Newsgroup: it.news.net-abuse
Titolo: [STATISTICHE] spam rifiutato da attila.bofh.it (ottobre 2004)

Queste sono le statistiche aggregate dello spam rifiutato da
attila.bofh.it
 tra queste date:
Oct 3 06:49:27
Oct 31 06:49:46
Al momento della generazione di queste statistiche, il server era
protetto (nell'ordine) da queste DNSBL:
sbl-xbl.spamhaus.org
list.dsbl.org
dnsbl.njabl.org
korea.services.net
dul.dnsbl.sorbs.net
l1.spews.dnsbl.sorbs.net
 256942	Bad HELO
  95726	DNSBL 
xbl.spamhaus.org
  76856	body checks
  47495	Recipient address rejected
  45899	DNSBL 
dul.dnsbl.sorbs.net
  42825	header checks
  15708	DNSBL 
list.dsbl.org
  13277	DNSBL 
dnsbl.njabl.org
  11621	DNSBL 
l1.spews.dnsbl.sorbs.net
   9015	Relay access denied
   6721	DNSBL 
korea.services.net
   5826	Client host rejected
   2493	DNSBL 
sbl.spamhaus.org
   2130	Need FQDN address
   1186	Sender address rejected
     20	Need FQDN address (recipient)
      4	Bad pipelining
 633744	TOTAL
Rejected headers:
  37742	no executable attachments allowed
   3459	Your mailer is not RFC 2047 compliant
    975	Gibe-F/Swen.A worm
    428	keep your viruses for yourself (ZIP)
    213	do not send stupid bounces
      7	Message content rejected
      1	we do not accept automatically generated complaints
Rejected bodies
  27642	
wonderland.linux.it
 is being forged by a spammer (SBL19309)
  10796	
wonderland.linux.it
 is being forged by a spammer (SBL20100)
  10326	
wonderland.linux.it
 is being forged by a spammer (SBL19694)
   6442	
wonderland.linux.it
 is being forged by a spammer (SBL19999)
   6150	
wonderland.linux.it
 is being forged by a spammer (SBL18559)
   5159	
wonderland.linux.it
 is being forged by a spammer (SBL18652)
   4592	
wonderland.linux.it
 is being forged by a spammer (SBL20102)
   3060	
wonderland.linux.it
 is being forged by a spammer (SBL17821)
    992	suspicious .zip file detected
    934	keep your viruses for yourself (hidden iframe)
    224	do not send stupid bounces
    207	keep your viruses for yourself (bmp attachment)
    194	
wonderland.linux.it
 is being forged by a spammer (SBL20485)
     72	
wonderland.linux.it
 is being forged by a spammer (SBL20187)
     62	
wonderland.linux.it
 is being forged by a spammer (SBL19277)
      2	
wonderland.linux.it
 is being forged by a spammer (SBL18779)
      1	suspicious .zip file detected (bad encoding)
      1	suspicious .zip file detected (password-protected)
Rejected HELO commands
 117697	using my own HELO hostname
 112590	fake IP literal in HELO hostname
  18179	unqualified HELO hostname
   6737	forged HELO hostname
   1739	Invalid name
Rejected hosts
   3988	Too much spam from CHINANET
   1716	non accettiamo posta da IP dinamici
     82	Too much spam from 
ethome.net.tw
     31	Too much spam from 
gwbn.net.cn
      9	Too much spam from 
chinamobile.com
-- 
ciao,
Marco

    1739 Invalid name
Ti spiacerebbe postare le regole usate per l'helo_access ?
in alternativa qualche link o lettura utile...
Grazie
-- 
Alex

 in alternativa qualche link o lettura utile...
http://www.postfix.org/uce.html#smtpd_helo_required
http://www.postfix.org/uce.html#smtpd_helo_restrictions
-- 
                          Maurizio - Tannoiser - Lemmo
                 Founder Member of ERLUG 
http://erlug.linux.it
-------------------------------------------------------------------------------
Wasting time is an important part of life.

in alternativa qualche link o lettura utile...
        check_helo_access hash:/etc/postfix/helo_access
        check_helo_access pcre:/etc/postfix/helo_access.pcre
localhost               REJECT using my own HELO hostname
213.92.8.2              REJECT using my own HELO hostname
...
remailer.com
            REJECT forged HELO hostname
postmaster.com
          REJECT forged HELO hostname
...
/^\d+\.\d+\.\d+\.\d+$/          REJECT fake IP literal in HELO hostname
/^[^\.]+\.?$/                   REJECT unqualified HELO hostname
grep 'helo=<' /var/log/mail.log | grep 'blocked using' > HELO
perl -pe 's/^.*helo=<([^>]+)>.*/$1/' < HELO > HELO2
sort < HELO2 | uniq -c | sort -rn > HELO3
-- 
ciao, |
Marco |  The Italian Usenet Cabal, Abuse Department (TINC)
"It's about damn time that all of us who actually give a damn about Usenet
stand up and tell the people who don't to fuck off and die." -- Russ Allbery

   XXX	
wonderland.linux.it
 is being forged by a spammer (<vari>)
Qui mi sfugge qualcosa: perché nei body_checks (mi verrebbe da dire
check_helo_access)? Potresti spiegarmi come fai questo controllo?
Grazie.
A.
-- 
questo articolo e` stato inviato via web dal servizio gratuito 
http://www.newsland.it/news
 segnala gli abusi ad 
ab...@newsland.it

check_helo_access)? Potresti spiegarmi come fai questo controllo?
Questo è il backscatter causato da uno spammer che falsifica
wonderland.linux.it
, appunto lo filtro cercando gli URL nel corpo del
messaggio..


 messaggio.
Uhm. Rifiuti tutti i DSN che hanno 
wonderland.linux.it
 nel body? Non hai
mailbox attive @
wonderland.linux.it
?


mailbox attive @
wonderland.linux.it
?
Se non avessi mailbox attive eviterei di ricevere la posta tout court...


 No, non č quello che ho scritto.
Ok, non sto capendo un cazzo. Se non sto chiedendo troppo, quando hai un
attimo potresti fare un cut and paste di:
mail 
nyj4...@sneakemail.com
 < /etc/postfix/body_checks
Se non ci arrivo nemmeno cosě lascio perdere. :|
Grazie dell'aiuto.


attimo potresti fare un cut and paste di:
Es:
~http://(mdntpsdprescrt|arecarmatey)\.com/~
        REJECT 
wonderland.linux.it
 is being forged by a spammer (SBL17821)


 Es:[cut]
Ora mi č chiaro, grazie Marco.
A.
