A large part of running a web hosting business, which I did for nearly two decades, is protecting customers from scammers, spammers, and hackers. This was a constantly escalating battle, and now with the addition of a whole new class of aggressive AI scrapers, one of the main reasons why I got out of the business. Waging low-level warfare for two decades was enough. Time to rest.
For a flexible definition of “rest”.
The first thing I found myself doing, unencumbered by the risk of messing up customer sites, was to build a “web application firewall”. This application looks at incoming requests and applies a set of rules to determine if the query is coming from a “bad actor” or not. If it is, it takes an action ranging from delivering an error to blocking the source address in the network firewall. The rule set I have for this is just as aggressive as the AI scrapers, and this results in some behaviours that would be unacceptable to my former clients (for example, all of Meta/Facebook is blocked from accessing my sites).
One of the things I learned how to do was write rules for Spamassassin, the widely installed open source application that protects millions of users from the worst spammers. Like any defensive measure, attackers work to find ways to defeat these tools, which is why many spams contain big blocks of unrelated text at the bottom in a small font. That’s an attempt to game a Bayes filter by making the spam trigger words less prevalent.
SA rules are a little tricky to write, but with some practice, I learned to write custom rules that flagged common phishing attempts, big blocks of text in a small font, and more. None of these alone are enough to flag a message as spam, but they’re reliable indicators. cPanel allows each user to write their own mail filters, using a much more simplified set of criteria. So I set my SA rules to not score very high, then used the indicators to write cPanel filters. This gave users the power of SA without the complexity and was very effective.
But now I don’t have to worry about killing a customer’s email with a false positive. I can write rules that say if a message comes from a domain like example.ru.com and contains one of several keywords in Portuguese, it’s going straight to write-only memory. A rule like that is currently killing 20-30 spams per day.
This morning I got one of a relatively new class of spam, the AI-generated “I love your Instagram account” praising my content on IG in a way that sounds human but isn’t quite right at the same time. It’s kind of amusing to see an algorithm take a wild guess at what my accounts are about. (BTW the accounts are @alanlangford, @in3dca, and @silohouse.ca).
Time to kill that crap. Now the domain that “Maya” sent the email from, the domain linked in the email body, and an intermediate domain that the message was routed to each trigger new SA “Instagram shill” rules that let me trash the message. I took the opportunity to pull some similar rules from my cPanel filters and bring them into SA, which should make the whole process a little more efficient.
Bye bye Maya!
Recent Comments