Thread: Linked spam

Linked spam

From
Bruce Momjian
Date:
I thought we had a filter to block linkedin spam.  Marc?

---------------------------------------------------------------------------

----- Forwarded message from Lucian Capdefier -----

LinkedIn
------------
  
I'd like to add you to my professional network on LinkedIn.

- Lucian Capdefier

Lucian Capdefier
Business Analytics and Optimization Service Line Leader at IBM Global Business Services 
Romania

Confirm that you know Lucian Capdefier
https://www.linkedin.com/e/-fsh06j-gcql2w64-19/isd/1554309907/uWsHY63D/


------
(c) 2010, LinkedIn Corporation----- End of forwarded message from Lucian Capdefier -----

--  Bruce Momjian  <bruce@momjian.us>        http://momjian.us EnterpriseDB
http://enterprisedb.com
 + It's impossible for everything to be true. +


Re: Linked spam

From
Tom Lane
Date:
Bruce Momjian <bruce@momjian.us> writes:
> I thought we had a filter to block linkedin spam.  Marc?

I asked for one a couple months ago, but it doesn't appear anything's
been done.
        regards, tom lane


Re: Linked spam

From
"Marc G. Fournier"
Date:
What would you like me to filter it based on?  Subject contains the word 
LinkedIn?

The problem is the From/To lines don't reference it, since they (at the 
least the ones I'd been looking at) come from the user inviting, not from 
linked in :(

Suggest a filter, I'll implement it ...

On Thu, 12 Aug 2010, Bruce Momjian wrote:

>
> I thought we had a filter to block linkedin spam.  Marc?
>
> ---------------------------------------------------------------------------
>
> ----- Forwarded message from Lucian Capdefier -----
>
> LinkedIn
> ------------
>
>
> I'd like to add you to my professional network on LinkedIn.
>
> - Lucian Capdefier
>
> Lucian Capdefier
> Business Analytics and Optimization Service Line Leader at IBM Global Business Services
> Romania
>
> Confirm that you know Lucian Capdefier
> https://www.linkedin.com/e/-fsh06j-gcql2w64-19/isd/1554309907/uWsHY63D/
>
>
>
> ------
> (c) 2010, LinkedIn Corporation----- End of forwarded message from Lucian Capdefier -----
>
> --
>  Bruce Momjian  <bruce@momjian.us>        http://momjian.us
>  EnterpriseDB                             http://enterprisedb.com
>
>  + It's impossible for everything to be true. +
>

----
Marc G. Fournier                        Hub.Org Hosting Solutions S.A.
scrappy@hub.org                                     http://www.hub.org

Yahoo:yscrappy    Skype: hub.org    ICQ:7615664    MSN:scrappy@hub.org


Re: Linked spam

From
Tom Lane
Date:
"Marc G. Fournier" <scrappy@hub.org> writes:
> What would you like me to filter it based on?  Subject contains the word 
> LinkedIn?

The variants I've seen areSubject: Invitation to connect on LinkedInSubject: <so and so> wants to stay in touch on
LinkedIn
If we could block those I think we'd be in good shape.  Occasionally
we get some non-English variants, likeSubject: [ADMIN] Convite para se conectar no LinkedIn
but there haven't been enough of those to justify a filter IMO.
        regards, tom lane


Re: Linked spam

From
Tom Lane
Date:
I wrote:
> The variants I've seen are
>     Subject: Invitation to connect on LinkedIn
>     Subject: <so and so> wants to stay in touch on LinkedIn

Actually, a bit of looking in my spam logs suggests that the best thing
would be to filter on headers that look like this:

X-LinkedIn-fbl: n-qcUUOoZC7xu6Osomtu7Puw6GhuWOdF6OrNGgqwO-6rdrXq5VwXwcd9i62mpE
X-LinkedIn-fbl: vq4Hn2B7IUfSDhzU_lQrCa-TZG-5pr8eMv_x1ajZoLQ5VeukFJ
X-LinkedIn-fbl: XWulUW6uONtHOdVFlLwD6W7gxeV-Ntn4W0rkYWXcSKh-cwWFBl

They seem to put that into all the variants...
        regards, tom lane


Re: Linked spam

From
Bruce Momjian
Date:
Marc G. Fournier wrote:
> 
> What would you like me to filter it based on?  Subject contains the word 
> LinkedIn?
> 
> The problem is the From/To lines don't reference it, since they (at the 
> least the ones I'd been looking at) come from the user inviting, not from 
> linked in :(
> 
> Suggest a filter, I'll implement it ...

Tom posted a pattern:

X-LinkedIn-fbl: n-qcUUOoZC7xu6Osomtu7Puw6GhuWOdF6OrNGgqwO-6rdrXq5VwXwcd9i62mpE
X-LinkedIn-fbl: vq4Hn2B7IUfSDhzU_lQrCa-TZG-5pr8eMv_x1ajZoLQ5VeukFJ
X-LinkedIn-fbl: XWulUW6uONtHOdVFlLwD6W7gxeV-Ntn4W0rkYWXcSKh-cwWFBl

--  Bruce Momjian  <bruce@momjian.us>        http://momjian.us EnterpriseDB
http://enterprisedb.com
 + It's impossible for everything to be true. +


Re: Linked spam

From
"Marc G. Fournier"
Date:
'k, should be in place now ... do you want messages with that header 
outright rejected, or to go through a moderator?  Just curious as to 
whether or not there is any chance a legit email could come through with 
those  headers ... I can't think of any, but ... ?

On Thu, 12 Aug 2010, Tom Lane wrote:

> I wrote:
>> The variants I've seen are
>>     Subject: Invitation to connect on LinkedIn
>>     Subject: <so and so> wants to stay in touch on LinkedIn
>
> Actually, a bit of looking in my spam logs suggests that the best thing
> would be to filter on headers that look like this:
>
> X-LinkedIn-fbl: n-qcUUOoZC7xu6Osomtu7Puw6GhuWOdF6OrNGgqwO-6rdrXq5VwXwcd9i62mpE
> X-LinkedIn-fbl: vq4Hn2B7IUfSDhzU_lQrCa-TZG-5pr8eMv_x1ajZoLQ5VeukFJ
> X-LinkedIn-fbl: XWulUW6uONtHOdVFlLwD6W7gxeV-Ntn4W0rkYWXcSKh-cwWFBl
>
> They seem to put that into all the variants...
>
>             regards, tom lane
>

----
Marc G. Fournier                        Hub.Org Hosting Solutions S.A.
scrappy@hub.org                                     http://www.hub.org

Yahoo:yscrappy    Skype: hub.org    ICQ:7615664    MSN:scrappy@hub.org


Re: Linked spam

From
"Marc G. Fournier"
Date:
Yup, he CC'd me with those, but thanks for adding to list noise ...

On Thu, 12 Aug 2010, Bruce Momjian wrote:

> Marc G. Fournier wrote:
>>
>> What would you like me to filter it based on?  Subject contains the word
>> LinkedIn?
>>
>> The problem is the From/To lines don't reference it, since they (at the
>> least the ones I'd been looking at) come from the user inviting, not from
>> linked in :(
>>
>> Suggest a filter, I'll implement it ...
>
> Tom posted a pattern:
>
> X-LinkedIn-fbl: n-qcUUOoZC7xu6Osomtu7Puw6GhuWOdF6OrNGgqwO-6rdrXq5VwXwcd9i62mpE
> X-LinkedIn-fbl: vq4Hn2B7IUfSDhzU_lQrCa-TZG-5pr8eMv_x1ajZoLQ5VeukFJ
> X-LinkedIn-fbl: XWulUW6uONtHOdVFlLwD6W7gxeV-Ntn4W0rkYWXcSKh-cwWFBl
>
> --
>  Bruce Momjian  <bruce@momjian.us>        http://momjian.us
>  EnterpriseDB                             http://enterprisedb.com
>
>  + It's impossible for everything to be true. +
>

----
Marc G. Fournier                        Hub.Org Hosting Solutions S.A.
scrappy@hub.org                                     http://www.hub.org

Yahoo:yscrappy    Skype: hub.org    ICQ:7615664    MSN:scrappy@hub.org


Re: Linked spam

From
Tom Lane
Date:
"Marc G. Fournier" <scrappy@hub.org> writes:
> 'k, should be in place now ... do you want messages with that header 
> outright rejected, or to go through a moderator?  Just curious as to 
> whether or not there is any chance a legit email could come through with 
> those  headers ... I can't think of any, but ... ?

I can't think of any situation where X-LinkedIn-fbl: would appear in
ordinary email, but who knows.
        regards, tom lane


Re: Linked spam

From
Bruce Momjian
Date:
Marc G. Fournier wrote:
> 
> Yup, he CC'd me with those, but thanks for adding to list noise ...

Well, we have asked for this several times, and if you had trouble last
time getting a pattern, you should have told us rather than just
ignoring the request.  

In this case, you have not indicated you saw Tom's pattern (until now),
and you still have not told us if you have added the filter.

---------------------------------------------------------------------------


> 
> On Thu, 12 Aug 2010, Bruce Momjian wrote:
> 
> > Marc G. Fournier wrote:
> >>
> >> What would you like me to filter it based on?  Subject contains the word
> >> LinkedIn?
> >>
> >> The problem is the From/To lines don't reference it, since they (at the
> >> least the ones I'd been looking at) come from the user inviting, not from
> >> linked in :(
> >>
> >> Suggest a filter, I'll implement it ...
> >
> > Tom posted a pattern:
> >
> > X-LinkedIn-fbl: n-qcUUOoZC7xu6Osomtu7Puw6GhuWOdF6OrNGgqwO-6rdrXq5VwXwcd9i62mpE
> > X-LinkedIn-fbl: vq4Hn2B7IUfSDhzU_lQrCa-TZG-5pr8eMv_x1ajZoLQ5VeukFJ
> > X-LinkedIn-fbl: XWulUW6uONtHOdVFlLwD6W7gxeV-Ntn4W0rkYWXcSKh-cwWFBl
> >
> > --
> >  Bruce Momjian  <bruce@momjian.us>        http://momjian.us
> >  EnterpriseDB                             http://enterprisedb.com
> >
> >  + It's impossible for everything to be true. +
> >
> 
> ----
> Marc G. Fournier                        Hub.Org Hosting Solutions S.A.
> scrappy@hub.org                                     http://www.hub.org
> 
> Yahoo:yscrappy    Skype: hub.org    ICQ:7615664    MSN:scrappy@hub.org

--  Bruce Momjian  <bruce@momjian.us>        http://momjian.us EnterpriseDB
http://enterprisedb.com
 + It's impossible for everything to be true. +


Re: Linked spam

From
"Marc G. Fournier"
Date:
'k, I'll leave it as consult *just in case* ... its not a huge flood of 
these as it is ...

On Thu, 12 Aug 2010, Tom Lane wrote:

> "Marc G. Fournier" <scrappy@hub.org> writes:
>> 'k, should be in place now ... do you want messages with that header
>> outright rejected, or to go through a moderator?  Just curious as to
>> whether or not there is any chance a legit email could come through with
>> those  headers ... I can't think of any, but ... ?
>
> I can't think of any situation where X-LinkedIn-fbl: would appear in
> ordinary email, but who knows.
>
>             regards, tom lane
>

----
Marc G. Fournier                        Hub.Org Hosting Solutions S.A.
scrappy@hub.org                                     http://www.hub.org

Yahoo:yscrappy    Skype: hub.org    ICQ:7615664    MSN:scrappy@hub.org


Re: Linked spam

From
Bruce Momjian
Date:
Marc G. Fournier wrote:
> 
> 'k, should be in place now ... do you want messages with that header 
> outright rejected, or to go through a moderator?  Just curious as to 
> whether or not there is any chance a legit email could come through with 
> those  headers ... I can't think of any, but ... ?

OK, I now see you have implemented it and we are good to go. Thanks.

--  Bruce Momjian  <bruce@momjian.us>        http://momjian.us EnterpriseDB
http://enterprisedb.com
 + It's impossible for everything to be true. +


Re: Linked spam

From
"Marc G. Fournier"
Date:
On Thu, 12 Aug 2010, Bruce Momjian wrote:

> Marc G. Fournier wrote:
>>
>> Yup, he CC'd me with those, but thanks for adding to list noise ...
>
> Well, we have asked for this several times, and if you had trouble last
> time getting a pattern, you should have told us rather than just
> ignoring the request.
>
> In this case, you have not indicated you saw Tom's pattern (until now),
> and you still have not told us if you have added the filter.

1. Tom sent it at 01:00 am ... I was long off line at that time
2. I sent an email about this *before* you sent this, and, in fact, there 
were two other emails gone back and forth between me and Tom prior to this 
email where I finish off confirming that I set it up as a consult (doesn't 
drop the message) ...

Follow up if I totally miss a thread, don't follow up when I'm actively 
participating in it ...

----
Marc G. Fournier                        Hub.Org Hosting Solutions S.A.
scrappy@hub.org                                     http://www.hub.org

Yahoo:yscrappy    Skype: hub.org    ICQ:7615664    MSN:scrappy@hub.org


Re: Linked spam

From
Bruce Momjian
Date:
Marc G. Fournier wrote:
> On Thu, 12 Aug 2010, Bruce Momjian wrote:
> 
> > Marc G. Fournier wrote:
> >>
> >> Yup, he CC'd me with those, but thanks for adding to list noise ...
> >
> > Well, we have asked for this several times, and if you had trouble last
> > time getting a pattern, you should have told us rather than just
> > ignoring the request.
> >
> > In this case, you have not indicated you saw Tom's pattern (until now),
> > and you still have not told us if you have added the filter.
> 
> 1. Tom sent it at 01:00 am ... I was long off line at that time
> 2. I sent an email about this *before* you sent this, and, in fact, there 
> were two other emails gone back and forth between me and Tom prior to this 
> email where I finish off confirming that I set it up as a consult (doesn't 
> drop the message) ...
> 
> Follow up if I totally miss a thread, don't follow up when I'm actively 
> participating in it ...

Yeah, I was confused with the thread ordering and missed your confirm.
Sorry.

--  Bruce Momjian  <bruce@momjian.us>        http://momjian.us EnterpriseDB
http://enterprisedb.com
 + It's impossible for everything to be true. +