Skip to Content.
Sympa Menu

internetworkers - Re: [internetworkers] sobig, yet soannoying

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: Steven Champeon <schampeo AT hesketh.com>
  • To: internetworkers AT lists.ibiblio.org
  • Subject: Re: [internetworkers] sobig, yet soannoying
  • Date: Fri, 22 Aug 2003 11:07:34 -0400

on Fri, Aug 22, 2003 at 10:21:06AM -0400, Sil Greene wrote:
>
> Anyone gotten spammed by Sobig? I've gotten somewhere around 10 emails in
> the last 24 hours, all containing a variety of .pif files and all from
> different (and unrecognized) email addresses. But each and every one of
> them contains this line in the header:
>
> Received: from CHRIS-0QU83G05Q (rdu163-45-117.nc.rr.com [24.163.45.117])
> by smtp.unc.edu (8.12.9/8.12.9) with ESMTP id h7MDUwp4027527
> for <Sil_greene AT unc.edu>; Fri, 22 Aug 2003 09:30:59 -0400 (EDT)
>
> Anyone else had similar experiences?

Heh. Yeah, we've gotten some 200+ copies here (all quarantined, just
like all the rest of the Windows executable attachments we get) and
rejected some 3600+ more. We block on broken HELO (e.g.,
CHRIS-0QU83G05Q) so we have managed to avoid the vast majority of them.
Stick this into your LOCAL_RULESETS and smoke it:

KCheck_BogusHELO2 regex -a@MATCH ^[-0-_]+$
R$* $: $1 $| $(Check_BogusHELO2 $&{s} $)
R$* $| @MATCH $#error $@ 5.7.1 $: "550 Mail not accepted from bogus
HELO. Please use a hostname, " $&{s} ", not a Windows NetBIOS name."
R$* $| $* $: $1


--
hesketh.com/inc. v: (919) 834-2552 f: (919) 834-2554 w: http://hesketh.com
Book publishing is second only to furniture delivery in slowness. -b. schneier




Archive powered by MHonArc 2.6.24.

Top of Page