If you have experienced a sudden rise in spam reaching end-users recently and you are located in the USA, you might be affected by snowshoe spam. This article tells you how to configure your ORF to deal with this type of spam.

How do I tell if I am affected?

Open a recent log file in the ORF Log Viewer and sort the events by the Related IP column. Scroll through the sorted list of events and look for large, continuous network blocks (e.g. a /24) with spammy email subjects. If the sender email addresses for these look like FirstnameLastname@domain.tld, you are affected. Otherwise, the increase in spam may be due to a technical issue and you should contact our Customer Service to investigate.

Typical example of a snowshoe campaign in the ORF Log Viewer.

How do I stop this campaign?

As of writing this, the Greylisting Test of ORF can stop the campaign easily (when configured a certain way).

• Open the Blacklists / Greylisting page in the Administration Tool.
• Make sure the test is enabled (see “On” next to the page title).
• Disable the “Accept delivery retries from the same /24 subnet” option
• Disable the “Skip Greylisting if the sender explicitly passes the SPF Test” option

The recommended ORF configuration for the Greylisting Test against snowshoe spam

Greylisting is an aggressive measure that delays emails from unknown senders for 5-15 minutes. We are working on a less aggressive technology against this type of spam. Meanwhile, make sure you also have the Auto Sender Whitelist enabled and assigned to the Before Arrival or both filtering points.

Why do I have to configure ORF this way?

The campaign is run remarkably well compared to the average spam. Instead of using a network of compromised computers (botnets), the spammer abuses reputable hosting companies with a clean IP reputation for very short periods of time (2-4 hours) before it moving on the next provider. The usual heuristics, such as reverse DNS and SPF checks also check out.

We suspect that custom spamware is used for email delivery which Greylisting fends of well. However, as emails arrive from a continuous range of IPs and SPF is properly set up for the spamming domains, Greylisting defaults needs to be adjusted for this campaign.

UPDATE: The External Agent discussed in this article no longer works against the snowshoe spam campaign discussed below. Visit our latest article regarding this type of spam.

In the past few days, we have received reports of a snowshoe spam campaign hitting many of our US-based clients heavily. The campaign is characterized by a sudden influx of spam in high volumes from a continuous range of IP addresses. Outbreaks last for 2-4 hours before the spammer moves to another provider. Due to the nature of this campaign, the usual heuristics provided by ORF do very little to stop these emails.

We are now releasing a quick relief External Agent to address this campaign specifically. The agent relies on DNS-based heuristics to safely identify and blacklist these emails.

A typical example of the snowshoe campaign in the ORF logs.

Is it for me?

You only need this agent if you are affected. If you are located in the US and suddenly started to see spam coming through ORF in numbers, you can verify if you are affected by opening a recent log file in the ORF Log Viewer and sorting the events by the Related IP column. When you scroll through the sorted list of events, look for large, continuous network blocks (e.g. a /24) with spammy email subjects. If the sender email addresses look like FirstnameLastname@subdomain.domain.tld, you are affected and you should install this agent.

How do I install this?

Download the agent from

http://vamsoft.com/downloads/agents/agent-snowshow-c15q1-01/agent.zip (95kB ZIP)

and extract the archive contents to any local directory on your server.

If you have used Windows Explorer to extract the archive contents, the ARSoft.Tools.Net.dll file in the arsoft-resolver folder may be blocked by Windows as being potentially harmful for its Internet origin. To verify and unblock the DLL right-click on the file, select Properties and click Unblock on the General tab, if required.

Import the External Agent definition agent-definition.xml. Once this is done, customize the definition to your system:

• On the Run tab, set the Agent Executable to your powershell.exe binary. This is usually found under \Windows\System32\WindowsPowerShell\1.0\powershell.exe.
• On the same Run tab, in the Command-Line Parameters box, replace the path in the -File parameter with the path of your script, e.g. “C:\ORF\snowshoe\agent-showshoe-c15q1-01.ps1”.
• In the same edit box, replace “8.8.8.8” with your DNS server IP address. Note that you must specify the DNS server by IP address, names will not work.

Once you’re done with editing, be sure to save your configuration.

What else should I know?

• The agent is written in PowerShell and was tested with PowerShell 3.0 and .NET Framework 4.0. The minimum system requirement should be PowerShell 2.0 and .NET Framework 2.0.
• As this is a quick relief agent, it was not subjected to the stringent standards of testing we usually apply to our code. Use with caution.

We have recently come under a particularly persistent case of comment spam attack on the Vamsoft Community Forums. Like everybody on the Internet, our forums get spammed occasionally by spambots and humans alike, so in a way, this was an unremarkable event.

Erectile dysfunction drug sites advertised by our spammer

What was remarkable, though, is that our spammer has managed to defeat our JavaScript-based spambot detection, a variant of the industry-standard detection technique called a honeypot. Only humans are expected to do that, but our attacker didn’t exactly behave like a human.

Eventually, we have decided to investigate our spammer and what we have found is a little-known secret of how automated web browsers like PhantomJS are abused by spammers for their purposes. This sort of attack dates back to at least 2013, yet little information is available on the Internet.

To help raise awareness among the web developer and administrator communities, we have published a case study on our investigation and contributed a few ideas for detecting the new kind of spambots.

Case study: Headless browser use in web forum spam (809kB PDF)

The Abusive Host Blocking List (AHBL) was a DNS Blacklist operated since 2003 by a division of the Summit Open Source Development Group (SOSDG), a developer of open source technologies. AHBL provided the community with high quality database of known problematic IPs on the Internet. The service was shut down on March 29, 2014 and it no longer contains any IP data.

Please remove AHBL from your list of ORF DNS Blacklist definitions (see instructions).

Vamsoft would like to say thank you on behalf of the ORF administrators to the blacklist operators for their dedicated work in the past eleven years.