[SAtalk] Abused redirector URLs ?

[Chr. von Stuckrad]

Hi

I just got a spam message which fakes two links 'into yahoo.com'
by using an unrestricted redirector on a yahoo webserver.
I think I have seen those a while ago.

Did somebody create/collect 'uri-rules' for known redirectors
which can be abused this way?

I created the following rule for them

# Special abused yahoo-redirector
uri YAHOO_REDIR         /srd.yahoo.com\/drst\/illuminating\/\*http:/
score YAHOO_REDIR       2
describe YAHOO_REDIR    contains url of an abused unrestricted redirector

The mail also contained a broken variant of the wrong/forgotten
Parameter of their Spam-Mailer:  ' $RANDOM IZE '

So:

body RANDOM_IZE         / \$RANDOM IZE /
score RANDOM_IZE        2
describe RANDOM_IZE     contains broken spamrobot parameter

Stucki  (postmaster of math/inf/mi.fu-berlin.de)

PS.:  Spam Mail attached ...

--- Begin Message --- achieve householder icosahedra corrugate bourgeoisie poets bender create postfix hustling bacchus imaginatively talking courses cranking matters hostelry bowel excommunicated polytope acclaim cries microscope abyssinia metronome scooping adjustors ternary scraps bobbins $RANDO MIZE counsellors adject cribs miller braking medial plugs bothered ethically pounding bombard poetical braided mealtime hurdle pneumococcus tearfully branches avis exams saws expositor bakhtiari memorandum merchandising tank scholastic creature excretions menhaden $RANDOM IZE brazenness meddle thallium hotelman playgrounds evens excise houseflies sears crate expunged huts scarcity popped boners expositions methylene plumage meandered possessor advice

schemas coverlets saxophone crosshatch coursing addictions branches pluperfect at&t bodhisattva craftsman brainwashes teacher hue meretricious horrible meticulous at&t tassel cowpoke adumbrates saturater port extemporaneous teletypewrite bodybuilder bangor pleading boaster crosswort $RANDOM IZE hydraulic andrea plugs bosom berlin acorn hygiene practitioner excited brambly postulated excise critique plied corridors ac cottonwood adores scrolls evince bombarding teletype sardonic savers meekness bamako potatoes sates telling admiralty $RANDOMI ZE adjustment poison excitement acculturated evenings migrated hygiene imagined additives hurrah cousins schedulers australia crossroad bahama sclerosis accoutrements banks advanced bluegrass bodhisattva
--- End Message ---