Re: Filter envelope sender not from address to prevent new spam attack

I've written a PHP script to collect subject lines into a 
file and that gets used in the incoming log to filter out
spam with the same or similar subject line.

The spammers have now started to add random strings to their 
subject lines, but I have a workaround for that too :)

Do you want a copy of my script?

Maybe you can adapt that to your needs?

Kind Regards,

Keith Roberts

-----------------------------------------------------------------
Websites:
http://www.php-debuggers.net
http://www.karsites.net
http://www.raised-from-the-dead.org.uk

All email addresses are challenge-response protected with
TMDA [http://tmda.net]
-----------------------------------------------------------------

On Thu, 30 Apr 2009, Dave Steinberg wrote:

> To: Russell Robinson <[email protected]>
> From: Dave Steinberg <[email protected]>
> Subject: Re: Filter envelope sender not from address to prevent new spam
>     attack
> 
>> On Thu, 30 Apr 2009 07:02:30 am Dave Steinberg wrote:
>>> My understanding was that TMDA *only* uses the envelope sender, except
>>> if you use a headers directive to look at the 'from' field, which I am
>>> guessing you're not doing.
>>
>> It seems not....
>>
>> I just had a detailed look at the tmda-filter code.
>>
>> I'm not a python programmer, but in the "main()" function it seems to be
>> creating an array called "sender_list" which consists of the envelope sender,
>> the list of From addresses and the list of Reply-To addresses.
>>
>> It then calls infilter.firstmatch with the sender_list, which returns when it
>> finds something that matches.
>>
>> And it succeeds because the From address is included in the sender_list.
>>
>> I've checked the code in version tmda-1.1.12 and it's the same.
>
> Yep, thanks for digging in, clearly my understanding wasn't correct!
>
>>> You've confirmed your analysis in your incoming log, yes?  Its a 'from'
>>> entry of some kind that's matching?
>>
>> Yes, Here's a log file entry:
>> 	Date: Wed, 01 Apr 2009 08:23:24 +1100
>> 	Sndr: [email protected]
>> 	From: "Heidi Carver" <[email protected]>
>> 	To: [email protected]
>> 	Subj: Vacheron Constantin cheaper than you could imagine!
>> 	Actn: OK (from-file ~/.tmda/lists/whitelist ok)                        (1172)
>>
>> [email protected] is in the whitelist, whereas [email protected] is
>> not.
>>
>> This seems to confirm my code analysis above.
>
> Maybe what's needed is to pull the list of desired header strings into a
> conf file?  Seems like it shouldn't be *too* hard to put together a patch.
>
> Worst case, just modify your local install to not include the from header?
>
> -- 
> Dave Steinberg
> http://www.geekisp.com/
> http://www.steinbergcomputing.com/
>
> ------------------------------------------------------------------------------
> Register Now & Save for Velocity, the Web Performance & Operations
> Conference from O'Reilly Media. Velocity features a full day of
> expert-led, hands-on workshops and two days of sessions from industry
> leaders in dedicated Performance & Operations tracks. Use code vel09scf
> and Save an extra 15% before 5/3. http://p.sf.net/sfu/velocityconf
> _______________________________________________
> tmda-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/tmda-users
>

------------------------------------------------------------------------------
Register Now & Save for Velocity, the Web Performance & Operations 
Conference from O'Reilly Media. Velocity features a full day of 
expert-led, hands-on workshops and two days of sessions from industry 
leaders in dedicated Performance & Operations tracks. Use code vel09scf 
and Save an extra 15% before 5/3. http://p.sf.net/sfu/velocityconf
_______________________________________________
tmda-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tmda-users