# NUISANCE LIST # # These are idiots whose stuff can't be caught by normal # methods, such as header or body IP or domain filtering, # and must be caught by a pattern match. # # The difference between these recipes and the generic # pattern matching recipes is that these recipes are far # narrower and intended to catch a specific spammer or # extremely specific type of spam, NOT to catch all spam # in a particular category. (Such as pill pushers.) # American English Center/American Language Center/New York Linguistics Center # # Last reported spam: 10/30/05 # Data files last updated: 9/25/05 # # Other Relevant Info: # # 10/07/03: # Russian spamhaus that spams in Russian selling American # English language training. Prolific, pushy, use every trick # in the book. :/ # # 6/30/05: # Still out there, still using every filter evasion trick # imaginable. Very determined, nekulturniy slimeballs. (Yes, # I intended them to see this if they're watching.) # # 7/25/05: # Looks like this spammer is dead -- literally. According to # MosNews.com, Vardan Kushnir, the spammer responsible for this # spam, was murdered Sunday, July 24, 2005 in his apartment in # Moscow. :/ There's no indication that his spamming caused # his murder, although that is certainly possible. Leaving the # recipe in place because someone else might take over this # thriving "business". # # 9/25/05: # One of Kushnir's colleagues clearly took over his business. # The spam from these idiots continues unabated. # TESTNAME='American English Center' TESTPATTERNS=${SBDIR}/black/aecnylc-patterns.rc TESTSCORE=${SPAMLEVEL} TESTLAST=20051030 TESTUPDATED=20050925 INCLUDERC=${SBDIR}/functions/identify-spammer-patterns.rc # Ariel Bastiero # # Last reported spam: 9/24/05 # Data files last updated: 9/24/05 # # Other Relevant Info: # # 9/24/05: # Long-time spamming member of the Argentinian House # of Representatives. (Yeah, spamming politician. Who'd # have thought it? ) # TESTNAME='Ariel Bastiero' TESTPATTERNS=${SBDIR}/black/arielbastiero-patterns.rc TESTSCORE=${SPAMLEVEL} TESTLAST=20050924 TESTUPDATED=20050924 INCLUDERC=${SBDIR}/functions/identify-spammer-patterns.rc # Banned CD # # Last reported spam: 12/22/04 # Data files last updated: 1/25/05 # # Other Relevant Info: # # 7/17/03: # Widely spammed *nuisance* with no clear originating # point, no domains they own and no clear "get back to # the spammer" links. # TESTNAME='Banned CD' TESTPATTERNS=${SBDIR}/black/bannedcd-patterns.rc TESTSCORE=${SPAMLEVEL} TESTLAST=20041204 TESTUPDATED=20050125 INCLUDERC=${SBDIR}/functions/identify-spammer-patterns.rc # Max Clark # # Last reported spam: 11/02/05 # Data files last updated: 11/02/05 # # Other Relevant Info: # # 11/02/05: # Spammer whose original home was with then-ROKSO-listed # spammer Brian Farrow of Hivelocity. Farrow and Hivelocity # have cleaned up their act, and among the spammers they sent # awandering for a home is this one, who doesn't use a set # domain or IP range. :/ # TESTNAME='Max Clark' TESTPATTERNS=${SBDIR}/black/maxclark-patterns.rc TESTSCORE=${SPAMLEVEL} TESTLAST=20051102 TESTUPDATED=20051102 INCLUDERC=${SBDIR}/functions/identify-spammer-patterns.rc # Essential Underground Handbook # # Last reported spam: 12/08/04 # Data files last updated: 00/00/00 # # Other Relevant Info: # # 8/14/03: # Book with lots of questionable and outright illegal # advice on a bunch of stuff, spammed all over the place. # TESTNAME='Essential Underground Handbook' TESTPATTERNS=${SBDIR}/black/essentialundergroundhandbook-patterns.rc' TESTSCORE=${SPAMLEVEL} TESTLAST=20041208 TESTUPDATED=20050125 INCLUDERC=${SBDIR}/functions/identify-spammer-patterns.rc # Evangelical Protestant Proselytizing spammer # # Last reported spam: 4/04/05 # Data files last updated: 4/04/05 # # Other Relevant Info: # # 12/05/03: # Massive proselytizing spam. Must be filtered with a content filter, since # the spammer does not provide any method of contacting him back. He doesn't # need to -- this is a standard evangelical Protestant "how to be saved" message # that could have been taken from one of any number of tracts I've seen over # the years. That does NOT provide an acceptable excuse for spamming. # # 12/11/03: # Proselytizing spam, probably related to "If You Are Not Saved" spam. # # 12/12/03: # A third variant of this spam -- I've now collapsed it into a single recipe. # It's the same person or people doing this, clearly. :/ # # 1/26/04: # He's BAA-AAACKKK. (Or someone else that sounds just like him.) # # 4/04/05: # Like the eveready bunny.... # # Status: Active Spammer # TESTNAME='EvProt' TESTPATTERNS=${SBDIR}/black/evprot-patterns.rc TESTSCORE=${SPAMLEVEL} TESTLAST=20050404 TESTUPDATED=20050404 INCLUDERC=${SBDIR}/functions/identify-spammer-patterns.rc # FiteNite # # Last reported spam: 4/28/05 # Data files last updated: 4/28/05 # # Other Relevant Info: # # TESTNAME='FiteNite' TESTPATTERNS=${SBDIR}/black/fitenite-patterns.rc TESTSCORE=${SPAMLEVEL} TESTLAST=20050428 TESTUPDATED=20050428 INCLUDERC=${SBDIR}/functions/identify-spammer-patterns.rc # Hare Krishna Proselytizing spammer # # Last reported spam: 8/10/05 # Data files last updated: 12/01/04 # # Other Relevant Info: # # 2/09/04: # The "Say Gouranga, and be happy" stuff spammed all over # creation. :/ # # Status: Active Spammer # TESTNAME='Hare Krishna' TESTPATTERNS=${SBDIR}/black/harekrishna-patterns.rc TESTSCORE=${SPAMLEVEL} TESTLAST=20050810 TESTUPDATED=20041204 INCLUDERC=${SBDIR}/functions/identify-spammer-patterns.rc # MassivePayouts # # Last reported spam: 11/03/05 # Data files last updated: 8/07/05 # # Other Relevant Info: # # 8/07/05: # Extremely aggressive MMF spammer. # # Status: Active Spammer # TESTNAME='MassivePayouts' TESTPATTERNS=${SBDIR}/black/massivepayouts-patterns.rc TESTSCORE=${SPAMLEVEL} TESTLAST=20051103 TESTUPDATED=20050807 INCLUDERC=${SBDIR}/functions/identify-spammer-patterns.rc # Rehman, S.A. (Peace and Reconciliation) # # Last reported spam: 11/05/05 # Data files last updated: 11/07/05 # # Other Relevant Info: # # 3/21/05: # Another ideological spammer, this one for "peace and # reconciliation", seems to intend to target Muslims, # but I'm getting complaints from Hindus who are being # spammed by the idiot too. # # Status: Active Spammer # TESTNAME='S. A. Rehman' TESTPATTERNS=${SBDIR}/black/sarehman-patterns.rc TESTSCORE=${SPAMLEVEL} TESTLAST=20051107 TESTUPDATED=20051107 INCLUDERC=${SBDIR}/functions/identify-spammer-patterns.rc # "Search Engine Optimization" Spammer # # Last reported spam: 9/25/05 # Data files last updated: 9/25/05 # # Other Relevant Info: # # 9/25/05: # Spammer abusing Gmail who offers "search engine # optimization" service. :/ # # Status: Active Spammer # TESTNAME='Search Engine Optimization' TESTPATTERNS=${SBDIR}/black/searchengineoptimization-patterns.rc TESTSCORE=${SPAMLEVEL} TESTLAST=20050925 TESTUPDATED=20050925 INCLUDERC=${SBDIR}/functions/identify-spammer-patterns.rc