MY TURN WITH ALEKSANDER
In 2021 Sean Connor posted about getting pestered with repeated
spam messages from various email addresses, always with the same
subject, name, and text in Russian:
gopher://gopher.conman.org/0Phlog:2021/07/20.2
He ended up simply deleting the email accounts that were receiving
the messages, but also later posted a less drastic solution
suggested by someone else for filtering them out with Postfix based
on the general form of the constantly changing email addresses that
Aleksandr (or Mayboroda) uses:
gopher://gopher.conman.org/0Phlog:2021/08/28.1
gopher://gopher.conman.org/0Phlog:2022/01/16.1
gopher://gopher.conman.org/0Phlog:2022/01/17.1
So starting sometime before early Febuary (when I last purged my
backup store of emails), I've been getting my own dose of
Aleksandr. It seems quite pointless to me, as it did for Connor,
because I don't read Russian. But except for a ten-day break in
Febuary I've been getting a few every day, from ever-changing
email accounts. Odds are that they got the email address from
scraping my website, as it's the main address for my online store.
I don't get that much other spam so I don't bother with automatic
spam filtering, but waiting for all these useless identical emails
to download on the days when my internet connection is scratchy,
just to bulk-select and delete them, eventually tipped me over the
line into doing something.
The solution that one of Connor's readers supplied was to configure
Postfix to block all emails with part of the sender's addresses
matching the regular expression "s[0-9]{1,2}.[a-z]*.ru" or
"info@.[a-z]*.ru". I'm also using Postfix, and running grep through
almost a decade of emails in my archive (not including deleted
emails such as spam) showed that I hadn't previously received any
legitimate email from addresses matching those expressions. Still,
they do seem like really broad filters, almost as if I might be
doing what the spammer wants if this is some politically-motivated
attack to ruin the reputation of all Russian email addresses.
Looking closer at the emails I noticed a couple of unusual headers:
X-Vjhy-Campaign-Uid: [random-looking altha-numeric string]
X-Vjhy-Subscriber-Uid: [random-looking altha-numeric string]
The string after "X-Vjhy-Campaign-Uid" keeps changing, but the
"X-Vjhy-Subscriber-Uid" value is always the same (in over 100
"Aleksandr" emails from lots of different addresses). At a guess
I'd say that this is probably something inserted by a bulk email
service or software that the spammer is using. I'm guessing that
"Vjhy" is something random that they typed in to fill in a
configuration field. Searching through my email history again,
nothing there had one of these headers or even anything like them,
so this seemed like a narrower way to block the spam.
My, possibly lazy, solution to this in the Postfix configuration
was to Create a "/etc/postfix/header_checks" file containing:
# Block "Aleksandr" spam which comes from various domains and IPs
# but always has this header which no other email seems to use:
/^X-Vjhy-Subscriber-Uid: .*/ DISCARD Aleksandr spam
EDIT: "Aleksandr" eventually changed the "Vjhy" bit of the headers
to something else, so, at slightly more risk of
false-positives, I'm now using:
/^X-.*-Subscriber-Uid: .*/ DISCARD Aleksandr spam
This probably blocks everything from the bulk mail platform
that they're using though.
Then add this line in /etc/postfix/main.cf:
header_checks = regexp:/etc/postfix/header_checks
Now the Postfix documentation makes the point that this is the
wrong way to filter spam because new mail processing is delayed
while it checks all the header lines from each email through the
regular expression/s in "/etc/postfix/header_checks". Setting up
proper filters allows checking to be done further down the line in
a non-blocking way. Still in this case it's just one rule (well OK,
it always _starts_ with one) and I don't get nearly enough mail or
server load for this to be a meaningful problem. I also like that
it gets rid of the spam right at the start of processing and
doesn't waste any more time on it, given that it's often been the
bulk of my day's external email to that (or any) address.
Interestingly they still show spam filtering rules in the example
at the end of the regexp_table(5) man page.
Also "pcre" instead of "regexp" is supposed to be faster, but
"postconf -m" didn't list it as available in my Postfix build. Run
"postfix reload" to make it load the new configuration.
Before long the Postfix log showed a number of correct matches for
"Aleksandr spam", and after a couple of days none has made it
through, so it looks like I might have won my personal battle
against Aleksandr.
I also turned up yet another victim of Aleksandr online (I seem to
be late to Aleksandr's party), who blocked the spam simply based on
the curiously-unchanging subject line (the postmap step isn't
necessary, and as already noted you can use regexp if pcre isn't
available):
https://iliasa.eu/postfix-discard-mail-based-on-header/
Related Postfix documentation links:
http://www.postfix.org/BUILTIN_FILTER_README.html
http://www.postfix.org/cleanup.8.html
http://www.postfix.org/header_checks.5.html
http://www.postfix.org/regexp_table.5.html - Examples at bottom
http://www.postfix.org/SMTPD_ACCESS_README.html
- The Free Thinker.
