[Tech] stato delle email, rapporto email valide / spam e progetto del quale non ricordo il nome (sono fuso?)
Marco Ermini
markoer@markoer.org
Mer 28 Lug 2004 10:12:32 CEST
<quota chi="Alessio Chemeri">
[...]
> tanto per proseguire (e anche per sfizio) mi sono fatto uno scrippe che
> si permette di elencarmi
> le email messe in quarantena (e quindi non lo spam.. ma quelle vietate o
> convirus o altro) e guarda
> un po' in un solo giorno che roba...
>
> le disallowed sono bloccate per altri motivi diversi dall'allegato... :-)
> e questo e' solo la prima maglia della rete (che e' in effetti anche
> molto imprecisa ma mi fa
> comodo tanto i pif del piffero sono tutti virus :-) che tra parentesi
> oramai non ci farebbero
> neanche una cippa avendo spostato tutti gli utenti su webmail :-))) ma
> e' per sicurezza...)
>
> praticamente i pif la fanno da padrone... :-)
>
> Statistica di email messe in quarantena
> mar lug 27 18:11:49 CEST 2004
> totale email in quarantena === * 1963*
> bloccate per allegato di tipo BAT === 1
> bloccate per allegato di tipo CMD === 1
> bloccate per allegato di tipo COM === 182
> bloccate per allegato di tipo CPL === 2
> bloccate per allegato di tipo Disallowed === 6
> bloccate per allegato di tipo Executable === 135
> bloccate per allegato di tipo HTA === 6
> bloccate per allegato di tipo PIF === 1442
> bloccate per allegato di tipo SCR === 186
> bloccate per allegato di tipo VBS === 2
</quota>
Anche io ho un *sacco* di merda ogni giorno... prendendo giusto un
LogWatch a caso:
################### LogWatch 5.2.2 (06/23/04) ####################
Processing Initiated: Wed Jul 28 04:02:05 2004
Date Range Processed: yesterday
Detail Level of Output: 0
Logfiles for Host: server01.markoer.org
################################################################
--------------------- amavis Begin ------------------------
361 messages checked and passed.
155 virus infected messages were found.
317 spam messages were found.
3 messages with bad headers were found.
[...]
Una serie di "unmatched entries" che sono le regole di SARE e che taglio,
giusto per farti vedere come fungono:
**Unmatched Entries**
Banned declared file name: message.scr (patt:
(?i-xsm:.\\.(exe|vbs|pif|scr|bat|com|tnef)$)): 44 Time(s)
[...]
SPAM-TAG, <starbuck@t-online.de> -> <XXXXX@XXXX.XXX>,
Yes, hits=13.1 tagged_above=-10.0 required=4.0 tests=AWL, BigEvilList_447,
FORGED_MUA_OUTLOOK, FORGED_OUTLOOK_TAGS, HTML_MESSAGE, HTML_TAG_EXISTS_TBODY,
ISO_7BITS, MSGID_FROM_MTA_BACKUP, MY_DSL, WLS_URI_OPT_90: 8 Time(s)
[...]
SPAM-TAG, <XXXXX@XXXX.XXX> -> <XXXXX@XXXX.XXX>, Yes,
hits=12.6 tagged_above=-10.0 required=4.0 tests=BigEvilList_709, HTML_40_50,
HTML_MESSAGE, RCVD_IN_SBL, SARE_HTML_FONT_INVIS2, SARE_HTML_GIF_DIM,
SARE_HTML_GIF_SHORT, SARE_HTML_HEAD_EMPTY, VOWEL_FROM_7, WLS_URI_OPT_138: 1
Time(s)
SPAM-TAG, <GwendolynMathis@graffiti.net> -> <XXXXX@XXXX.XXX>, Yes,
hits=18.1 tagged_above=-10.0 required=4.0
tests=BAD_ISO_CHARSET, BLANK_LINES_80_90, FORGED_RCVD_NET_HELO, ISO_7BITS,
MONOTONE_WORDS_2_15, MONOTONE_WORDS_2_30, MONOTONE_WORDS_3_20,
NO_DNS_FOR_FROM,
NO_RDNS, NO_RDNS2, SARE_BOUNDARY_07, SARE_HTML_URI_PARTID: 1 Time(s)
SPAM-TAG, <markoer@usa.net> -> <markoer@markoer.org>, Yes,
hits=9.5 tagged_above=-10.0 required=4.0 tests=AWL, CLICK_BELOW,
COMBO_IMAGEONLY1, HTML_90_100, HTML_COMMENT_RATIO, HTML_IMAGE_ONLY_02,
HTML_LINK_CLICK_HERE, HTML_MESSAGE, HTML_TAG_EXISTS_TBODY,
HTTP_WITH_EMAIL_IN_URL, MIME_HTML_ONLY, OPT_OUT, RCVD_IN_BL_SPAMCOP_NET,
RCVD_IN_SBL, RM_hm_EmtyMsgid, SARE_HTML_GIF_SHORT, SARE_HTML_URI_SPACER: 1
Time(s)
[...]
SPAM-TAG, <XXXXX@XXXX.XXX> -> <XXXXX@XXXX.XXX>, Yes,
hits=9.5 tagged_above=-10.0 required=4.0 tests=AWL, CLICK_BELOW,
COMBO_IMAGEONLY1, HTML_90_100, HTML_COMMENT_RATIO, HTML_IMAGE_ONLY_02,
HTML_LINK_CLICK_HERE, HTML_MESSAGE, HTML_TAG_EXISTS_TBODY,
HTTP_WITH_EMAIL_IN_URL, MIME_HTML_ONLY, OPT_OUT, RCVD_IN_BL_SPAMCOP_NET,
RCVD_IN_SBL, RM_hm_EmtyMsgid, SARE_HTML_GIF_SHORT, SARE_HTML_URI_SPACER,
SUBJ_YOUR_OWN: 1 Time(s)
Banned declared file name: data02_riccardo.pif (patt:
(?i-xsm:.\\.(exe|vbs|pif|scr|bat|com|tnef)$)): 1 Time(s)
[...]
SPAM-TAG, <gatewow@bluecom.no> -> <XXXXX@XXXX.XXX>, Yes,
hits=18.8 tagged_above=-10.0 required=4.0 tests=A_HREF_NOTHING,
BigEvilList_931,
CLICK_BELOW, FROM_GATE, HTML_60_70, HTML_FONT_BIG, HTML_LINK_CLICK_HERE,
HTML_MESSAGE, J_CHICKENPOX_54, J_CHICKENPOX_74, MIME_HTML_ONLY,
MR_EMPTY_SUBJ,
MR_FROM_SHORT, MR_GOT_PENIS, MSGID_FROM_MTA_SHORT, SARE_HTML_USL_A,
WLS_URI_OPT_182: 1 Time(s)
[...]
SPAM-TAG, <book1@nerdshack.com> -> <XXXXX@XXXX.XXX>, Yes,
hits=10.5 tagged_above=-10.0 required=4.0 tests=COMBO_IMAGEONLY1, HTML_70_80,
HTML_IMAGE_ONLY_02, HTML_MESSAGE, HTML_MIME_NO_HTML_TAG,
HTML_TAG_BALANCE_TABLE,
MIME_HTML_ONLY, SARE_HTML_NO_BODY1, SARE_HTML_NO_BODY2, SARE_HTML_NO_HTML3,
SARE_HTML_NO_HTML5, SARE_RECV_SPAM_DOMN0, SARE_SUB_ENC_WIN1255: 1 Time(s)
[...]
SPAM-TAG, <book1@nerdshack.com> -> <XXXXX@XXXX.XXX>, Yes,
hits=18.8 tagged_above=-10.0 required=4.0 tests=CLICK_BELOW, COMPLETELY_FREE,
EXCUSE_23, FREE_TRIAL, FROM_ENDS_IN_NUMS, HTML_MESSAGE, J_CHICKENPOX_34,
J_CHICKENPOX_44, J_CHICKENPOX_73, LIMITED_TIME_ONLY, LINES_OF_YELLING,
MIME_BOUND_NEXTPART, MIME_HTML_NO_CHARSET, OFFER, OFFERS_ETC, OPT_OUT,
RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_SBL, RCVD_IN_SORBS, RCVD_POWERMTA,
RM_hm_EmtyMsgid, SARE_FROM_NUM_8DIG, SARE_HEAD_SPAM, STOCK_PICK: 1 Time(s)
Banned declared file name: file_a5ee23.txt.exe (patt:
(?i-xsm:\\.[a-zA-Z][a-zA-Z0-9]{0,3}\\.(vbs|pif|scr|bat|com|exe|dll)$)): 1
Time(s)
[...]
SPAM-TAG, <mbomark@jumpy.it> -> <XXXXX@XXXX.XXX>, Yes,
hits=20.7 tagged_above=-10.0 required=4.0 tests=DEAR_SOMETHING,
J_CHICKENPOX_61,
J_CHICKENPOX_63, NA_DOLLARS, NIGERIAN_BODY1, NIGERIAN_BODY2, NIGERIAN_BODY3,
NIGERIAN_BODY4, NIGERIAN_BODY_2, NO_REAL_NAME, RCVD_IN_BL_SPAMCOP_NET,
RCVD_IN_RFCI, RCVD_IN_SORBS, SARE_FRAUD_X3, SARE_FRAUD_X4, SARE_FRAUD_X5,
SARE_MILLIONSOF, SARE_URGBIZ, SUBJ_ALL_CAPS: 1 Time(s)
[...]
SPAM-TAG, <XXXXX@XXXX.XXX> -> <XXXXX@XXXX.XXX>, Yes, hits=13.3
tagged_above=-10.0 required=4.0 tests=ALL_NATURAL,
BigEvilList_190, LOSE_POUNDS, NO_RDNS, RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_DSBL,
SPECIAL_OFFER, WLS_URI_OPT_39: 1 Time(s)
Banned declared file name: letter43_segreteria.pif (patt:
(?i-xsm:.\\.(exe|vbs|pif|scr|bat|com|tnef)$)): 1 Time(s)
[...]
SPAM-TAG, <XXXXX@XXXX.XXX> -> <XXXXX@XXXX.XXX>, Yes,
hits=106.3 tagged_above=-10.0 required=4.0 tests=HTML_20_30, HTML_MESSAGE,
HTML_MIME_NO_HTML_TAG, MIME_HTML_NO_CHARSET, MIME_HTML_ONLY,
NORMAL_HTTP_TO_IP,
SARE_FORGED_EBAY, SARE_HTML_NO_BODY3, SARE_HTML_NO_HTML2, SARE_HTML_NO_HTML4,
SARE_HTML_URI_IP: 1 Time(s)
[...]
SPAM-TAG, <karrington_an@halliwell.org.uk> -> <XXXXX@XXXX.XXX>, Yes,
hits=16.4 tagged_above=-10.0 required=4.0
tests=BIZ_TLD, CLICK_BELOW, DISGUISE_VIAGRA, DRUGS_ERECTILE,
RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_DSBL, RCVD_IN_DYNABLOCK, RCVD_IN_RFCI,
RCVD_IN_SORBS, SARE_HTML_URI_RM, SUBJ_BUY, SUBJ_VIAGRA, VIAGRA_ONLINE,
WLS_URI_OPT_533: 1 Time(s)
[...]
SPAM-TAG, <SNMSCJFGAVKFZA@snail-mail.net> -> <XXXXX@XXXX.XXX>, Yes,
hits=50.6 tagged_above=-10.0 required=4.0
tests=BAD_ISO_CHARSET, BigEvilList_361, COMBO_IMAGEONLY1,
FORGED_RCVD_NET_HELO,
HTML_90_100, HTML_MESSAGE, HTML_MIME_NO_HTML_TAG, J_CHICKENPOX_21,
J_CHICKENPOX_33, J_CHICKENPOX_43, J_CHICKENPOX_45, J_CHICKENPOX_51,
J_CHICKENPOX_55, MESSAGE_BADMIME, MIME_HTML_ONLY, MIME_HTML_ONLY_MULTI,
MR_EMPTY_SUBJ, NO_RDNS, NO_RDNS2, RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_DSBL,
SARE_BOUNDARY_07, SARE_HEAD_MIME_PROD, SARE_HEAD_SPAM, SARE_HTML_FSIZE_1ALL,
SARE_HTML_INV_TAG2, SARE_HTML_INV_TAG3, SARE_HTML_NO_BODY3,
SARE_HTML_NO_HTML2,
SARE_HTML_NO_HTML4, SARE_HTML_URI_PARTID, SARE_MSGID_CHAR_2AT, SARE_RAND_2,
SARE_RAND_2W, TW_FJ, TW_JG, T_RATWARE_OOPS_14, VERBOSE_MIME_VERSION,
WLS_URI_OPT_71, X_MESSAGE_INFO: 1 Time(s)
[...]
SPAM-TAG, <XXXXX@XXXX.XXX> -> <XXXXX@XXXX.XXX>, Yes, hits=42.6
tagged_above=-10.0
required=4.0 tests=AWL, DEAR_SOMETHING, DOMAIN_BODY, IMPRONONCABLE_2,
IMPRONONCABLE_2_FULL, ISO_7BITS, J_CHICKENPOX_101, J_CHICKENPOX_102,
J_CHICKENPOX_12, J_CHICKENPOX_13, J_CHICKENPOX_14, J_CHICKENPOX_15,
J_CHICKENPOX_16, J_CHICKENPOX_17, J_CHICKENPOX_18, J_CHICKENPOX_19,
J_CHICKENPOX_21, J_CHICKENPOX_210, J_CHICKENPOX_22, J_CHICKENPOX_23,
J_CHICKENPOX_24, J_CHICKENPOX_25, J_CHICKENPOX_26, J_CHICKENPOX_29,
J_CHICKENPOX_31, J_CHICKENPOX_32, J_CHICKENPOX_33, J_CHICKENPOX_34,
J_CHICKENPOX_35, J_CHICKENPOX_36, J_CHICKENPOX_37, J_CHICKENPOX_38,
J_CHICKENPOX_39, J_CHICKENPOX_41, J_CHICKENPOX_42, J_CHICKENPOX_43,
J_CHICKENPOX_44, J_CHICKENPOX_45, J_CHICKENPOX_46, J_CHICKENPOX_47,
J_CHICKENPOX_48, J_CHICKENPOX_51, J_CHICKENPOX_52, J_CHICKENPOX_53,
J_CHICKENPOX_54, J_CHICKENPOX_55, J_CHICKENPOX_56, J_CHICKENPOX_57,
J_CHICKENPOX_61, J_CHICKEN
POX_62, J_CHICKENPOX_63, J_CHICKENPOX_64, J_CHICKENPOX_66, J_CHICKENPOX_71,
J_CHICKENPOX_72, J_CHICKENPOX_74, J_CHICKENPOX_75, J_CHICKENPOX_81,
J_CHICKENPOX_82, J_CHICKENPOX_83, J_CHICKENPOX_92, J_CHICKENPOX_93,
LARGE_HEX,
LONGWORD, L_HELLO_ADDRESS, MAILTO_TO_SPAM_ADDR, MEGALONGWORD, MY_FNAMEB,
NO_REAL_NAME, REMOVE_REMOVAL_NEAR, RISK_FREE, SARE_ADLTOBFU, SARE_BAYES_5x8,
SARE_BAYES_6x8, SARE_BAYES_7x8, SARE_FRAUD_X3, SARE_FROM_SPAM_WORD3,
SARE_HEAD_XBEEN, SMILEY, TW_AJ, TW_BD, TW_BJ, TW_BK, TW_BL, TW_BZ, TW_CF,
TW_CG,
TW_CN, TW_CR, TW_CV, TW_CX, TW_CZ, TW_DM, TW_DQ, TW_DR, TW_DT, TW_DV,
TW_DW, TW_DX,
TW_DY, TW_EB, TW_EH, TW_EV, TW_FN, TW_FW, TW_FZ, TW_GD, TW_GM, TW_GZ,
TW_HB, TW_HD,
TW_HJ, TW_HP, TW_HV, TW_HX, TW_II, TW_JC, TW_JF, TW_JL, TW_JV, TW_JZ,
TW_KD, TW_KF,
TW_KK, TW_KL, TW_KP, TW_KQ, TW_KV, TW_KX, TW_KZ, TW_LH, TW_LQ, TW_MF,
TW_MQ, TW_MR,
TW_MX, TW_NB, TW_NH, TW_NQ, TW_NV, TW_NX, TW_OV, TW_PF, TW_PG, TW_PM,
TW_PN, TW_PR,
TW_PW, TW_QA, TW_QD, TW_QF, TW_QG, TW_QK, TW_Q
L, TW_QM, TW_QT, TW_QZ, TW_RJ, TW_RQ, TW_RR, TW_SN, TW_SW, TW_SX, TW_TK,
TW_TR,
TW_TX, TW_UC, TW_UH, TW_UV, TW_UW, TW_VF, TW_VG, TW_VH, TW_VJ, TW_VK,
TW_VN, TW_VV,
TW_VW, TW_WB, TW_WH, TW_WJ, TW_WR, TW_WV, TW_WW, TW_WX, TW_XB, TW_XC,
TW_XF, TW_XH,
TW_XK, TW_XL, TW_XN, TW_XP, TW_XX, TW_YB, TW_YF, TW_YK, TW_ZB, TW_ZF,
TW_ZG, TW_ZJ,
TW_ZM, TW_ZR, TW_ZS, TW_ZW, TW_ZX, TW_ZZ, UPPERCASE_25_50, VIRUS_WARNING171,
VIRUS_WARNING_EXE1, VIRUS_WARNING_MYDOOM5, WLS_URI_OPT_451: 1 Time(s)
do_unzip: part-00003, 2 members encrypted, archive retained: 1 Time(s)
[...]
SPAM-TAG, <2.17207271636.4677140.2@ientrynetwork.net> ->
<XXXXX@XXXX.XXX>, Yes, hits=26.0 tagged_above=-10.0 required=4.0
tests=BigEvilList_1320,
BigEvilList_2318, BigEvilList_2681, FORGED_MUA_OUTLOOK, HTML_50_60,
HTML_FONTCOLOR_BLUE, HTML_LINK_PUSH_HERE, HTML_MESSAGE, ISO_7BITS,
MIME_HTML_ONLY, NORMAL_HTTP_TO_IP, NO_RDNS, RCVD_IN_SORBS, RCVD_POWERMTA,
RISK_FREE, SARE_HTML_MANY_BR05, SARE_HTML_P_BREAKcb, SARE_HTML_TITLE_YR,
SARE_HTML_USL_1CHAR2, VOWEL_FROM_5, WLS_URI_OPT_256, WLS_URI_OPT_453,
WLS_URI_OPT_523: 1 Time(s)
[...]
SPAM-TAG, <lawanda_velazquez_lk@readingcinemas.com.au> ->
<XXXXX@XXXX.XXX>, <XXXXX@XXXX.XXX>, Yes, hits=14.6 tagged_above=-10.0
required=4.0
tests=BigEvilList_409, CLICK_BELOW, MR_NO_LENDING, OFFER_2,
RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_DSBL, RCVD_IN_DYNABLOCK, RCVD_IN_SORBS,
SARE_SUB_CASINO, SPECIAL_OFFER, WLS_URI_OPT_80: 1 Time(s)
Banned declared file name: news01_10.txt
.pif (patt:
(?i-xsm:.\\.(exe|vbs|pif|scr|bat|com|tnef)$)): 1 Time(s)
[...]
---------------------- amavis End -------------------------
--------------------- Clamav Begin ------------------------
Viruses detected:
Worm.Bagle.AG.2: 2 Time(s)
Worm.Bagle.Gen-zippwd: 1 Time(s)
Worm.Bagle.Z: 1 Time(s)
Worm.SomeFool.Gen-1: 26 Time(s)
Worm.SomeFool.P: 119 Time(s)
Worm.SomeFool.X: 2 Time(s)
Worm.SomeFool.Z: 6 Time(s)
Daemon check list:
Database status OK: 21 Time(s)
Virus database reloads:
Now protecting against 22927 viruses: 1 Time(s)
---------------------- Clamav End -------------------------
[...]
--------------------- postfix Begin ------------------------
41707544 bytes transferred
1490 messages sent
64 resent messages
Top ten senders:
27 messages sent by:
XXXXX
11 messages sent by:
XXXXX
TLS Connections from:
arwen.bmm.it[213.144.76.61] : 2 Time(s)
host83-90.pool80204.interbusiness.it[80.204.90.83] : 2 Time(s)
linux.us.dell.com[143.166.224.162] : 4 Time(s)
lists.us.dell.com[143.166.224.162] : 2 Time(s)
mailhub6.mclink.it[195.110.128.33] : 1 Time(s)
net128-087.mclink.it[195.110.128.87] : 1 Time(s)
unknown[69.41.245.122] : 1 Time(s)
TLS Connections To:
bacchus.dotnet.co.nz : 1 Time(s)
bledmeerfaste.intercom.it : 1 Time(s)
e4.ny.us.ibm.com : 1 Time(s)
flyfishers.it : 1 Time(s)
hotels-reservations.org : 1 Time(s)
mail.cise.ufl.edu : 1 Time(s)
mail.interfree.it : 1 Time(s)
ms01.sssup.it : 2 Time(s)
tourguide.it : 1 Time(s)
[...]
Messages rejected:
Domain not found 51 Time(s)
213-156-52-116.fastres.net[213.156.52.116] 4 Time(s)
host2-162.pool8250.interbusiness.it[82.50.162.2] 1 Time(s)
host2-61.pool8023.interbusiness.it[80.23.61.2] 2 Time(s)
host216-163.pool8250.interbusiness.it[82.50.163.216] 4 Time(s)
key01.keyforweb.com[213.254.1.246] 32 Time(s)
ppp-62-11-173-193.dialup.tiscali.it[62.11.173.193] 1 Time(s)
unknown[211.158.125.181] 1 Time(s)
unknown[212.131.233.42] 4 Time(s)
unknown[82.52.138.242] 1 Time(s)
unknown[82.53.150.238] 1 Time(s)
need fully-qualified address 3 Time(s)
host2-61.pool8023.interbusiness.it[80.23.61.2] 1 Time(s)
host243-65.pool8248.interbusiness.it[82.48.65.243] 1 Time(s)
ppp-62-10-89-74.dialup.tiscali.it[62.10.89.74] 1 Time(s)
Connections lost:
Connection lost after command CONNECT : 2 Time(s)
Connection lost after command DATA : 1 Time(s)
Connection lost after command EHLO : 1 Time(s)
Connection lost after command HELO : 14 Time(s)
Connection lost after command MAIL : 2 Time(s)
Connection lost after command RCPT : 61 Time(s)
Illegal address syntax:
In command MAIL from:
host202-230.pool82186.interbusiness.it[82.186.230.202] : 1 Time(s)
host37-166.pool8173.interbusiness.it[81.73.166.37] : 1 Time(s)
Errors in HELO/EHLO conversation:
061092174014.ctinets.com[61.92.174.14] : Helo command rejected (need
fully-qualified hostname) : 1 Time(s)
178.005.dsl.pth.iprimus.net.au[203.134.183.178] : Helo command rejected
(need fully-qualified hostname) : 1 Time(s)
server01.markoer.org[62.149.229.140] : greeted me with my own hostname
mx01.markoer.org : 1 Time(s)
server01.markoer.org[62.149.229.140] : replied to HELO/EHLO with my own
hostname mx01.markoer.org : 1 Time(s)
unknown[220.180.132.30] : Helo command rejected (need fully-qualified
hostname) : 1 Time(s)
unknown[61.189.236.152] : Helo command rejected (need fully-qualified
hostname) : 4 Time(s)
unknown[80.102.42.208] : Helo command rejected (need fully-qualified
hostname) : 54 Time(s)
unknown[80.242.7.41] : Helo command rejected (need fully-qualified
hostname) : 1 Time(s)
Unrecognized warning:
bledmeerfaste.intercom.it[195.72.192.7] offered null AUTH mechanism
list : 2 Time(s)
**Unmatched Entries**
[...]
---------------------- postfix End -------------------------
[...]
Come vedi c'è un sacco di merda a giro, non solo virus e spam, un sacco la
si può tagliare già fin dalla connessione :-)
Ciao
--
Marco Ermini
http://www.markoer.org
Dubium sapientiae initium. (Descartes)
<< This message is for the designated recipient only and may contain
privileged or confidential information. If you have received it in
error, please notify the sender immediately and delete the original.
Any other use of the email by you is prohibited. >>
Maggiori informazioni sulla lista
flug-tech