[arin-discuss] The joy of SWIPping

Tue May 13 10:06:09 EDT 2008

> BTW, to the guys with this verification messages. Could you turn those  
> things off.  You are on a mailing list.  It's a bit annoying.

every time i get another verification message i scan it for a unique
signature that will identify all instances of that software so that i
can reject all future verification messages.  here's the current list,
in postfix pattern file format.  any remote postmaster who runs this
kind of software deserves all the rejection messages we can send them.

(if anybody has any suggested additions, please e-mail them to me!)

/^Subject:.*ALERTE \- Vous avez envoye un mail avec virus/	REJECT avhead
/^Subject:.*ALERTE\: un virus a /				REJECT avhead
/^Subject:.*ALERT\! Virus found in your mail/			REJECT avhead
/^Subject:.*Anti-Virus Notification/				REJECT avhead
/^Subject:.*Antigen found VIRUS/				REJECT avhead
/^Subject:.*Antigen Notification/				REJECT avhead
/^Subject:.*AntiVir ALERT/					REJECT avhead
/^Subject:.*Antivirus stopped your message/			REJECT avhead
/^Subject:.*Antivirus found VIRUS/				REJECT avhead
/^Subject:.*Anti\-Virus Notification/				REJECT avhead
/^Subject:.*BANNED FILENAME/ 					REJECT avhead
/^Subject:.*BitDefender found an infected object/		REJECT avhead
/^Subject:.*Content violation/					REJECT avhead
/^Subject:.*Disallowed attachment type found/			REJECT avhead
/^Subject:.*Email Quarantined Due to Virus/			REJECT avhead
/^Subject:.*Failed to clean virus file/				REJECT avhead
/^Subject:.*File blocked - ScanMail for Lotus/			REJECT avhead
/^Subject:.*Inflex scan report \[\d+\]/				REJECT avhead
/^Subject:.*InterScan NT Alert/					REJECT avhead
/^Subject:.*MailMarshal has detected a Virus in your message/	REJECT avhead
/^Subject:.*MailSure Virus Alert/				REJECT avhead
/^Subject:.*Mail Warning \(Attachment Removal\)/		REJECT avhead
/^Subject:.*message .* contains a virus/			REJECT avhead
/^Subject:.*Message deleted/					REJECT avhead
/^Subject:.*MMS Notification/					REJECT avhead
/^Subject:.*MxShield Virus Notification/			REJECT avhead
/^Subject:.*NAV detected a virus/				REJECT avhead
/^Subject:.*Network Associates Webshield.*Content Alert/	REJECT avhead
/^Subject:.*Norton Anti.* detected/				REJECT avhead
/^Subject:.*Ochrona antywirusowa/				REJECT avhead
/^Subject:.*problem found in sent message/			REJECT avhead
/^Subject:.*RAV Anti[Vv]irus/					REJECT avhead
/^Subject:.*RECIPIENT \! Virus Notify \!/			REJECT avhead
/^Subject:.*Report to Sender/					REJECT avhead
/^Subject:.*Returned due to virus\; was\:/			REJECT avhead
/^Subject:.*SAV detected a violation in a /			REJECT avhead
/^Subject:.*ScanMail Message\: To Sender\, virus found /	REJECT avhead
/^Subject:.*SENDER \! Virus Notify \!/				REJECT avhead
/^Subject:.*Suspected SPAM message.* from your domain/		REJECT avhead
/^Subject:.*Suspect Email \(SpamGuardian\)/			REJECT avhead
/^Subject:.*Symantec (AntiVirus|AVF|Mail Security)/		REJECT avhead
/^Subject:.*This message contains unsolicited data/		REJECT avhead
/^Subject:.*Virenchecker Information/				REJECT avhead
/^Subject:.*VIRUS .* IN MAIL FROM YOU/				REJECT avhead
/^Subject:.*VIRUS .*IN YOUR MAIL/				REJECT avhead
/^Subject:.*Virus Alert/					REJECT avhead
/^Subject:.*Virus Check Alert/					REJECT avhead
/^Subject:.*Virus Detected by Network Assoc/			REJECT avhead
/^Subject:.*Virus discarded/					REJECT avhead
/^Subject:.*Virus found in /					REJECT avhead
/^Subject:.*virus found in sent message/			REJECT avhead
/^Subject:.*Virus in Ihrer Nachricht/				REJECT avhead
/^Subject:.*VIRUS in your message/				REJECT avhead
/^Subject:.*Virus intercepted/					REJECT avhead
/^Subject:.*Virus in\:/						REJECT avhead
/^Subject:.*VIRUS .*NO SEU EMAIL/				REJECT avhead
/^Subject:.*Virus Notification from Redstone/			REJECT avhead
/^Subject:.*Virus Notification\:/				REJECT avhead
/^Subject:.*Virus Quarantine Notification/			REJECT avhead
/^Subject:.*virus trouve dans le message envoye/		REJECT avhead
/^Subject:.*virus trovato in un messaggio inviato /		REJECT avhead
/^Subject:.*Virus Warning/					REJECT avhead
/^Subject:.*Votre message contient un virus/			REJECT avhead
/^Subject:.*Warning \- Virus Detected\:/			REJECT avhead
/^Subject:.*Warning\: antivirus system report/			REJECT avhead
/^Subject:.*Warning\: E-mail viruses detected/			REJECT avhead
/^Subject:.*Warning\: .* \- user unknown/			REJECT avhead
/^Subject:.*WARNING\: YOU MAY HAVE A VIRUS/			REJECT avhead
/^Subject:.*WorldSecure Server notification/			REJECT avhead
/^Subject:.*\[SmartFilter\] Virus Alert /			REJECT avhead
/^Subject:.*\[Virus detected\]/					REJECT avhead
/^Subject:.*\{VIRUS\?\}/					REJECT avhead
/^From:.*Symantec_AntiVirus_for_SMTP_Gateways\@/		REJECT avhead
/^Subject:.*VIRUS POSLAN SA VASE ADRES/				REJECT avhead
/^Subject:.*Unsolicited commercial email rejected/		REJECT avhead
/^Subject:.*ALERT\: Message from [a-z0-9]+ was cleaned/		REJECT avhead
/^Subject:.*Your message was discarded/				REJECT avhead
/^Subject:.*Message you sent blocked by our bulk email filter/	REJECT avhead
/^Subject:.*Message sent from [a-z0-9\@\.]+ To [a-z0-9\@\.]+ was blocked/ REJECT avhead
/^Subject:.*NetSource SPAMinator RE\:/				REJECT avhead
/^Subject:.*Please confirm your message/			REJECT avhead
/^Subject:.*Virus Scan service detected a virus in a message you sent/ REJECT avhead
/^Subject:.*ALERT \- Virus .* found\; an attachment/		REJECT avhead
/^Subject:.*(ConfirmSystem|Spamwall Confirmation)/		REJECT avhead
/^Subject:.*Quarantine Attachments/				REJECT avhead
/^Subject:.*Your message was flagged as possible spam/		REJECT avhead
/^Subject:.*Automatic response to your mail/			REJECT avhead
/^Subject:.*Considered UNSOLICITED BULK EMAIL from you/		REJECT avhead

/^From:.*\b(NoReply\@spamrival\.com)\b/				REJECT chresp
/^From:.*\@mailsoap\.com\b/					REJECT chresp
/^From:.*\@ipermitmail\.com\b/					REJECT chresp
/^From:.*\bspamlion\@/						REJECT chresp
/^Subject:.*\[Qurb\s+\#\d+\]/					REJECT chresp
/^From:.*\bchallenge response\b/				REJECT chresp
/^From:.*ImagiNet Email Filter\b/				REJECT chresp

/^Hi\.\s+This is the Reflexion Total Control server at\s/	REJECT avbody
/^This is due to automatic rules that have determined/		REJECT avbody
/^Norton AntiVirus ha trovato un virus/				REJECT avbody
/^was blocked by our Spam Firewall. The email you sent/		REJECT avbody
/^Sorry Dangerous Attachment has been Removed/			REJECT avbody
/^WARNING: This e-mail has been altered by MIMEDefang/		REJECT avbody
/^Norton AntiVirus deleted the following email message/		REJECT avbody
/^Diagnostic\-Code\: 550 5\.7\.1 Virus detected by ClamAV/	REJECT avbody
/^This is a machine-generated message, please do not reply/	REJECT avbody
/^Las partes del mensaje que estaban infectadas no han sido/	REJECT avbody
/^Your email was not properly addressed/			REJECT avbody
/^This is an autoresponder. I'll never see your message./	REJECT avbody
/^Hello\. The spammer below is either using your resources/	REJECT avbody
/^has triggered our SPAM filters and has been rejected/		REJECT avbody
/^The following message was blocked because it contains/	REJECT avbody
/^You are receiving this message because you are not yet/	REJECT avbody
/^Notice of AUP\-violation from SpamShield/			REJECT avbody
/^in order for it to be read/					REJECT avbody
/^The following email message was blocked by MailMarshal/ 	REJECT avbody
/^http\:\/\/spamarrest\.com\/a2/				REJECT avbody
/^I apologize for this automatic reply to your email\./      	REJECT avbody
/^I\'m protecting myself from receiving junk mail\./ 		REJECT avbody
/^This e\-mail\, in its original form\, contained one or/	REJECT avbody
/^Sender\, Trend Micro Anti\-spam has detected a sensitive e\-mail\./ REJECT avbody
/^Your recent email was deemed to contain inappropriate/	REJECT avbody
/^You are not allowed to post to this mailing list/		REJECT avbody
/^Your message has been refused by our server/			REJECT avbody
/^To protect my mailbox from spam\, you need to/		REJECT avbody
/^I apologize for this small one-time inconvenience\, but I/	REJECT avbody
/^If you have sent a legitimate e-mail to one of our subscribers/ REJECT avbody
/^A sua mensagem foi marcada como SPAM pelo servidor de e-mail/ REJECT avbody
/^was considered unsolicited bulk e\-mail \(UBE\)/		REJECT avbody
/^An email sent to you was quarantined/				REJECT avbody
/^Your Message attached is being held in a queue, because/	REJECT avbody
/^The e\-mail that you sent has been quarantined until/		REJECT avbody
/^I will receive your original email but only if you will please/ REJECT avbody

/^http\:\/\/mail\.webdb\.com\/challenge\//			REJECT chresp
/^Your email was intercepted because it got a spam rating/	REJECT chresp
/^You will be added automatically and your original message/	REJECT chresp
/^In order for your message to be delivered to/			REJECT chresp
/^http\:\/\/www\.spamsnag\.com\/verify\/cmcom\//		REJECT chresp
/^To release your message for delivery\, please/		REJECT chresp
/^I\'m reducing the amount of junk mail I\'m receiving by using/ REJECT chresp
/^The message you sent requires that you verify that you/	REJECT chresp
/^This email account is protected by\:/				REJECT chresp
/^I use Spam Sleuth to screen all my e\-mail/			REJECT chresp
/^In an effort to eliminate time wasting SPAM/			REJECT chresp
/^You have received this e\-mail from SpamWall/			REJECT chresp
/^100\% spam-free email provided by Sendio/			REJECT chresp
/^To complete this verification\,/				REJECT chresp