{"id":771,"date":"2003-06-14T12:00:47","date_gmt":"2003-06-14T20:00:47","guid":{"rendered":"http:\/\/lee.org\/blog\/archives\/2003\/06\/14\/6-14-03\/"},"modified":"2006-03-22T01:40:23","modified_gmt":"2006-03-22T09:40:23","slug":"spamkiller-spam-filter-help","status":"publish","type":"post","link":"https:\/\/www.lee.org\/blog\/2003\/06\/14\/spamkiller-spam-filter-help\/","title":{"rendered":"Spamkiller spam filter help"},"content":{"rendered":"

Here’s another weapon in the war against spam<\/strong>. In the last year I’ve started receiving a lot of spam that Spamkiller hasn’t been able to filter. These spams look like garbage when viewed in Spamkiller. I’ll see garbage like this in the body of the message: DQoNCjxNRVRBIEhUVFAtRVFVSVY9IkNvbnRlbnQtVHlwZSIgQ09OVEV…<\/p>\n

Well, what the spammers are doing is encoding the messages in Base 64<\/strong>. Outlook knows how to decode Base 64 but Spamkiller doesn’t.<\/p>\n

Here’s how I set up filters to stop this type of spam. I used this very helpful site<\/a> to encode a couple bits of text into Base 64 and then I stuck those encoded bits into Spamkiller’s killfile.<\/p>\n

More specifically, I encoded some very popular strings, like “a href=http:\/\/” and made those into Spamkiller filters. So, in this example, if the email isn’t in my don’t-kill file, it’s HTML based, encoded in Base 64, and has a hyperlink, Spamkiller will kill the message. This system is case-sensitive so I had to add a bunch more filters to cover other combinations of cases…<\/p>\n

Regular Expression for a href=”http:\/\/
\na href=”http:\/\/ converts to YSBocmVmPSJodHRwOi8v
\nhref=”http: converts to IGhyZWY9Imh0dHA6L
\nhref=”http:\/ converts to aHJlZj0iaHR0cDovL<\/p>\n

Regular Expression for A HREF=”http:\/\/
\nA HREF=”http:\/\/ converts to QSBIUkVGPSJodHRwOi8v
\nHREF=”http: converts to IEhSRUY9Imh0dHA6L
\nHREF=”http:\/ converts to SFJFRj0iaHR0cDovL<\/p>\n

Regular Expression for a href=http:\/\/
\na href=http: converts to YSBocmVmPWh0dHA6L
\nhref=http:\/ converts to IGhyZWY9aHR0cDovL
\nhref=http:\/\/ converts to aHJlZj1odHRwOi8v<\/p>\n

Regular Expression for A HREF=http:\/\/
\nA HREF=http: converts to QSBIUkVGPWh0dHA6L
\nHREF=http:\/ converts to IEhSRUY9aHR0cDovL
\nHREF=http:\/\/ converts to SFJFRj1odHRwOi8v<\/p><\/blockquote>\n

<\/p>\n

So, in case it’s not clear, I went into Spamkiller and, using the Advanced… button I created 12 Message Text Filters that look like this the photo on the right.<\/p>\n

Of course, the war will continue to escalate. There are other obfuscation techniques that this technique doesn’t prevent.<\/p>\n

I still believe that the best way to stop spam is to legislate it away. This worked with spam faxes and it can work with spam email.<\/p>\n

Joy.<\/p>\n

Trying to set up an scp server on my Windows 2000 machine is reminding me why I got out of using linux. People are ecstatic about writing supercharged, amazing tools that can help you conquer the world, but they don’t ever bother to tell you where the frigging “start” button is!!<\/p>\n","protected":false},"excerpt":{"rendered":"

Here’s another weapon in the war against spam. In the last year I’ve started receiving a lot of spam that Spamkiller hasn’t been able to filter. These spams look like garbage when viewed in Spamkiller. I’ll see garbage like this in the body of the message: DQoNCjxNRVRBIEhUVFAtRVFVSVY9IkNvbnRlbnQtVHlwZSIgQ09OVEV… Well, what the spammers are doing is encoding […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-771","post","type-post","status-publish","format-standard","hentry","category-general"],"_links":{"self":[{"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/posts\/771","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/comments?post=771"}],"version-history":[{"count":0,"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/posts\/771\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/media?parent=771"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/categories?post=771"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lee.org\/blog\/wp-json\/wp\/v2\/tags?post=771"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}