Subject: Re: [Tools-discuss] recent spam subscriptions to ietf.org lists

From: Glen <[email-masked]>
Date: Tue, 12 Apr 2016 09:11:41 -0700

> From: "HANSEN, TONY L" <[email-masked]>
> Subject: [Tools-discuss] recent spam subscriptions to ietf.org lists
> Date: April 11, 2016 at 10:34:44 AM GMT-3
> To: Tools-discuss <[email-masked]>, WGChairs <[email-masked]>
>
> I'm seeing spam subscriptions ramping up again, using random subaddresses
> off of a handful of gmail addresses. So far they all match these patterns:
>
> ^leafylagann\[email-masked]
> ^kemo.mart\[email-masked]
> ^kezukaya\[email-masked]
> ^dramaalertbiz\[email-masked]
> ^killerkeemstar\[email-masked]
> ^newdramaalert\[email-masked]
>
> - Tony

This was forwarded to me for response.

The way to combat this is to add a per-list configuration addition to
the "banned addresses" section of the list config...

When we saw this previously, it was all +numeric suffixes.

Doing something like,

^[a-zA-Z0-9_.-]+\+[0-9][email-masked]

would probably stop all of them.

Or, the list owner could limit it to the known prefixes, and do a
separate entry for each one, like this:

^kemo.mart\+[0-9][email-masked]

Of course, Tony's rules suggest that the address space has spread to
alpha characters, so his rules might work better.

AMS has applied these to the lists we manage; but it is up to each
list owner to choose to use one (or more) of the above methods on your
particular lists (or not.)

Glen
Glen Barney
IT Director
AMS (IETF Secretariat)

---

From: "HANSEN, TONY L" <[email-masked]>
Date: Tue, 12 Apr 2016 18:32:37 +0000

>particular lists (or not.)

Hi Glen, thanks for your reply.

Yes, I had added those patterns to my per-list configuration.

And yes, the address spaces HAS spread to alpha characters.

Note, I wouldn't add "^[a-zA-Z0-9_.-]+\+[0-9][email-masked]" because I know a number of people who use +ietf (even on gmail) on their legitimate subscription addresses.

	Tony

---

From: Glen <[email-masked]>
Date: Tue, 12 Apr 2016 11:36:48 -0700

> Note, I wouldn't add "^[a-zA-Z0-9_.-]+\+[0-9][email-masked]" because I know a number of people who use +ietf (even on gmail) on their legitimate subscription addresses.

Tony -

Understood and acknowledged, thank you!!!

Glen