{"id":220,"date":"2009-04-20T18:54:43","date_gmt":"2009-04-20T10:54:43","guid":{"rendered":"http:\/\/www.computersolutions.cn\/blog\/?p=220"},"modified":"2009-04-20T18:54:43","modified_gmt":"2009-04-20T10:54:43","slug":"spam-from-livecom","status":"publish","type":"post","link":"https:\/\/www.computersolutions.cn\/blog\/2009\/04\/spam-from-livecom\/","title":{"rendered":"Spam from Live.com"},"content":{"rendered":"

We’re seeing a huge recurrence of spam thats been getting through our spam filters., all coming from @live.com addresses.
\nI hadn’t seen any personally until one of our clients brought up the fact that she was receiving 20-30 sex related spam a day, all coming from Random name @live.com addresses.<\/p>\n

A check of the logs showed that we’ve received at least 100,000 of these spam mails over the last month that have gotten through to our users.
\nThis is something I’d obviously like to remedy.\u00a0 Not receiving, processing, or storing that much spam free’s up the servers for other things.<\/p>\n

As the number of valid addresses using @live.com accounts appears to be minimal (I could only see a handful of legitimate users sending from that domain), I have taken the decision to block any email from the @live.com domain until Microsoft can resolve their spam issues.<\/p>\n

If you do have clients using @live.com addresses, you will be able to send email to them, but not receive from them.
\nWe apologize for the inconvenience, but unfortunately there is no other solution that easily mitigates the issue, other than completely blocking them.<\/p>\n

For a more technical explanation of whats happening, read below:
\n
\nThis is a header from a sample spam email from a live.com address.
\nAs you can see below, the header shows that it passes an SPF check – meaning that the sending email server was verified to be a microsoft one.
\nThat means that the sender also passes our greylist and SPF checks, as Hotmail is a valid sender (for most of the time!).<\/p>\n

Return-Path: <lourdesuxanbirr1980@live.com>
\nDelivered-To: XXXX
\nReceived: (qmail 3070 invoked from network); 20 Apr 2009 11:53:37 +0800
\nDomainKey-Status: no signature
\nReceived: from blu0-omc2-s16.blu0.hotmail.com (65.55.111.91)
\nby mail.computersolutions.cn with SMTP; 20 Apr 2009 11:53:37 +0800
\nReceived-SPF: pass (mail.computersolutions.cn: SPF record at spf-a.hotmail.com designates 65.55.111.91 as permitted sender)
\nReceived: from BLU128-W5 ([65.55.111.72]) by blu0-omc2-s16.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
\nSun, 19 Apr 2009 20:54:11 -0700
\nMessage-ID: <BLU128-W51B2E2DECCF46C5980E74DC760@phx.gbl>
\nReturn-Path: lourdesuxanbirr1980@live.com
\nX-Originating-IP: [201.150.66.6]
\nFrom: Lourdes Browne <Lourdesuxanbirr1980@live.com>
\nSender: <lourdesuxanbirr1980@live.com>
\nTo: XXXXX
\nSubject: Hi! This is Muriel. Young girls in action with animals.
\nDate: Mon, 20 Apr 2009 03:54:11 +0000
\nImportance: Normal
\nContent-Type: text\/plain; charset=”iso-8859-1″
\nContent-Transfer-Encoding: quoted-printable
\nMIME-Version: 1.0
\nX-OriginalArrivalTime: 20 Apr 2009 03:54:11.0766 (UTC) FILETIME=[AA2F5560:01C9C16B]<\/p><\/blockquote>\n

As the sender is a legitimate hotmail \/ live account “lourdesuxanbirr1980@live.com” (albeit a garbage generated name), its probable that the sender is generated from a script.<\/p>\n

A check on google reveals that the live.com captcha system has been cracked, and is being abused by botnets to send spam.<\/p>\n

http:\/\/arstechnica.com\/security\/news\/2008\/04\/gone-in-60-seconds-spambot-cracks-livehotmail-captcha.ars<\/a><\/p>\n

This probably explains the sudden flood of spam coming from @live.com addresses, although its a bit strange that we didn’t see this sooner!
\nHopefully they’ll resolve it soon, so we can unblock them.<\/p>\n","protected":false},"excerpt":{"rendered":"

We’re seeing a huge recurrence of spam thats been getting through our spam filters., all coming from @live.com addresses. I hadn’t seen any personally until one of our clients brought up the fact that she was receiving 20-30 sex related spam a day, all coming from Random name @live.com addresses. A check of the logs […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[73,48,25],"tags":[96,94,95,76],"class_list":["post-220","post","type-post","status-publish","format-standard","hentry","category-email","category-exploits","category-technical-mumbo-jumbo","tag-botnet","tag-live","tag-microsoft","tag-spam"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts\/220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/comments?post=220"}],"version-history":[{"count":1,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts\/220\/revisions"}],"predecessor-version":[{"id":221,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts\/220\/revisions\/221"}],"wp:attachment":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/media?parent=220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/categories?post=220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/tags?post=220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}