Internetworkers: http://www.ibiblio.org/internetworkers/

[Steven Champeon <schampeo AT hesketh.com>]

on Wed, Dec 03, 2003 at 10:50:42AM -0500, Jay Cuthrell wrote:
> It's apparently the same crappy spamware that manufactures bogus semi-random
> addresses
> 
> From: "$First $MI $Last" <$firstname.$lastname$junkfiller@jjdomain>

I've got some twenty or so sendmail rules to block mail matching these
patterns; but only if it also matches other spamsign as well. There's
a slew of variants on the same theme:

# first_last e.g. "Eileen W. Harden" <eileen_hardentk AT ecmsel.co.uk>
# firstlast e.g. "Susan Proctor" <susanproctorys AT jace.co.uk>
# first.last_ e.g."Joy H. Muller" <joy.muller_lm AT jawa.at>
# first.last e.g. "Adolfo Wang" <adolfo.wangon AT cellsure.co.za>
# f_last e.g. "Ronda Chandler" <r_chandlerka AT olympicteam.de>
# first_last_ e.g. "Patrice M. Nicholas" 
<patrice_nicholas_mf AT the-undertaker.co.uk>
# flast_ e.g "Burl K. Buck" <bbuck_wn AT archimedes.pol.lublin.pl>
# f.last_ e.g. "Candice Garza" <c.garza_qv AT wsab.se>
# last_ e.g. "Chasity Fischer" <fischer_dg AT glos.ac.uk>
# last e.g. "Claudette Muniz" <munizbu AT archives.state.al.us>
# firstmlast e.g. "Kendra N. Delarosa" <kendrandelarosa_cu AT ascrum.de>
# f_last_ e.g. "Lilian S. Short" <l_short_fk AT ska.in-berlin.de>
# firstlast_ e.g. "Mindy Rodriguez" <mindyrodriguez_vw AT artinmind.de>
# fm.last e.g. "Robbie M. Hess" <rm.hessdh AT there-is-no-spoon.co.uk>
# f.last e.g. "Gerald Boyer" <g.boyerot AT jims.cam.ac.uk>
# flast_ e.g. "Lorrie Mullen" <lmullen_up AT thriller.co.uk>
# f_m_last_ e.g. "Julius L. Myers" <j_l_myers_gq AT central.ysd.sk.ca>
# flast e.g "Nina W. Wooten" <nwootenxf AT mf.no>
# f_last_ e.g. "Harlan W. Erickson" <h_erickson_el AT sign-lang.uni-hamburg.de>

Then they started throwing curve balls:

# firstmcLast e.g. "Deanna McCarthy" 
<deannamcCarthyap AT sign-lang.uni-hamburg.de>
# f_la-st_ e.g. "Kalila A. Garcia-Molina" <k_garcia-Molina_cj AT hermas.com>

I'm sure there are more variants, I just haven't seen them yet. I have a
catchall alias on most of my domains that simply refuses mail to unknown
addresses with a message to the effect of "no, thanks, we don't want your
stupid joe job bounce spam reports".

-- 
hesketh.com/inc. v: (919) 834-2552 f: (919) 834-2554 w: http://hesketh.com
Book publishing is second only to furniture delivery in slowness. -b. schneier