still work for that sort of thing, as long as it’s not a stalker or an angry ex-whatever trying to track you down for alimony. Just don’t bet your life, or your finances, on it.
(via GeekPress)
About once every three days or so, I get a message via Yahoo! Instant Messenger: tammy2much4u: Heya, I was looking at yahoo and i noticed your page, anyways, you look…
About once every three days or so, I get a message via Yahoo! Instant Messenger:
tammy2much4u: Heya, I was looking at yahoo and i noticed your page, anyways, you look interesting.
tammy2much4u: do you wanna see my profile and pictures..?
Now I assume this is a scam of some sort, since, well, my Yahoo! profile/”page” is not, as far as I know, all that interesting looking (nor am I), and I certainly am not soliciting or looking for someone to contact me this way.
I usually just click on “Report as Spam” and go on, but …
… what sort of scam/spam would operate this way?
… or are people so desperate out there that they troll the profiles looking for friendly faces … or lack thereof, in this case?
Just don’t get it.
The subject line “Add up important spice to your aliveness!” is intriguing, but I don’t know that I should trust someone named “Buford” with something of that sort….
The subject line “Add up important spice to your aliveness!” is intriguing, but I don’t know that I should trust someone named “Buford” with something of that sort.
My Internet host, Hosting Matters, is rolling out a new anti-spam system to its various servers, and it finally got to mine. The new system, MailScanner, still uses the SpamAssassin…
My Internet host, Hosting Matters, is rolling out a new anti-spam system to its various servers, and it finally got to mine.
The new system, MailScanner, still uses the SpamAssassin engine, but the option to flag subject lines of spam messages (as detected) has gone away (it’s a server-based setting, not an account-based setting, and evidently a huge majority of HM users prefer not to see the subject line marked up). Problem is, a lot of mailers (like Outlook Express) can’t read the alternative mail header flags.
MailScanner has two threshold (configurable to a SpamAssassin score) — “low scoring spam” and “high scoring spam.” Mail falling into either of those categories can be set to be delivered, deleted, or routed to a particular e-mail address.
Now, with Thunderbird, I can set a Message Filter to look for a X-HMDNSGroup-MailScanner-SpamScore message header value that contains “ssssssssssss” or something. But what makes this dicey is that I also provide mail hosting to my folks, Margie’s folks, and Mary, and OE users (the Ks) can’t do message header filtering, and I have no idea if it’s possible in my folks’ or Mary’s e-mail clients.
Sigh.
What I will likely do is monitor what flows into my account with that flag, and look for false positives, then play with the settings some more, until I can confidently just have stuff flagged as spam deleted. Either that, or the HM folks have said they’re looking at a per-account subject line flagger that I’d be more than happy to go back to using.
Meantime, the new system also has anti-virus cleaning and some nice anti-phishing/fraud features that I consider a plus. Yay.
While one would ordinarily just discard a message with a subject line, “Unclaimed Property – Outstanding Check,” a further subtle characteristic of both the subject line and the from line…
While one would ordinarily just discard a message with a subject line, “Unclaimed Property – Outstanding Check,” a further subtle characteristic of both the subject line and the from line led me to actually open the e-mail …
… to discover that, no, it wasn’t spam, but a notice that I’d never cashed a check I was supposed to have received six years ago, and should they send me a new copy?
Cool. But, once more, demonstrating the danger of sending messages with spam-like subject lines.