Google Groups Spam
I thought Google Groups was defunct. But it appears it is still possible for people to use it to set up mailing lists. I have been receiving a certain amount of spam sent via this mechanism over the past couple of weeks: what seems to happen is that the spammer registers a random domain and sets Google to manage email for that domain, creates a list on Google Groups with an address on that domain, subscribes a bunch of victims to it, then sends out their junk mail with the from-address set to the list address. Several of those addresses have autoreply set (e.g. tech support addresses), so they in turn send those autoreplies to the list address, which adds to the spam. Thankfully, there don’t seem to be autoreplies to their autoreplies, so at least things don’t spiral completely out of control ... What I have found is that all these messages have a common characteristic, namely a “List-Unsubscribe” header line which contains an address like “<mailto:googlegroups-manage+«blah-blah»+unsubscribe@googlegroups.com>”. Checking a few other mailing lists I’m on (like this one), they have entirely different addresses in this field. So, following some instructions in the Postfix documentation, I have added a “header_checks” map to my MTA configuration, containing the rule /^List-Unsubscribe\:\s*.*\@googlegroups\.com REJECT I always feel a little nervous about these sorts of email-related changes, since it’s so easy to stuff something up and block receipt of all mail altogether. I’ll feel reassured by seeing this posting to the mailing list come back to me. ;)
I wrote:
I wrote:
/^List-Unsubscribe\:\s*.*\@googlegroups\.com REJECT
Of course that should have been
/^List-Unsubscribe\:\s*.*\@googlegroups\.com/ REJECT
(forgot the terminating “/”) ...
Well, I am pleased to report that 1) I am still receiving mail from this list, and 2) I got my first successful rejection of a spam message under the new rule: Apr 03 22:02:30 rimu.geek-central.gen.nz postfix/cleanup[356284]: D6BD8543C6: reject: header List-Unsubscribe: <mailto:googlegroups-manage+1000866739939+unsubscribe@googlegroups.com>,? <https://groups.google.com/a/shjy-kj.com/group/nh/subscribe> from mail-oa1-f71.google.com[209.85.160.71]; from=<nh+bncBD46DCPATMNRBNUAX3HAMGQEJZLDFDY@shjy-kj.com> to=<ldo@geek-central.gen.nz> proto=ESMTP helo=<mail-oa1-f71.google.com>: 5.7.1 message content rejected I’m ready to call it a success. ;) Oh, and hope your long weekend is going well ...
participants (1)
-
Lawrence D'Oliveiro