[Nlnog] Toename in list subscription bombing

[Niels Bakker]

Hallo,

De afgelopen tijd worden zowel noc@ als webmaster@ ams-ix.net door  
derden op mailing lists gesubscribed.

In het begin was dit wel grappig (de "pantyhosefetish.com" mailing  
list?) maar het begint ondertussen best vervelend te worden.  Het  
vervuilt ook ons ticketing system.

Alle subscription confirmation mails hebben een vrij lage score in  
SpamAssassin.  Ik loop alle hosts gewoon te blocken in /etc/postfix/ 
access maar dat schaalt niet echt.

Hebben andere mensen ook een toename van dit soort misbruik gezien?   
Tips, SA rules etc. om dit tegen te gaan?

Overigens zijn de laatste regels van 't tweede bijgesloten mailtje  
best interessant...


Begin forwarded message:

> Return-Path: <bounces at hotbobs.com>
> Received: from hotbobs.hitsconnect.com (hotbobs.hitsconnect.com  
> [63.246.153.22])
>     (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
>     (No client certificate requested)
>     by betonmix.noc.ams-ix.net (Postfix) with ESMTP id 8532BFA868
>     for <noc at ams-ix.net>; Thu, 20 Oct 2005 08:02:06 +0200 (CEST)
> Received: from hotbobs2 by hotbobs.hitsconnect.com with local (Exim  
> 4.52)
>     id 1ESTV7-0003rh-Af
>     for noc at ams-ix.net; Thu, 20 Oct 2005 01:02:05 -0500
> Content-Disposition: inline
> Content-Transfer-Encoding: binary
> Content-Type: text/plain
> MIME-Version: 1.0
> X-Mailer: MIME::Lite 2.117  (F2.72; T1.001; B3.05; Q3.03)
> Date: Thu, 20 Oct 2005 06:02:05 UT
> From: "Advertising knowhow newsletter" <admin at hotbobs.com>
> To: "Amsix Amsixnet" <noc at ams-ix.net>
> Subject: Re: [AMS-IX #10922] Advertising Know-How Subscription  
> Confirmation
> Message-Id: <814101_542979_133996_930654 at hotbobs.com>
> X-AntiAbuse: This header was added to track abuse, please include  
> it with any abuse report
> X-AntiAbuse: Primary Hostname - hotbobs.hitsconnect.com
> X-AntiAbuse: Original Domain - ams-ix.net
> X-AntiAbuse: Originator/Caller UID/GID - [32006 32003] / [47 12]
> X-AntiAbuse: Sender Address Domain - hotbobs.com
> X-Source: /usr/bin/perl
> X-Source-Args: /usr/bin/perl arp3-formcapture.pl
> X-Source-Dir: hotbobs.com:/public_html/cgi-bin/arp3
>
> Thank you for subscribing to Advertising Know-How.
> We operate a 100% permission only policy
> You have subscribed as Amsix
> at noc at ams-ix.net
>
> In order to receive your report on how scotts sign up rate went from
> 10 to 500 subscribers today you will need to confirm your subscription
> by clicking once on the link below.
>
> http://www.hotbobs.com/cgi-bin/arp3/arp3-confirm.pl? 
> p=1129788125.175067
>
> If the above link is not clickable for any reason then copy and  
> paste it
> into your browser.
>
> If you delete this email without using the above link your  
> subscription
> will automatically be deleted after 72 hours.
>
> You may also contact me at webmaster at advertisingknowhow.com
> -------------------------------------------------------
>
> We are dedicated to legitimate mailing to those that voluntarily  
> sign-up
> their email address to receive mail from Advertising Know-How. ALL  
> mails
> have a remove from list link at the bottom .
>
> All list data is secure and safe and NEVER released to any one.
>
> If you wish not to receive this report or not to be a subscriber to
> Advertising Know-How You may remove your self instantly by using
> this link http://www.hotbobs.com/cgi-bin/arp3/arp3-un.pl? 
> c=164219&p=8812
>
> Thank you.
> Robert Puddy
> editor of Advertising Know-How


Begin forwarded message:

> Return-Path: <errors+gb at ipost.com>
> Received: from www02.ipost.com (db02.ipost.com [64.84.5.12])
>     by betonmix.noc.ams-ix.net (Postfix) with ESMTP id E4E97FA868
>     for <noc at ams-ix.net>; Thu, 20 Oct 2005 08:06:25 +0200 (CEST)
> Received: (from nobody at localhost)
>     by www02.ipost.com (8.11.6/8.11.6) id j9K66P308194;
>     Wed, 19 Oct 2005 23:06:25 -0700
> Date: Wed, 19 Oct 2005 23:06:25 -0700
> Message-Id: <200510200606.j9K66P308194 at www02.ipost.com>
> X-Authentication-Warning: www02.ipost.com: nobody set sender to  
> errors+gb at ipost.com using -f
> Precedence: bulk
> Subject: [AMS-IX #10923] Garden Botanika subscription preferences  
> changed
> From: "Garden Botanika" <admin+gb at ipost.com>
> To: noc at ams-ix.net
>
> This message confirms changes to your subscription preferences
> for address <noc at ams-ix.net>.
>
> This address is SUBSCRIBED to mailings from Garden Botanika.
>
> To review your preferences or make further changes:
> http://gb.ip07.com/gb/prefs// 
> 9z1zo2dht82jk2aiam7aegfmiqm5b2odan6ltjg6kdo
>
> If these changes were not made or authorized by you,
> please notify <admin+gb at ipost.com>.
>
> Submission details:
>  IP address: 80.11.125.82
>  Date: Wed Oct 19 23:06:25 2005