Page 1 of 1
Spamfilter for Sex Pages
Posted: Tue May 23, 2006 8:21 am
by Trancer
hi all
Every Days connect a proxy User and post in a Query this Text
[19:44:46] <onzad> i saw your girlfriend on cams2006.com
)
The Text is variable
Have idea for a spamfliter on Cams whit Wildcard tho Block this Text?
Sorry for my english
German:
Es connecten jeden Tag Users mit Proxy und schreiben flogendes ins Query mehreren Usern
[19:44:46] <onzad> i saw your girlfriend on cams2006.com
)
Kann jemand ein Spamfilter Entwerfen auf cams mit Wildcards so dass es den ganzen Text blockt?
mfg
Posted: Tue May 23, 2006 8:55 am
by akin
Code: Select all
spamfilter {
regex "cams2006\.com";
target private;
action gline;
reason "exit.";
};
Posted: Fri May 26, 2006 4:59 am
by nate
A network I visit regularly is being hit with this bot also (atleast assuming its the same bot, usually has the same host mask, with minor changes because its a dialup, so it changes on the class C end of it), but the problem is thats not the only line it, it spams multiple different sites, most likely which contain a trojan or some crap.
Its nickname and ident are always the same thing, but rotate (Always 5 letters long, seemingly 5 lower case letters that are randomized).
Its real name though however on every one is the same, simply though its just 'Real Name', but doing a full broad filter or even a SGline maybe to block that would be bad, as I'm sure there are clients out there which default as that?
Posted: Fri May 26, 2006 5:01 am
by Stealth
Paste some whois examples?
Posted: Fri May 26, 2006 10:35 pm
by ARcanUSNUMquam
Hallo,
We've been getting those bots too, and they have been spamming other stuff, so we just banned the entire ISP with as much other info as we could.
Here are some things I gleaned from our spamfilter logs:
I used this to spamfilter them:
Code: Select all
/spamfilter add u gline - Spam ((?-i:[a-z]{5}))!~\1@pc[0-9]{2}\.zippcomplex\.iasi\.rdsnet\.ro:Real name
Posted: Sat May 27, 2006 2:29 am
by Stealth
Why not
Code: Select all
/gline 0 ~*@*.zippcomplex.iasi.rdsnet.ro Due to abulsive connections from this ISP, it is now required that users connecting from this ISP enable identd
Posted: Sat May 27, 2006 2:46 am
by ARcanUSNUMquam
We've got the processing power to handle complex spamfilters and we don't like banning entire ISPs unless we absolutely need to. We pride ourselves on balancing security with openness, which is why I love spamfilters so much.
Posted: Sat May 27, 2006 3:16 am
by Stealth
With that you aren't necessarily banning the whole ISP, just unidented hosts. Spamfilters are great until someone decides to be smart and randomizes the real names as well...
Posted: Sat May 27, 2006 5:20 pm
by Jason
Stealth, it is pretty rare for someone to write a good attack script that cant be spamfiltered. And even then, you can usually trapchan it or something. I dont think he has to worry about this. Unless the attacker reads here he wont know the reason his bots are found out. IMO, a spamfilter is the better solution to this until the attacker gets a brain (unlikely). Its probably a canned script anyhow, and the attacker has no idea how to do anything to it.
Posted: Sun Jul 09, 2006 2:00 am
by Git
/spamfilter add pnNa gline +0 Blocked i.?saw.?your.?girlfriend.?on.?cams2006.?com.*