mainSavannah Administration - Support: sr #111018, Protect against new kind of spam


sr #111018: Protect against new kind of spam

Submitter:  Bruno Haible <haible>
Submitted:  Thu 08 Feb 2024 07:23:23 PM UTC
Category:  Project mailing lists Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  None
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup

Jump to the original submission

Fri 16 Feb 2024 11:18:11 PM UTC, comment #6: 

I think there's nothing in particular that can be done here, so closing. Thanks, all.

Karl Berry <karl>
Site Administrator
Fri 16 Feb 2024 06:59:28 PM UTC, comment #5: 

I'll just note that we have been seeing this type of spam off and one for a while now.  It's definitely sneaky.  And it fools people who only look at the subject line.

Lesson: Never approve anything just from the subject line.  Always look at the body of the message too.

The anti-spam tools that we use like CRM114 have generally done a good job of classifying the email in the correct direction.  But sometimes the clues are insufficient for the automation and then it falls upon the human reviewers to be vigilant.

It's especially difficult when the valid senders use poor email practices on valid emails.  Adding more restrictions to make automated detection more accurate will end up sweeping in some of these other senders that have not kept upgraded to all of the current email trends.  It's a problem.

Bob Proulx <rwp>
Site Administrator
Fri 09 Feb 2024 11:24:06 PM UTC, comment #4: 

I can't imagine a way to guess at what links are valid vs. spam, myself. Sometimes the existing filters will detect it. It's all so probabilistic, no way to know for sure.

In any case, thanks for the suggestion. Something to think about. We're always tinkering with the filtering.

BTW, I have not seen an onslaught of such spam. Usually such things come in waves of thousands, not a message here or there. Can only be grateful ...

Karl Berry <karl>
Site Administrator
Fri 09 Feb 2024 03:31:53 AM UTC, comment #3: 

Would it be possible/practical to filter out all links besides a subset of accepted safe ones? Not sure what these ones link to but I think it would help reduce the chances of more complex phishing attacks in the future.

Collin Funk <collinfunk>
Fri 09 Feb 2024 02:30:57 AM UTC, comment #2: 
Bruno Haible <haible>
Thu 08 Feb 2024 10:32:14 PM UTC, comment #1: 

I've just seen this on lists too. So far, the examples I've seen have a misspelling in the Subject: line, and change the name of the real poster slightly.

Anyway, I don't think there's any general way to deal with it, just like there's been no general way to deal with previous waves of spam using various new methods. We'll just have to be extra careful in approving.

I think future dates are already one of the many factors in guessing whether a msg is spam or not. But these dates seem to be in the future by only a few hours, or not at all, depending on the timezone and when it is read. I'm not sure spamassassin has a factor for that.

Thanks for bringing this up.

Karl Berry <karl>
Site Administrator
Thu 08 Feb 2024 07:23:23 PM UTC, original submission:  

A new kind of spam is appearing: They take a mailing list post, such as
add a link to a spam or phishing site, and post it:

In this case, it was easily detectable, due to a date that lies in the future. But what can be done, more generally?

Bruno Haible <haible>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by collinfunk (Posted a comment)
  • -email is unavailable- added by karl (Posted a comment)
  • -email is unavailable- added by haible (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-02-16 karl Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-c373.
    Corresponding source code