I am trying to block variants of ceertain gmail addresses but I'm having trouble concocting the right rexexp to accomplish the task.
Gmail addresses can contain embedded periods and can be followed by a '+' and an arbitrary suffix. So all the following are the same address: * joebloe@gmail.com * joe.blow@gmail.com * j.o.e.blow@gmail.com * joe.blow+abcd@gmail.com
And so on. I've tried various regexps, but none have worked so far.
1. Could someone show me the right syntax to catch all embedded
dots in the part before the '+'?
2. Is there a way to script removing all my experimentation from
the ban lists on multiple mailing lists? Things are looking
pretty cluttered by now on the privacy admin pages.
Thanks very much in advance.
Matthew Saltzman Clemson University Math Sciences mjs AT clemson DOT edu
On 9/24/15 1:47 PM, Matthew Saltzman wrote:
1. Could someone show me the right syntax to catch all embedded dots in the part before the '+'?
^.*..*+.*@
for any domain or
^.*..*+.*@gmail.com$
for only gmail.com.
2. Is there a way to script removing all my experimentation from the ban lists on multiple mailing lists? Things are looking pretty cluttered by now on the privacy admin pages.
See the withlist script at https://www.msapiro.net/scripts/add_banned.py. In that script, replace the line
mlist.ban_list.append(address)
with
mlist.ban_list = []
For that script, you would still need to supply an 'address_to_ban' argument even though it's ignored. You could make an even simpler withlist script along the lines of
def init_ban_list(mlist): if not mlist.Locked(): mlist.Lock() mlist.ban_list = [] mlist.Save() mlist.Unlock()
On 9/24/15 1:47 PM, Matthew Saltzman wrote:
I am trying to block variants of ceertain gmail addresses but I'm having trouble concocting the right rexexp to accomplish the task.
Gmail addresses can contain embedded periods and can be followed by a '+' and an arbitrary suffix. So all the following are the same address: * joebloe at gmail.com * joe.blow at gmail.com * j.o.e.blow at gmail.com * joe.blow+abcd at gmail.com
In my prior reply https://mail.python.org/pipermail/mailman-users/2015-September/079856.html, I focused on your literal question and answered accordingly, but it occurs to me that you are trying to deal with bot generated subscriptions of addresses of the form word.word+digits@gmail.com. While this pattern is the most common one I've seen, not all addresses are like that. They are in different domains and while all gmail addresses may have dots, not all addresses do and a rare few have had non-digits after the +, but all I've seen have at least 5 digits following a + and immediately preceding the @.
For the lists @python.org, we are now using
^.*+.*\d{3,}@
For the history, see https://mail.python.org/pipermail/mailman-users/2015-August/079668.html, https://mail.python.org/pipermail/mailman-users/2015-September/079829.html and https://mail.python.org/pipermail/mailman-users/2015-September/079844.html and other posts in those threads.
On Thu, 2015-09-24 at 20:57 -0500, Mark Sapiro wrote:
On 9/24/15 1:47 PM, Matthew Saltzman wrote:
I am trying to block variants of certain gmail addresses but I'm having trouble concocting the right rexexp to accomplish the task.
Gmail addresses can contain embedded periods and can be followed by a '+' and an arbitrary suffix. So all the following are the same address: * joebloe at gmail.com * joe.blow at gmail.com * j.o.e.blow at gmail.com * joe.blow+abcd at gmail.com
In my prior reply https://mail.python.org/pipermail/mailman-users/2015-September/07985 6.html, I focused on your literal question and answered accordingly, but it occurs to me that you are trying to deal with bot generated subscriptions of addresses of the form word.word+digits@gmail.com. While this pattern is the most common one I've seen, not all addresses are like that. They are in different domains and while all gmail addresses may have dots, not all addresses do and a rare few have had non -digits after the +, but all I've seen have at least 5 digits following a + and immediately preceding the @.
For the lists @python.org, we are now using
^.*+.*\d{3,}@
For the history, see https://mail.python.org/pipermail/mailman-users/2015-August/079668.h tml, https://mail.python.org/pipermail/mailman-users/2015-September/07982 9.html and https://mail.python.org/pipermail/mailman-users/2015-September/07984 4.html and other posts in those threads.
Looking back over this thread, I picked up on this. It is a bit more aggressive than I was looking for, but probably works with high probability.
When I encountered the original issue, I had enough evidence to find the exact set of addresses that were causing the problem on my server. After I banned those, the same addresses started showing up with embedded periods.
FIY, the ones I found were:
- ^nkymtky+.*@gmail.com
- ^kihuwzl+.*@gmail.com
- ^kihuotter+.*@gmail.com
- ^hulexchan+.*@gmail.com
- ^ewnetwork+.*@gmail.com
- ^damofah+.*@gmail.com
- ^bustysarahrae+.*@gmail.com
- ^vujovich+.*@usc.edu
- ^yesboobsofficial+.*@gmail.com
- ^yowesephth+.*@gmail.com
- ^ewnetwork2+.*@gmail.com
- ^nwplayer123+.*@gmail.com
So I guessed that if I could just block those (with embedded periods), I'd have the issue covered. Have others seen other addresses?
BTW, the part after the '+' in all cases I've seen have been only digits. That might be a better way to go than any three or more characters if one wanted to be as precise as possible.
Thanks for your help.
On 09/28/2015 12:04 PM, Matthew Saltzman wrote:
FIY, the ones I found were:
- ^nkymtky+.*@gmail.com
- ^kihuwzl+.*@gmail.com
- ^kihuotter+.*@gmail.com
- ^hulexchan+.*@gmail.com
- ^ewnetwork+.*@gmail.com
- ^damofah+.*@gmail.com
- ^bustysarahrae+.*@gmail.com
- ^vujovich+.*@usc.edu
- ^yesboobsofficial+.*@gmail.com
- ^yowesephth+.*@gmail.com
- ^ewnetwork2+.*@gmail.com
- ^nwplayer123+.*@gmail.com
So I guessed that if I could just block those (with embedded periods), I'd have the issue covered. Have others seen other addresses?
These
bustys.arahrae+digits@gmail.com dam.ofah+digits@gmail.com ewne.twork2+digits@gmail.com ewnet.work+digits@gmail.com hul.exchan+digits@gmail.com kihuo.tter+digits@gmail.com kih.uwzl+digits@gmail.com nky.mtky+digits@gmail.com nw.player123+digits@gmail.com vujovich+digits@usc.edu yesboo.bsofficial+digits@gmail.com yowesep.hth+digits@gmail.com
are just the ones seen at mail.python.org on Sept 28, CEST. I have seen lots of others and other domains. The initial ones a few weeks ago had only 5 digits, but lately, they all have more.
As noted in the post at https://mail.python.org/pipermail/mailman-users/2015-August/079668.html, I checked and there was only one member of one list out of all the python.org list subscribers that had a local part ending with '+' and digits and it only had one digit between the '+' and '@'.
There are a few that match the '+' followed by anything followed by at least 3 digits followed by @ RE, so this RE
^.*+\d(3,}@
which requires 3 or more digits and only digits between + and @ is safer, and
^.*+\d(5,}@
is safer still and I think would get all the ones I'm currently seeing.
Mark Sapiro wrote:
These
bustys.arahrae+digits at gmail.com dam.ofah+digits at gmail.com ewne.twork2+digits at gmail.com ewnet.work+digits at gmail.com hul.exchan+digits at gmail.com kihuo.tter+digits at gmail.com kih.uwzl+digits at gmail.com nky.mtky+digits at gmail.com nw.player123+digits at gmail.com vujovich+digits at usc.edu yesboo.bsofficial+digits at gmail.com yowesep.hth+digits at gmail.com
are just the ones seen at mail.python.org on Sept 28, CEST.
I went back further in the logs and have seen the following:
admins+<digits>@inkedfur.com bustys.arahrae+<digits>@gmail.com bustysarahrae+<digits>@gmail.com dam.ofah+<digits>@gmail.com damofah+<digits>@gmail.com ewne.twork2+<digits>@gmail.com ewnetwork2+<digits>@gmail.com ewnet.work+<digits>@gmail.com ewnetwork+<digits>@gmail.com hul.exchan+<digits>@gmail.com hulexchan+<digits>@gmail.com kamilla+<digits>@inkedfur.com kihuo.tter+<digits>@gmail.com kihuotter+<digits>@gmail.com kih.uwzl+<digits>@gmail.com kihuwzl+<digits>@gmail.com knuckles9048+<digits>@gmail.com kory+<digits>@korybing.com legal+<digits>@thehiveworks.com nky.mtky+<digits>@gmail.com nkymtky+<digits>@gmail.com nw.player123+<digits>@gmail.com nwplayer123+<digits>@gmail.com poisonedala+<digits>@gmail.com shelbyshuff+<digits>@aol.com shelbyshuff+<digits>@gmail.com skitty+<digits>@outlook.com swizzlecomms+<digits>@gmail.com vujovich+<digits>@usc.edu yesboo.bsofficial+<digits>@gmail.com yesboobsofficial+<digits>@gmail.com yowesep.hth+<digits>@gmail.com yowesephth+<digits>@gmail.com zetaharu.contact+<digits>@gmail.com
I thought I had seen one, possibly in the inkedfur.com domain, which had some non-digits between the + and the digits, but I don't see it in the logs.
On 09/28/2015 08:07 PM, Mark Sapiro wrote:
I thought I had seen one, possibly in the inkedfur.com domain, which had some non-digits between the + and the digits, but I don't see it in the logs.
OK, Here's what I now believe is the complete list we've seen at mail.python.org.
admins+<digits>@inkedfur.com bustys.arahrae+<digits>@gmail.com bustysarahrae+<digits>@gmail.com cosith545+add-furrets-on-skype-<digits>@gmail.com cosith545+<digits>@gmail.com dam.ofah+<digits>@gmail.com damofah+<digits>@gmail.com dongus3009+<digits>@gmail.com ewne.twork2+<digits>@gmail.com ewnetwork2+<digits>@gmail.com ewnet.work+<digits>@gmail.com ewnetwork+<digits>@gmail.com hre257.103+add-furrets-on-skype-<digits>@gmail.com hre257.103+<digits>@gmail.com hul.exchan+<digits>@gmail.com hulexchan+<digits>@gmail.com kamilla+<digits>@inkedfur.com kemo.mart+<digits>@gmail.com kemo.mart+<digits>@gmail.com; kihuo.tter+<digits>@gmail.com kihuotter+<digits>@gmail.com kih.uwzl+<digits>@gmail.com kihuwzl+<digits>@gmail.com knuckles9048+<digits>@gmail.com kory+<digits>@korybing.com legal+<digits>@thehiveworks.com lincoramon+<digits>@gmail.com melthehybrid+<digits>@gmail.com menominun+add-furrets-on-skype-<digits>@gmail.com menominun+<digits>@gmail.com mithrilarts+<digits>@gmail.com nankasiroino+add-furrets-on-skype-<digits>@gmail.com nankasiroino+<digits>@gmail.com nkymtky+add-furrets-on-skype-<digits>@gmail.com nky.mtky+<digits>@gmail.com nkymtky+<digits>@gmail.com norphedore+add-furrets-on-skype-<digits>@gmail.com norphedore+<digits>@gmail.com nw.player123+<digits>@gmail.com nwplayer123+<digits>@gmail.com poisonedala+<digits>@gmail.com purple.kecleon+<digits>@gmail.com rara_10_25+add-furrets-on-skype-<digits>@hotmail.com rara_10_25+<digits>@hotmail.com sample<digits>@email.tst shelbyshuff+<digits>@aol.com shelbyshuff+<digits>@gmail.com skitty+<digits>@outlook.com supersatanson+<digits>@gmail.com swizzlecomms+<digits>@gmail.com techtonik<digits>@gmail.com tygurstar+<digits>@gmail.com vujovich+<digits>@usc.edu yatton7+add-furrets-on-skype-<digits>@gmail.com yatton7+<digits>@gmail.com yesboo.bsofficial+<digits>@gmail.com yesboobsofficial+<digits>@gmail.com yowesep.hth+<digits>@gmail.com yowesephth+<digits>@gmail.com zetaharu.contact+<digits>@gmail.com
The list I posted at https://mail.python.org/pipermail/mailman-users/2015-September/079877.html is those for the month of September to date. The above list includes August too. I think in all cases, <digits> is a string of at leaser 5 digits.
-
Mark Sapiro -
Matthew Saltzman