Subject: [Asrg] 1c. Analysis of Spam - casual observations from my log files

From: Brett Watson <[email-masked]>
Date: Wed, 25 Feb 2004 17:48:51 +1100

Folks,

Nothing Earth-shattering here, but I found it mildly interesting. I've noticed 
a number of failed attempts to spam me at my ASRG-specific address, and also 
my mail-ng-specific address. My current convention for specific addresses is 
famous-<specific-part>@nutters.org -- a common enough approach. (I don't much 
use the "base" address of "famous" anymore, since it has degenerated into a 
spam-trap over time.)

The first and foremost reason that these spam attempts have failed is because 
they fail to recognise the "dash" characters as part of the email address, 
and thus send to "asrg@..." rather than "famous-asrg@...". This also suggests 
that they were scraped out of an HTML page, either directly from the web, or 
in the cache of a compromised host. There's also a possibility that they were 
encountered in a plain message/rfc822 file on a compromised host. Available 
data relating to these incidents follows.

[Date: 2004-02-21 05:04:44 +0000; Peer: 218.54.209.137]
helo mail2.naool.com
mail from:<[email-masked]>
rcpt to:<[email-masked]>
+
[Date: 2004-02-25 02:38:42 +0000;  Peer: 64.173.9.239]
helo adsl-64-173-9-239.dsl.sntc01.pacbell.net
mail from:<[email-masked]>
rcpt to:<[email-masked]>
+
[Date: 2004-02-25 04:18:09 +0000; Peer: 83.154.201.104]
helo dyn-83-154-201-104.ppp.tiscali.fr
mail from:<[email-masked]>
rcpt to:<[email-masked]>

The first instance originates in Korea and has no in-addr.arpa PTR record, but 
mail2.naool.com does resolve to the address in question, and that host is an 
MX for naool.com, so I conclude that it was an open relay. Note that the 
second and third instances are relatively close together (less than 2 hours 
difference) and originate from a PacBell DSL account and a French PPP account 
respectively: almost certainly zombies. The "helo" argument in both cases is 
consistent with the in-addr.arpa PTR records for the originating IP. The 
spamware tool is randomly forging return path addresses with a local part 
matching /[A-Z]{9,11}/ and well-known freemail domains.

I have two similar records of spam attempts to "ng@..." which are almost 
certainly mis-parsed from "famous-mail-ng@....". The only noteworthy 
difference is that the return path has a lower case local part, but is 
otherwise similar: a string of random letters at yahoo.com. Probably a 
different spammer, though.

I also have one curious mis-send to "[email-masked]", which is probably a 
mis-parse of a quoted-printable rendition of "=tfbw@..." (and I can only 
speculate where that may have been encountered). "tfbw@..." is another valid 
address for me.

I surmise that the current practice in address-scraping is to find things 
which match <local-part>@<domain>, where <domain> is a routable mail domain, 
and <local-part> matches /[[:alnum:]]+/. It seems probable that spamware 
authors will wise up to the use of "dash" in email addresses sooner or later, 
if it has good enough payoff. They may even wise up to the plethora of other 
legal but obscure local-part productions. For the moment, however, a simple 
non-alphanumeric character is enough to make an address harvest-proof -- or 
so it seems.

Regards,
TFBW

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brett Watson <[email-masked]>
Date: Wed, 25 Feb 2004 18:34:35 +1100

On Wed, 25 Feb 2004 17:48, Brett Watson wrote:
> The first and foremost reason that these spam attempts have failed is
> because they fail to recognise the "dash" characters as part of the email
> address, and thus send to "asrg@..." rather than "famous-asrg@...". This

Of course, no sooner do I send the message, than I receive actual spam to my 
actual asrg address. Looks like it came through a cable modem account in 
Israel. Selected headers follow.

From: "Dixie Koch" <[email-masked]>
To: [email-masked]
Subject: Buy watches lennox
Date: Tue, 24 Feb 2004 23:06:48 -0700

So, was this a more intelligent instance of web-scraping, or is our dear 
spammer obtaining addresses via direct subscription to the list?

Regards,
TFBW

---

From: "Chris" <[email-masked]>
Date: Sun, 29 Feb 2004 21:02:49 +1030

I've been getting spam almost since I signed up

Annoying that an anti spam group could not have avoided this problem.

I assumed the email address was scraped from the archives

Chris

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Brett
> Watson
> Sent: 25 February 2004 6:05 PM
> To: [email-masked]
> Subject: [Asrg] Re: 1c. Analysis of Spam - casual observations from my
> log files
>
>
> Return-Path: <[email-masked]>
> Received: from [80.230.181.208] (helo=cable-181-208.inter.net.il)
> 	by randall.nutters.org with smtp (Exim 3.35 #1 (Debian))
> 	id 1AvsBv-00014F-00
> 	for <[email-masked]>; Wed, 25 Feb 2004 06:06:44 +0000
> Message-ID: <[email-masked]>

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 29 Feb 2004 13:46:01 -0500

> I assumed the email address was scraped from the archives

I have been talking to the IETF Secretariat about the need to 
reconfigure their archiver to hide email addresses, but so far no success.

Yakov