Category Archives: spam

Rule #3

Rule #3 states “Spammers are stooOOpid.”

if you need an example of rule #3, i have one for you:

the spammer sent mail from a computer called… get this…

UCEBOX.CO.ZA

😝😂🤣🤪🤦😠🤬

for those of you who still don’t “get” it, not only is the computer in south africa, home to all things shady and illegal, but “UCE” stands for “Unsolicited Commercial Email”… in other words, “spam”.

it’s as though they’re saying, “fuck yeah, we’re so gawd-damned proud of the illegal spam we send, that we’re going to name our computer after it, and nobody will care, even if they do notice!”

people should have to take an intelligence test before being allowed into the human race.

seriously.

spam update

i have now, officially, blocked IP address ranges in the following countries:

afghanistan
albania
angola
argentina
aruba
australia
austria
bangladesh
belarus
belgium
bhutan
bolivia
bosnia & herzegovina
brazil
british virgin islands
bulgaria
cambodia
canada
chile
china
colombia
congo
cote d’ivoire
croatia
czech republic
denmark
ecuador
egypt
el salvador
estonia
finland
france
georgia
germany
ghana
greece
guatemala
honduras
hong kong
hungary
iceland
india
indonesia
iran
iraq
ireland
israel
italy
japan
jordan
kazakhstan
kenya
kyrgyzstan
latvia
lithuania
luxembourg
macao
malaysia
mexico
moldova
monaco
mongolia
morocco
myanmar
netherlands
new zealand
nigeria
norway
pakistan
panama
paraguay
peru
philippines
poland
romania
russia
serbia
seychelles
singapore
slovakia
south africa
south korea
spain
sweden
switzerland
taiwan
tajikistan
tanzania
thailand
Trinidad & tobago
turkey
UK
ukraine
uruguay
USA
uzbekistan
vietnam

the big winners are china, russia, and india, and the runners up are spain, uzbekistan and kazakhstan…

and the good ol’ united states of ‘merica makes an appearance, as well.

before i started blocking whole swaths of IP addresses, the CPU usage on my server was between 75% and 100%, pretty much always. since i started blocking IP address ranges, my CPU usage is between 2% and 5%… which means that my web sites respond more quickly.

a side benefit is that, often, the same IP address ranges that are used by spammers, are also used by crackers, skript-kiddies, and other miscreants, so by absolutely blocking them (using both the IP Blocker and the Global Email Filters) i kill two birds with one stone. 😉

the down side is that i’ve been catching a few false positives, which are messages from people within north america, but, through no fault of their own, sent their messages at EXACTLY the right time, so that the date in their message ID gets caught by the rule that’s supposed to catch IP addresses… 😖

but, honestly, there have been fewer than 10 false positives in the last 6 months (they tend to come in spurts: i’ve caught 3 today, but haven’t seen one for months), whereas, if left unfettered, i would have received, easily, 100 times that many spam messages PER DAY, so, in all, i’m almost ready to make my list available to anybody else who wants to cut down on the people who send you spam… 😉

new regex stuff!

logical operators! thanks ian! 😉

+ () [] - |

(stuff that remains the same)+(stuff that changes) – otherwise known as “capture groups”

[89] = 8 or 9

[0-4] = 0, 1, 2, 3, or 4

| = logical OR

so…

\D(85\.157\.47\.)+(12[89]|1[3-9][0-9]|2[0-4][0-9]|25[0-5])\D

means “capture everything in 85.157.47.128/25”

which, up until now, has meant “make a separate rule for every IP address between 85.157.47.128 and 85.157.47.255” — 128 SEPARATE RULES, which takes A LONG time, and slows down processing speed.

this is a BIG step forward!

WOO!!! 😎👍

ETA 200205: even more WOO!!! because ian directed me to a RegEx Numeric Range Generator, which means that i don’t have to figure them all out myself! WOO!!! 😎👍

calm, still no storm… weird…

still calm, still a few “false positives” which are easily dealt with, and forwardable almost immediately… ‼👍 but no “bitcoin sextortion” spam since 191202… and the record is currently held by 1LfYcbCsssB2niF3VWRBTVZFExzsweyPGQ, who i last heard from on 191127, who spammed me four hundred eighty-seven times

spam assassin has, apparently, figured out a regex (or something) for capturing bitcoin addresses, so after 191127, there have been no bitcoin sextortion spams that have NOT been labeled as ***SPAM*** by spam assassin, which makes them a lot easier to filter out.

but it’s weird, because, even though it has been almost a week now, waking up in the morning and NOT having two or three DOZEN spam messages to process makes me nervous that something else may be happening to all of those messages, and, potentially, legitimate messages, as well, and i have no clue what may be happening to them, because nobody other than me is even aware of the fact that they’re not there any longer. 😕

we started the panto. it’s Jack and The Beanstalk… i don’t remember whether this is the first panto we did, or the second panto we did, way back when we first started doing pantos, 17 years or so ago… but it’s largely the same script: different actors but the same characters… and no simon, but he hasn’t been involved since he got drunk, did something which he wasn’t supposed to (sexual harrassment? stealing stuff? something that only drunk people do… 😒), and was banned from the palladium, a few years ago. we did the first four of 20 performances, last weekend, and only missed one music cue: half the band started a half a measure before the other half of the band, and none of the singers came in at the right point, but we recognised it almost immediately, and kiki said “wait, can we start that again?” and everybody came in on cue when we tried it again… and there was one place at the end of the panto, where the giant chops down the beanstalk, and the ogress (represented by a puppet) falls from the castle in the sky, along a zip-line, to the back of the palladium. but, this time, the doors to the castle opened, but no ogress came out… so we just continued, where the ogress (this time, the real actor) then “falls” back up to the front of the stage, and has a few lines… and then the puppet ogress decided it was time to fall… 🤣

but, all in all, the panto is going well.